chore: dismiss Dependabot review requests

[Pigbibi]

What changed

• dismiss Pigbibi review requests automatically generated for Dependabot PRs
• recognize both dependabot[bot] and app/dependabot identities
• require the review-request event actor to be Dependabot
• re-check the latest Pigbibi review-request actor from the PR timeline immediately before deletion
• preserve later or concurrent review requests made by maintainers
• keep concurrent review-request runs instead of cancelling the matching cleanup
• use pull_request_target with metadata-only GitHub API access and no checkout

Why

These repositories already auto-merge eligible non-major Dependabot updates after CI, but CODEOWNERS creates redundant review notifications. Event-actor and timeline checks let the workflow remove only bot-generated requests without touching human review requests, including race conditions while a run is queued.

Validation

• verified automatic CODEOWNERS timeline actor on a historical Dependabot PR
• verified both supported Dependabot identities
• verified requested reviewer, event actor, and latest timeline actor conditions
• verified API errors fail instead of being treated as no match
• verified no checkout or execution of PR code
• bash syntax check
• git diff --check

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 2 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Reliability in .github/workflows/dependabot_review_request_cleanup.yml

The workflow checks the latest review_requested timeline actor and then unconditionally deletes the reviewer in a separate API call. If a maintainer manually re-requests Pigbibi after the timeline query but before the DELETE executes, this job will still remove that fresh manual request because GitHub only stores the current requested reviewer state, not distinct request instances. This is reachable on pull_request_target because the job runs asynchronously from the original Dependabot-triggered event and there is no atomic compare-and-delete step. (line 46)

Suggestion: Re-read the timeline or requested-reviewer state immediately before deletion and abort if the latest matching review_requested event is no longer from Dependabot, or use a narrower API flow that validates the current request origin as close as possible to the DELETE.

2. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

The timeline query is hard-limited to per_page=100 and does not follow pagination, but the code assumes [-1] is the latest matching request. On a Dependabot PR with more than 100 timeline events, the API will only return the first page, so this can inspect an older review_requested event and make the wrong decision: it may delete a maintainer's later manual request or fail to remove the current automatic one. (line 41)

Suggestion: Paginate through the timeline until the newest page is examined, or request pages in descending order if supported and explicitly select the true latest matching review_requested event before deciding to delete.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0b0824267e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 52b99adde7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3de4825807

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Paginate timeline events before choosing the latest request

For a Dependabot PR with more than 100 timeline events, this only inspects the first API page, so [-1] need not be the latest Pigbibi request. If Dependabot made the original request in that page and a maintainer re-requested review later, the job identifies the old Dependabot actor and deletes the currently pending manual request, defeating the preservation check. Fetch all pages (or otherwise query the newest matching event) before deciding to remove it.

Useful? React with 👍 / 👎.