fix Dependabot review request races

[Pigbibi]

What changed

• read the complete paginated PR timeline before identifying the latest review-request actor
• re-check the latest actor after deletion
• restore Pigbibi automatically if a maintainer requested review while cleanup was running

Why

This closes the remaining race between validating a bot-generated review request and deleting it. Human requests are preserved whether they happen before, during, or after the cleanup operation.

Validation

• bash syntax check
• git diff --check
• no PR code checkout or execution

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

latest_review_request_actor() filters the timeline down to review_requested events only, so after the DELETE it can decide to restore Pigbibi based on an older human request even if the most recent timeline event for that reviewer was a later review_request_removed. This is reachable through the current workflow entry point whenever a maintainer requests review during cleanup and then cancels it before the second check; the job will re-add Pigbibi even though no human request is active anymore, producing incorrect review state on the PR. (line 35)

Suggestion: Compute the latest timeline event for this reviewer across both review_requested and review_request_removed, and restore only when the latest relevant event is a human-authored review_requested rather than a removal.

---

Review by Codex PR Review bot • PR