Skip to content

fix Dependabot review request races#129

Merged
Pigbibi merged 1 commit into
mainfrom
agent/harden-dependabot-review-races
Jul 20, 2026
Merged

fix Dependabot review request races#129
Pigbibi merged 1 commit into
mainfrom
agent/harden-dependabot-review-races

Conversation

@Pigbibi

@Pigbibi Pigbibi commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator

What changed

  • read the complete paginated PR timeline before identifying the latest review-request actor
  • re-check the latest actor after deletion
  • restore Pigbibi automatically if a maintainer requested review while cleanup was running

Why

This closes the remaining race between validating a bot-generated review request and deleting it. Human requests are preserved whether they happen before, during, or after the cleanup operation.

Validation

  • bash syntax check
  • git diff --check
  • no PR code checkout or execution

Co-Authored-By: Codex <noreply@openai.com>
@github-actions

Copy link
Copy Markdown

🤖 Codex PR Review

Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

The post-delete restore decision only inspects the latest review_requested actor and ignores later review_request_removed timeline events. If Pigbibi was originally requested by Dependabot, a maintainer later requested the same reviewer, and then that maintainer removed the request while this cleanup job was running, latest_review_request_actor() still returns the maintainer and the new POST /requested_reviewers call re-adds Pigbibi even though the latest human action was to remove the reviewer. This is a reachable race on the PR timeline and produces the wrong review-request state. (line 66)

Suggestion: Base the restore decision on the latest reviewer-related timeline event for that reviewer, not just the latest review_requested event. Only restore when the most recent event is a human review_requested; if the most recent event is review_request_removed or the reviewer is no longer requested, do not re-add them.


Review by Codex PR Review bot • PR

@Pigbibi
Pigbibi merged commit 8306d96 into main Jul 20, 2026
3 checks passed
@Pigbibi
Pigbibi deleted the agent/harden-dependabot-review-races branch July 20, 2026 06:24

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b86dcb2ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +68 to +70
gh api --method POST \
"repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/requested_reviewers" \
-f "reviewers[]=${REVIEWER}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid restoring a subsequently removed review request

If a maintainer removes Pigbibi's review request after the second timeline read but before this POST, the most recent review_requested event still identifies that maintainer, so this branch recreates the request they intentionally canceled. The cleanup workflow should also account for a later review_request_removed event (or re-check the current review-request state) before restoring it.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant