Keep PR-batch review closeout autonomous - #160
Conversation
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![claude[bot]](https://avatars.github.com/in/1236702?s=60&v=4){kind=small}
Review: Keep PR-batch review closeout autonomous (#160)OverviewThis PR extends the address-review / pr-batch coordination contract in three main ways:
The change is almost entirely markdown "prompt spec" plus embedded shell/awk templates, mirrored verbatim across skills/address-review/SKILL.md, references/actions.md, references/templates.md, workflows/address-review.md, workflows/pr-processing.md, and skills/pr-batch/SKILL.md, with a large batch of new string-presence assertions in single_target_entrypoint_test.rb keeping the mirrors in sync. Findings posted inline
Other observations (no inline comment needed)
SecurityThe trust-boundary language is careful and consistent throughout (COORDINATED_AUTOFIX and COORDINATED_REVIEW_SOURCE_PR must come from trusted parent state, never from PR text, review comments, or branch content; live re-fetch plus ownership/pushability re-validation before acting on a source PR; never push the unpushable source PR; ITEM_SOURCE_PR explicitly barred from checkout, commit, or push use). No obvious injection or privilege-escalation issues found beyond the merge-authority scope-widening noted above. VerificationPer the PR description, bin/validate and the two Ruby test files were run and presumably pass (not re-run here). The new embedded bash/awk was not executed against live data beyond manual review, per the test-coverage note above. |
![chatgpt-codex-connector[bot]](https://avatars.github.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f89f4d37a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/address-review/references/templates.md`:
- Around line 309-312: Update the node ID validation in the item record check to
accept GitHub’s Base64 and Base64URL characters, including =, /, +, and -, while
preserving "-" as the existing standalone value and rejecting invalid or empty
IDs.
In `@skills/address-review/SKILL.md`:
- Around line 263-307: Update SOURCE_HAS_CHECKPOINT validation in
skills/address-review/SKILL.md lines 263-307 and workflows/address-review.md
lines 189-227: only suppress the source PR wait when a checkpoint comment is
authored by the expected review actor and contains the complete valid
source-state schema, rather than relying on marker presence alone. Apply
identical validation to both copies while preserving the existing first-harvest
behavior when validation fails.
- Around line 336-364: Gate SOURCE_REVIEW_CUTOFF_AT on successful parsing and
validation of the latest source-state checkpoint: in
skills/address-review/SKILL.md lines 336-364 and workflows/address-review.md
lines 239-258, leave the cutoff empty when the checkpoint is malformed or
incomplete, and only apply the latest valid summary checkpoint’s cutoff while
preserving the existing source inventory and filtering rules.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c43acea3-c2ba-4351-8fdf-b38a03efcf72
📒 Files selected for processing (9)
CHANGELOG.mdskills/address-review/SKILL.mdskills/address-review/bin/fetch-pr-review-data-test.rbskills/address-review/references/actions.mdskills/address-review/references/templates.mdskills/pr-batch/SKILL.mdskills/pr-batch/bin/single_target_entrypoint_test.rbworkflows/address-review.mdworkflows/pr-processing.md
Address-review summaryScan scope: full PR history; no prior address-review summary cutoff. Mattered
Optional
Skipped
Autonomously resolved threads
Validation: Next default scan starts after this comment. Say |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b270b5c7c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review: Keep PR-batch review closeout autonomous (#160)OverviewThis is a documentation/spec-only PR (9 files, ~1063/-139 lines) touching the
Code quality / consistency
Security
Other notes
No blocking issues found. The two inline comments above are a minor consistency nit and a design-awareness callout, not correctness bugs. |
Address-review summaryScan scope: review activity after 2026-07-15T01:31:52Z. Mattered
Optional
Skipped
Autonomously resolved threads
Validation on Next default scan starts after this comment. Say |
Review SummaryThis PR is a spec/documentation-only change (no application code) that (1) decouples trusted PR-batch coordinated review closeout from merge_authority: auto_merge_when_gates_pass, replacing it with evidence-backed per-item fix now / defer / decline / ask user recommendations, and (2) adds a "replacement PR carryover" mechanism so review feedback on an unpushable original PR can be triaged, fixed, and replied-to via a pushable replacement PR while routing replies back to the original threads. What the PR does:
Correctness:
Security:
