fix Dependabot review request races

[Pigbibi]

What changed

• read the complete paginated PR timeline before identifying the latest review-request actor
• re-check the latest actor after deletion
• restore Pigbibi automatically if a maintainer requested review while cleanup was running

Why

This closes the remaining race between validating a bot-generated review request and deleting it. Human requests are preserved whether they happen before, during, or after the cleanup operation.

Validation

• bash syntax check
• git diff --check
• no PR code checkout or execution

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

The post-delete restore decision only inspects the latest review_requested actor and ignores later review_request_removed timeline events. If Pigbibi was originally requested by Dependabot, a maintainer later requested the same reviewer, and then that maintainer removed the request while this cleanup job was running, latest_review_request_actor() still returns the maintainer and the new POST /requested_reviewers call re-adds Pigbibi even though the latest human action was to remove the reviewer. This is a reachable race on the PR timeline and produces the wrong review-request state. (line 66)

Suggestion: Base the restore decision on the latest reviewer-related timeline event for that reviewer, not just the latest review_requested event. Only restore when the most recent event is a human review_requested; if the most recent event is review_request_removed or the reviewer is no longer requested, do not re-add them.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b86dcb2ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid restoring a subsequently removed review request

If a maintainer removes Pigbibi's review request after the second timeline read but before this POST, the most recent review_requested event still identifies that maintainer, so this branch recreates the request they intentionally canceled. The cleanup workflow should also account for a later review_request_removed event (or re-check the current review-request state) before restoring it.

Useful? React with 👍 / 👎.