Repository navigation
[probe, do not merge] What may GITHUB_TOKEN do to reviews on a protected base - #148
FeliLucero1 wants to merge 1 commit into
Conversation
Temporary, not for merge. Measures three things the auto-dismiss vs judge decision turns on: whether the bot can dismiss a review it authored, whether branch protection blocks that, and whether the bot can submit APPROVE at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
probe: can the author of a review dismiss it?
Superseded — see the current review report for commit
|
| probe "3. submit APPROVE" POST "repos/${REPO}/pulls/${PR}/reviews" \ | ||
| -f commit_id="${SHA}" -f event=APPROVE -f body="probe: approve" | ||
| echo "RESULT 3 submit APPROVE: rc=${LAST_RC}" |
There was a problem hiding this comment.
🟡 Suggestion (medium confidence): if probe 3 works, github-actions[bot]'s APPROVE stays on the PR, and nothing here dismisses it. If the repo allows Actions to approve PRs, that approval can count toward required reviews on protected main until the PR is closed. Consider dismissing the APPROVE review id right after logging RESULT 3 (this also tells you whether the bot can dismiss an APPROVE as well as a CHANGES_REQUESTED).
| probe "4. final review states" GET "repos/${REPO}/pulls/${PR}/reviews" | ||
| echo "RESULT 4 states=$(printf '%s' "${LAST_OUT}" | jq -r '[.[]|{id,state,user:.user.login}]|tostring' 2>/dev/null)" |
There was a problem hiding this comment.
🟡 Suggestion (low confidence): general-pr-review also runs on this PR and submits reviews as github-actions[bot]. Probe 4's list can therefore mix in that workflow's REQUEST_CHANGES/COMMENT reviews, and a synchronize re-run adds more probe reviews on top. Filter by the review ids this run created (or by body prefix probe:) so RESULT 4 can't be misread.
|
Probe done, results captured in #147. Conclusive on a PR targeting protected
The docs' protected-branch caveat ("you must be a repository administrator or be included in the list of people or teams who can dismiss") did not bite: that restriction only applies when a dismissal allow-list is actually configured, and none of our repos configure one. Closing without merging; the workflow file existed only on this branch. |
General PR Review: [probe, do not merge] What may GITHUB_TOKEN do to reviews on a protected baseBlocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0 Review SummaryThis PR adds one temporary workflow,
It then logs every review's state. I scanned the full diff for security and correctness. Permissions are kept to Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agentsReviewed commit: |
1 participant
Throwaway probe for the
verdict_modedecision in #147. Not for merge — this branch and PR get deleted as soon as the run is read.Measures, with the real
GITHUB_TOKENon a PR targeting protectedmain:github-actions[bot]submitREQUEST_CHANGES? (baseline does this today, so: control)APPROVEat all? — what judge mode in [CXH-2780] Let CI submit an approval, not only a block (verdict_mode) #147 depends on🤖 Generated with Claude Code