Test coverage:
Maintainability note:
No blocking correctness or security issues found; the two inline comments are suggestions for reviewer awareness and follow-up hardening, not blockers. |
Address-review summaryScan scope: review activity after 2026-07-15T01:47:14Z. Mattered
Optional
Skipped
Autonomously resolved threads
Current head Next default scan starts after this comment. Say |
Final-head QA evidenceQA required: yes — this PR changes developer workflow and autonomous review behavior. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6be9b022b9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address-review summaryScan scope: review activity after 2026-07-15T01:54:37Z. Must-fix
Autonomously resolved threads
Current head 1644340: focused tests, diff checks, RuboCop, and the full bin/validate suite pass locally. The fix was delivered in one fast-forward push. Hosted current-head checks are pending and will be polled before handoff. Next default scan starts after this comment. Say check all reviews to rescan the full PR. |
Review summaryThis PR is almost entirely a prose/spec change to the What it does
Strengths
Findings posted inline
Other observations (not blocking)
No correctness bugs found in the actual logic (cutoff computation, row schema, dedup-by-identity semantics, mutual exclusion between primary/source PR mutations) — the two items above are consistency/coverage gaps rather than exploitable defects. |
Address-review summaryScan scope: review activity after 2026-07-15T02:08:37Z. Optional
Skipped
Autonomously resolved threads
Current head 1644340: local full bin/validate and hosted validate passed; Claude current-head review passed. No code changed and no additional push was made for this advisory-only pass. Next default scan starts after this comment. Say check all reviews to rescan the full PR. |
Final-head closeout evidenceCurrent head: 1644340. |
Review SummaryThis PR is a large (1420/-170 across 9 files) behavioral-spec change to the What it does
Strengths
Concerns
Nit
Overall this is a well-tested, carefully-scoped (if very large) extension of an existing autonomous-review-closeout system, with genuine executable test coverage for the trickiest new logic (the jq source-state validators). The main things worth a second look before merge are the autonomy/merge-authority decoupling (#1) and the maintenance cost of the multi-file duplication (#3). |
|
Final exact-head QA and priority disposition evidence for |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5aa2335579
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review SummaryThis PR extends the Overall: the change is well-specified and, unusually for this kind of prose/prompt spec, the embedded Points worth a maintainer's explicit sign-off (not bugs, but real policy/consistency changes):
No traditional injection/security issues spotted in the shell snippets — |
Review SummaryThis PR extends the What's solid
Issues found
Design/maintainability concern (not blocking, but worth flagging)This PR pushes the existing "prose must stay byte-identical across mirrors" pattern further: large blocks of near-identical text (the coordinated Note on verificationThe PR description lists |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b977f12a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review summaryThis PR is a large but internally-consistent extension of the address-review / pr-batch autonomy contract: it (1) decouples What I checked
Findings (posted inline, low severity)
Overall this looks like a careful, well cross-referenced change with good test coverage for the new cross-PR carryover mechanics (the |
Review: Keep PR-batch review closeout autonomous (#160)OverviewThis PR is entirely a "specification" change: it edits prose/markdown skill instructions (
Strengths
Concerns
No functional bugs found in the shell/jq/awk logic on static review; the two items above are judgment calls for maintainers rather than defects. |
|
Final merged-head QA and priority disposition evidence for |
* origin/main: Keep PR-batch review closeout autonomous (#160)
1 participant
Summary
fix now,defer, ordeclinerecommendation without another maintainer prompt.ask useroutcome, independent of merge authority.Verification
bin/validateruby skills/pr-batch/bin/single_target_entrypoint_test.rbruby skills/address-review/bin/fetch-pr-review-data-test.rbTrusted reviewer investigation
PR #8 predates the trusted-actor allowlist addition. The current trust preflight recognizes the configured bot reviewers, and an audit of the recent merged PR sample did not reproduce a missed trusted actor. No trusted-actor configuration change is included here; a newer concrete PR URL would be needed to isolate any separate current miss.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation