chore: dismiss Dependabot review requests

[Pigbibi]

What changed

• dismiss Pigbibi review requests automatically generated for Dependabot PRs
• recognize both dependabot[bot] and app/dependabot identities
• require the review-request event actor to be Dependabot
• re-check the latest Pigbibi review-request actor from the PR timeline immediately before deletion
• preserve later or concurrent review requests made by maintainers
• keep concurrent review-request runs instead of cancelling the matching cleanup
• use pull_request_target with metadata-only GitHub API access and no checkout

Why

These repositories already auto-merge eligible non-major Dependabot updates after CI, but CODEOWNERS creates redundant review notifications. Event-actor and timeline checks let the workflow remove only bot-generated requests without touching human review requests, including race conditions while a run is queued.

Validation

• verified automatic CODEOWNERS timeline actor on a historical Dependabot PR
• verified both supported Dependabot identities
• verified requested reviewer, event actor, and latest timeline actor conditions
• verified API errors fail instead of being treated as no match
• verified no checkout or execution of PR code
• bash syntax check
• git diff --check

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

The workflow fetches only the first 100 timeline events (?per_page=100) and then treats the last matching review_requested event in that truncated page as the latest request actor. On a Dependabot PR with more than 100 timeline events, a newer manual review request by a maintainer can fall onto a later page and be invisible here, while an older automatic CODEOWNERS request by Dependabot remains in the first page. In that reachable case, the workflow will incorrectly conclude the latest request came from Dependabot and delete the current maintainer review request. (line 38)

Suggestion: Page through the timeline until the end, or request events in descending order and inspect the first matching review_requested event, so the actor check is based on the true most recent review-request event before deleting the reviewer.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b83dffac8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2af51a7b49

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4198b403e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2a496b0868

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use a review-request event that GitHub emits

pull_request_target does not emit the review_requested activity type (its supported activities are limited to assigned/unassigned, labeled/unlabeled, opened, synchronize, reopened, and closed). Consequently this workflow will never start when CODEOWNERS requests Pigbibi's review, so the requested review remains in place for every Dependabot PR.

Useful? React with 👍 / 👎.