fix(ci): port workflow hardening follow-ups to dev

[Wibias]

Summary

• port the follow-up workflow hardening fixes discovered while promoting merged PR fix(ci): harden comment-driven review workflows #1255 to main in PR fix(ci): promote workflow comment-spam hardening to main - Hotfix #1265 back onto current dev
• prevent a future dev -> main merge from restoring the older fix(ci): harden comment-driven review workflows #1255 behavior over the hardened main implementation
• keep this sync intentionally limited to the five files whose final fix(ci): promote workflow comment-spam hardening to main - Hotfix #1265 blobs differ from the versions already merged by fix(ci): harden comment-driven review workflows #1255

Follow-up fixes carried back to dev

• authenticate the CodeRabbit status producer before allowing privileged revalidation
• keep the shared gate/hygiene concurrency lock PR-stable across head changes
• make resolve-pr the single PR-resolution authority and pass its output into the write-capable job
• authorize gui-screenshot-waived from durable label-event provenance instead of the current wake-up event sender, failing closed when provenance cannot be established
• explicitly scope the write job permissions and update the workflow harness/regressions to cover the hardened contracts without brittle full-expression matching

Scope

Exactly five files differ from current dev:

• .github/workflows/enforce-pr-target.yml
• .github/workflows/pr-hygiene.yml
• tests/ci-workflows.test.ts
• tests/helpers/enforce-pr-target-harness.ts
• tests/zz-pr-coderabbit-readiness-revalidation.test.ts

The other five files originally promoted from #1255 are unchanged between #1255-final and #1265-final and are deliberately not included here.

Validation

The exact final versions being ported are the versions validated on #1265:

• focused workflow suite: 128/128 pass
• workflow helper suite: 451/451 pass
• typecheck: pass
• privacy scan: pass
• git diff --check: pass

This branch is built directly on the current dev head and is exactly one commit ahead / zero commits behind.

Summary by CodeRabbit

• Bug Fixes

  • Improved pull request validation to reliably identify the correct open pull request across revisions.
  • Added safeguards to reject unverified status events and unauthorized screenshot waiver labels.
  • Prevented stale or incomplete status information from incorrectly marking checks as ready.
  • Improved workflow coordination so updates for the same pull request are processed consistently.

• Tests

  • Expanded coverage for event validation, maintainer authorization, pull request resolution, and fail-closed behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a8b91a02-3289-41e3-8820-565485c291f7

📥 Commits

Reviewing files that changed from the base of the PR and between fdc47db and f7448e7.

📒 Files selected for processing (5)

• .github/workflows/enforce-pr-target.yml
• .github/workflows/pr-hygiene.yml
• tests/ci-workflows.test.ts
• tests/helpers/enforce-pr-target-harness.ts
• tests/zz-pr-coderabbit-readiness-revalidation.test.ts

---

📝 Walkthrough

Walkthrough

The PR separates trusted PR resolution from write-capable enforcement, changes concurrency keys to PR numbers, verifies maintainer-applied screenshot waivers, and updates workflow tests and harness fixtures for resolver outputs and status events.

Changes

Pull request enforcement

Layer / File(s)	Summary
Resolve PR identity before enforcement .github/workflows/enforce-pr-target.yml:28-220, tests/ci-workflows.test.ts:830-1133, tests/zz-pr-coderabbit-readiness-revalidation.test.ts:45-78	A read-only resolve-pr job validates CodeRabbit status events and resolves one open PR by current head. enforce-target consumes RESOLVED_PULL_NUMBER and fails closed when the identity is invalid or absent.
Authorize waivers and serialize PR state .github/workflows/enforce-pr-target.yml:543-654, .github/workflows/pr-hygiene.yml:14-17, tests/ci-workflows.test.ts:2678-2785	Screenshot waivers require a label event from a listed maintainer. Checklist staleness handling excludes status events without a head SHA. Hygiene concurrency uses the PR number.
Model resolver inputs and validate workflows tests/helpers/enforce-pr-target-harness.ts:66-1110, tests/zz-pr-coderabbit-readiness-revalidation.test.ts:10-78	The harness supports issue-event fixtures, sender identity, pagination, resolved PR numbers, and step environments. Tests cover resolver guards, authorized and unauthorized waivers, and status-event enforcement.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant StatusEvent
  participant resolve-pr
  participant GitHubAPI
  participant enforce-target
  StatusEvent->>resolve-pr: trusted status metadata and SHA
  resolve-pr->>GitHubAPI: resolve one open PR at the current head
  GitHubAPI-->>resolve-pr: pull request number
  resolve-pr->>enforce-target: RESOLVED_PULL_NUMBER
  enforce-target->>GitHubAPI: perform PR enforcement

Loading

Possibly related PRs

• lidge-jun/opencodex#1255: Introduced related workflow, concurrency, test, and harness changes.
• lidge-jun/opencodex#1265: Modified the same enforcement workflow and related resolver and waiver behavior.
• lidge-jun/opencodex#1175: Added the related CodeRabbit status-event revalidation flow.

Suggested labels: chore

Suggested reviewers: lidge-jun, ingwannu

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/workflow-hardening-followups-dev

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• UI screenshot required.

What to do

• Add a screenshot of the UI change to the PR description.

Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.