fix Dependabot review request races

[Pigbibi]

What changed

• read the complete paginated PR timeline before identifying the latest review-request actor
• re-check the latest actor after deletion
• restore Pigbibi automatically if a maintainer requested review while cleanup was running

Why

This closes the remaining race between validating a bot-generated review request and deleting it. Human requests are preserved whether they happen before, during, or after the cleanup operation.

Validation

• bash syntax check
• git diff --check
• no PR code checkout or execution

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

The restore branch keys only off the last review_requested actor and never checks for a newer review_request_removed event or the current requested-reviewer state. If a maintainer requests Pigbibi while cleanup is running and then removes that request before the second latest_review_request_actor call, the timeline still ends with the maintainer's review_requested event, so this code will POST the reviewer back and undo the maintainer's explicit removal. (line 68)

Suggestion: Before restoring, verify that Pigbibi is currently absent because of this cleanup race rather than an intentional later removal. A safe fix is to compare the latest relevant timeline event for that reviewer across both review_requested and review_request_removed, or re-read gh pr view --json reviewRequests after deletion and restore only when the latest reviewer-specific event is a human review_requested.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d5c95b206

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor review-request removals before restoring

If a maintainer requests Pigbibi after the DELETE and then removes that request before the second timeline read, this filter still reports the maintainer as the latest actor because it ignores the later review_request_removed event. The subsequent POST then re-adds a review request the maintainer intentionally cancelled. Check that Pigbibi is currently requested (or account for removal events) before performing the restore.

Useful? React with 👍 / 👎.