fix(ci): revalidate readiness when CodeRabbit finds new issues

[Wibias]

Summary

• allow CodeRabbit's own PR status-comment create/edit events to rerun the existing PR quality gate
• keep the write-capable issue_comment path restricted to CodeRabbit or canonical maintainers
• reuse the existing live Codex/CodeRabbit review-thread verifier instead of trusting comment text
• retain standalone CodeRabbit findings outside the current diff using CodeRabbit's stable cr-comment:v1:<id> identities
• add regression coverage for the CodeRabbit exception, maintainer guard, and durable outside-diff lifecycle

Root cause

PR #1163 was marked ready around 01:32 UTC. CodeRabbit then posted a new unresolved finding at 01:35:10 UTC and updated its normal PR status comment at 01:35:33 UTC.

The gate already listens for issue_comment edits and already knows how to invalidate the "Codex and CodeRabbit findings" checklist claim. However, its write-capable issue-comment guard only admitted canonical maintainers, so CodeRabbit's status-comment update was ignored. With no later privileged gate run, the PR stayed Ready for Review with review-ready despite the new finding.

A second edge case is tracked in #1182. CodeRabbit findings that cannot attach inline live in the review body. The previous gate supplemented those immutable review-body findings only while an unrelated bot review thread remained unresolved, so a standalone outside-diff finding could disappear from the gate when the last inline thread was resolved.

Why this signal

Direct pull_request_review_comment handling is not sufficient for contributor fork PRs because that event's GITHUB_TOKEN is read-only for forks. CodeRabbit's regular PR status comment produces an issue_comment event in the base repository, where the existing trusted gate can re-read the live review threads and reviews and perform its normal draft/label/checklist mutations.

The CodeRabbit status-comment body is not used as evidence. Its create/edit event is only a trigger signal; the gate verifies live review state through the existing trusted-base code.

Durable outside-diff findings

CodeRabbit embeds each finding that cannot be posted inline with a stable marker such as cr-comment:v1:<id>. The gate now reads those markers from the latest CodeRabbit review for the live head independently of normal review-thread state.

That means:

• a standalone outside-diff finding blocks readiness even when no inline bot thread exists
• the aggregate Actionable comments posted: N value is not used as the identity/count for marker-aware outside-diff findings, avoiding double-counting normal inline findings
• the latest CodeRabbit review on the same head is authoritative; when a later review omits an old marker, that bot-controlled review is the trusted resolution signal
• reviews from older heads and reviews from humans cannot keep the finding active
• older CodeRabbit review bodies without stable markers retain the previous bounded fallback while an inline bot thread remains unresolved

This keeps the resolution path entirely in trusted bot review state: no PR-head review workflow and no new privileged maintainer command are required.

Addresses #1182.

Behavior after this change

When CodeRabbit updates its PR status comment after a review:

1. the existing gate reruns
2. current CodeRabbit/Codex review threads and the latest current-head CodeRabbit review are re-read
3. any new unresolved inline or marker-backed outside-diff finding invalidates the findings checklist claim
4. the findings box is unticked
5. review-ready is removed
6. a Ready contributor PR is converted back to draft
7. a later clean CodeRabbit review on the same head clears marker-backed outside-diff findings without an empty commit

Normal non-maintainer comments still cannot invoke the write-capable gate.

Deployment note

GitHub only triggers issue_comment workflows when the workflow file exists on the repository's default branch. The repository default is main, while contributions target dev, so this new CodeRabbit path becomes active when this workflow revision is promoted to main.

Test plan

• regression test asserts issue_comment still handles created and edited
• regression test pins the CodeRabbit bot exception
• regression test pins the canonical-maintainer defensive guard
• regression tests pin CodeRabbit cr-comment identity parsing, standalone outside-diff blocking, no aggregate double-count, same-head clean-review resolution, head scoping, human-review exclusion, and marker de-duplication
• existing CI validates workflow and PR-gate behavior

Summary by CodeRabbit

• Bug Fixes

  • Pull request review checks can now be re-evaluated when CodeRabbit posts a status comment.
  • Comment-based checks remain restricted to pull requests and authorized contributors.
  • CodeRabbit findings are tracked consistently across reviews, including updates, duplicates, and later clean reviews.
  • Outside-diff findings are filtered to the current pull request revision and reviewer.

• Tests

  • Added automated coverage for CodeRabbit-triggered rechecks, authorization rules, and review finding state management.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR enables findings-gate reruns from authorized CodeRabbit pull-request comments. It adds stable outside-diff finding tracking, clean-review clearing, legacy count fallback, and workflow and state tests.

