ci(auto-approve): retry the approval on GitHub API errors

[ilya-bogin-keenable]

Makes the approval bridge survive transient GitHub API errors.

• Problem: a single GitHub API error silently dropped the bridge approval, as with HTTP 502 during the 2026-10-12 incident (keenable-eval #2061, keenable-infra #758).
• Fix: the approval is retried up to 4 times, with 20/40/60 s backoff inside the existing 5-min job timeout.
• No double approvals: each attempt re-reads the PR head and the dedupe check, so a retry after a partial success never approves twice.
• Everything else is unchanged: trigger, Qodo-login check, job-level concurrency and verdict quoting.
• Tested: actionlint and shellcheck are clean. A fake-gh harness covered two 502s then success (exactly one approval), approval already present (no duplicate) and a persistent failure (exit 1 after 4 attempts).

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Retry auto-approval after transient GitHub API failures

🐞 Bug fix 🕐 10-20 Minutes

AI Description

• Retry failed bridge approvals up to four times with backoff, rather than losing them after one API
 error.
• Recheck the PR head and existing approvals on every attempt to avoid duplicate approvals.

Diagram

graph TD
  E["Qodo comment"] --> V["Parse verdict"] --> H["Fetch head/reviews"] --> D{"Already approved?"} -->|No| A["Post approval"] -->|Success| S["Done"]
  D -->|Yes| S
  H -->|API failure| R{"Attempts left?"}
  A -->|API failure| R
  R -->|Yes, after backoff| H
  R -->|No| F["Fail job"]

Loading

High-Level Assessment

Keep the retry loop within the existing workflow: it preserves the trigger and approval body while reusing the head-based deduplication on every attempt. A separate action or workflow would add dependencies without improving this single-step recovery path.

Files changed (1) +28 / -10

Bug fix (1) +28 / -10

auto-approve.ymlRetry failed approvals with per-attempt deduplication +28/-10

Retry failed approvals with per-attempt deduplication

• Moves the head and existing-review checks into an approval function that runs on every attempt. Retries failed GitHub calls up to four times with 20/40/60-second backoff, and fails the job if all attempts fail; verdict parsing and approval text remain unchanged.

.github/workflows/auto-approve.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Retries can approve unreviewed commits 🐞 Bug ≡ Correctness

Description

approve_once fetches the current PR head on every attempt rather than pinning the approval to the
head from the initial attempt. If an API call fails and a new commit is pushed during a retry delay,
the next attempt can approve that new head while quoting the earlier Qodo comment's verdict and URL.

Code

.github/workflows/auto-approve.yml[63]

+            head_sha=$(gh api "repos/$REPO/pulls/$NUM" --jq .head.sha) || return 1

Evidence

Only comment creation or editing triggers this job, so a push during its retry delay does not start
a replacement run. Each attempt reads the then-current head, while the review body continues to use
the verdict and URL from the triggering comment; the retry loop explicitly waits before repeating
those steps.

.github/workflows/auto-approve.yml[13-26]
.github/workflows/auto-approve.yml[43-48]
.github/workflows/auto-approve.yml[59-71]
.github/workflows/auto-approve.yml[76-84]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A failed attempt can be retried after the PR head changes, causing an approval for a commit that was not present when the Qodo comment triggered the run.

## Fix Focus Areas
- .github/workflows/auto-approve.yml[59-71]
- .github/workflows/auto-approve.yml[73-84]

## Recommended Fix
Capture the intended head before entering the retry loop. On each attempt, abort rather than approve if the current head differs; submit the approval against the captured commit ID so a push between the check and submission cannot redirect it to a newer head.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

Context sources

Review mode: Auto: ⚖️ Balanced: Behavioral CI retry logic affects repository approvals and GitHub API interactions.

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Retries can approve unreviewed commits 🐞 Bug ≡ Correctness

approve_once fetches the current PR head on every attempt rather than pinning the approval to the
head from the initial attempt. If an API call fails and a new commit is pushed during a retry delay,
the next attempt can approve that new head while quoting the earlier Qodo comment's verdict and URL.

Agent Prompt

## Issue description
A failed attempt can be retried after the PR head changes, causing an approval for a commit that was not present when the Qodo comment triggered the run.

## Fix Focus Areas
- .github/workflows/auto-approve.yml[59-71]
- .github/workflows/auto-approve.yml[73-84]

## Recommended Fix
Capture the intended head before entering the retry loop. On each attempt, abort rather than approve if the current head differs; submit the approval against the captured commit ID so a push between the check and submission cannot redirect it to a newer head.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

[github-actions]

Auto-approved: Qodo review completed — 🐞 Bugs (1),📘 Rule violations (0) 📜 Skill insights (0). Findings are advisory per team policy; verdict source: #74 (comment) [auto-approve.yml]

[ilya-bogin-keenable]

/agentic_review

[qodo-code-review]

No code changes since the last review — review skipped