feat: hunk filters (externally decided already-reviewed hunks)

[asyncawaitpromise]

Summary / Background

When an approval is checked, the diff is taken twice from the same merge base, once to the head and once to the approved commit, and the hunks appearing in both are subtracted. What is left is what the reviewer has not seen, and if any of it is theirs, the approval is dismissed.

That subtraction compares text, so a hunk which changed for a reason a particular codebase does not care about still counts as unreviewed. Whether that is right depends on the codebase: in one repository a reformat is noise, in another the formatter changing its mind is what somebody needs to look at. Picking one on a repository's behalf means every consumer inherits it, along with the language-awareness it takes to stay correct.

This adds the seam and no policy. The new hunk-filter input names a program which receives the hunks still outstanding against an approval, alongside the hunks that approval introduced, and answers which of them the reviewer has effectively already reviewed.

Behavior

• hunk-filter (default empty, so unset means no change at all): path to an executable. It reads one JSON object on stdin and writes one on stdout, naming already-reviewed hunks by index. Format documented in the new README section.
• Both sides of the diff are sent, because a hunk rewritten since approval looks like new code on its own and only looks like reviewed code next to the text the reviewer saw.
• A filter can only narrow what an approval answers for. It cannot add hunks, name a file it was not sent, alter ownership, or request or grant an approval. Ownership resolution and the staleness check run unchanged on whatever hunks survive.
• Every failure leaves the diff exactly as computed and logs a warning: missing or non-executable program, non-zero exit, no result within 60s, output that is not a single JSON object of the known shape, or a file or index that was not sent.
• Bounded at 60s and 8MB of output per call, executed directly instead of through a shell, once per distinct approved commit.

Implementation notes

• NewDiff and NewDiffWithExecutor gain a variadic ...DiffOption parameter, so existing call sites keep compiling. Both live in internal/, so no external consumer can reach them either way.
• pkg/ only gains a new package (pkg/hook); nothing already exported changes.
• The filter runs inside changesSince, which is the only place both the head hunks and the approval-time hunks still exist as text.
• A filter acts in the direction of dismissing less, so it is worth being deliberate about which program a workflow names. The README covers this, including that a path inside GITHUB_WORKSPACE is writable by the PR author and is the wrong thing to point at.
• Design question: the response names hunks by index into the request. Naming them by content hash instead would survive reordering, at the cost of making the hook do the hashing. Happy to change it if you would prefer that.

Code Changes

• pkg/hook: wire contract, subprocess runner, response validation
• internal/git: DiffOption, WithHunkFilter, filtering in changesSince
• internal/app: hook wiring and the fail-safe policy
• main.go / action.yml: the hunk-filter input
• README.md: "Hunk Filters" section

Testing

• TestChangesSinceWithoutFilterIsUnchanged: with no filter configured the diff is byte-for-byte what it is today
• TestHunkFilterDropsOnlyWhatItNames, TestHunkFilterDroppingEveryHunkRemovesTheFile: the narrowing itself
• TestHunkFilterFailuresChangeNothing: error, index past the end, negative index, unsent file, empty answer
• TestHunkFilterOnlySeesSurvivingHunks: already-subtracted hunks are never offered to the filter
• TestIndexesAcceptsWhatWasSent, TestIndexesRejectsAnswersOutsideTheRequest: response validation, including that index order is deterministic
• TestRunReadsTheResponse, TestRunFailsLoudly, TestRunMissingHookIsAnError, TestRunHonoursTheDeadline: every runner failure mode, including a hook which outlives its own deadline
• TestAppHunkFilterAppliesAValidAnswer, TestAppHunkFilterAnswersNoneOnFailure, TestAppHunkFilterMissingHookAnswersNone: the fail-safe wiring end to end
• go test ./..., go vet ./..., golangci-lint run ./... clean

[gemini-code-assist]

Code Review

This pull request introduces 'Hunk Filters' to Codeowners Plus, allowing external tooling to determine which post-approval changes do not require re-review. It adds configuration options, updates the diff logic to apply the filter, and implements the hook execution package with comprehensive tests. The reviewer feedback highlights two key improvements: addressing non-deterministic map iteration in the hook response processing to prevent flaky behavior, and optimizing the hunk filter application by only parsing older diffs for files present in the survivors list.

[github-actions]

Codeowners approval required for this PR:

• @BakerNet or @zbedforrest

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
pkg/hook/hook.go	Defines the versioned hook contract, bounded subprocess runner, strict single-object JSON decoding, and response validation.
internal/git/diff.go	Adds optional hunk filtering to approval-time diff processing while preserving unfiltered behavior.
internal/app/app.go	Wires the action input into diff construction and treats hook failures as filtering no hunks.
action.yml	Exposes the optional hunk-filter path and forwards it to the executable.
main.go	Parses the hunk-filter input and passes it into application configuration.

Sequence Diagram

sequenceDiagram
    participant App
    participant Diff as Git diff processing
    participant Hook as Hunk filter
    participant Review as Approval evaluation
    App->>Diff: Compare merge base to head and approved commit
    Diff->>Diff: Subtract textually matching hunks
    alt Filter configured and outstanding hunks remain
        Diff->>Hook: Send outstanding and approval-time hunks
        Hook-->>Diff: Return reviewed hunk indexes
        Diff->>Diff: Validate response and remove named hunks
    end
    Diff-->>Review: Remaining changes since approval
    Review->>Review: Keep or dismiss approval

Loading

_{Reviews (2): Last reviewed commit: "fix: close four ways a filter could reac..." | Re-trigger Greptile}