Changes

CodeRabbit revalidation

Layer / File(s)	Summary
Comment trigger and job guard .github/workflows/enforce-pr-target.yml	The workflow recognizes CodeRabbit status comments and permits CodeRabbit comments on pull requests.
Comment identity validation and workflow tests .github/workflows/enforce-pr-target.yml, tests/zz-pr-coderabbit-readiness-revalidation.test.ts	The workflow uses CODE_RABBIT_LOGIN for separate CodeRabbit validation. Other commenters still require allowed association and canonical maintainer membership. Tests verify triggers, conditions, trusted checkout selection, authorization, and unresolved-findings handling.
Stable outside-diff finding state .github/scripts/pr-quality-state.cjs, .github/scripts/pr-quality-outside-diff.test.cjs	The state logic selects the latest matching review for the live head, extracts and deduplicates cr-comment:v1 markers, clears findings after a clean review, and preserves legacy actionable-count fallback. Tests cover these behaviors.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CodeRabbit as CodeRabbit review
  participant GitHub as GitHub issue_comment event
  participant Actions as GitHub Actions job
  participant Gate as PR findings gate
  CodeRabbit->>GitHub: Publish review or status comment
  GitHub->>Actions: Emit pull-request comment event
  Actions->>Actions: Validate pull request and commenter
  Actions->>Gate: Recheck unresolved findings
  Gate->>CodeRabbit: Read latest live-head review markers
  CodeRabbit-->>Gate: Return deduplicated finding state

Loading

Possibly related PRs

• lidge-jun/opencodex#648: Modifies and tests the same enforcement workflow.
• lidge-jun/opencodex#1094: Extends related CodeRabbit finding handling.
• lidge-jun/opencodex#1123: Extends the issue-comment-triggered pull-request gate.

Suggested reviewers: ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: rerunning readiness validation when CodeRabbit reports new issues.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/revalidate-review-findings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/pr-coderabbit-readiness-revalidation.test.ts`:
- Around line 38-42: Strengthen the script-content assertions in the readiness
revalidation test so they verify the actual issue_comment rejection condition,
requiring !isCanonicalMaintainer within the branch where !isCodeRabbit is true.
Keep the existing symbol-presence checks, but add a focused assertion tied to
the authorization expression rather than merely matching predicates
independently.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 774eba9c-f2d6-4b8d-bd62-bf87b1ab63cc

📥 Commits

Reviewing files that changed from the base of the PR and between 1fc24f0 and 741aa91.

📒 Files selected for processing (2)

• .github/workflows/enforce-pr-target.yml
• tests/pr-coderabbit-readiness-revalidation.test.ts

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/enforce-pr-target.yml:
- Around line 45-48: Update the CodeRabbit-triggered issue_comment path in
enforce-pr-target.yml so the .github/scripts checkout uses
github.event.repository.default_branch (falling back to dev only when
appropriate) instead of the pull request base SHA. Make this selection
conditional on an explicit branch-policy decision, ensuring privileged script
execution is sourced from the repository’s default branch or otherwise blocked
until scripts are promoted there.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c99d4175-a40a-4a0c-be42-a16f56d307b1

📥 Commits

Reviewing files that changed from the base of the PR and between 44dce33 and be5857f.

📒 Files selected for processing (2)

• .github/workflows/enforce-pr-target.yml
• tests/zz-pr-coderabbit-readiness-revalidation.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/pr-quality-state.cjs:
- Around line 252-272: Update the sort comparator in
latestCodeRabbitReviewForHead to handle non-finite submittedAt values without
producing NaN: only subtract timestamps when both are finite, otherwise proceed
to the numeric review-ID tie-breaker. Add a regression case covering two
live-head CodeRabbit reviews with missing or invalid submitted_at values and
verify the higher review ID is selected deterministically.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 47c4ae59-5113-47b5-ab75-1215d526d945

📥 Commits

Reviewing files that changed from the base of the PR and between be5857f and d1cb1a0.

📒 Files selected for processing (2)

• .github/scripts/pr-quality-outside-diff.test.cjs
• .github/scripts/pr-quality-state.cjs

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/zz-pr-coderabbit-readiness-revalidation.test.ts`:
- Around line 36-38: Update the checkout ref assertion in the readiness
revalidation test to match the current enforce-pr-target workflow expression,
including its fallback to the documented dev integration branch. Preserve the
test’s validation of the remaining gate behavior and use the existing workflow
contract rather than introducing a different checkout expectation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b5656ab0-7c6e-41ee-af13-a7467b75d322

📥 Commits

Reviewing files that changed from the base of the PR and between d1cb1a0 and 5dae9e2.

📒 Files selected for processing (3)

• .github/scripts/pr-quality-outside-diff.test.cjs
• .github/scripts/pr-quality-state.cjs
• tests/zz-pr-coderabbit-readiness-revalidation.test.ts