feat(pr-reviewer): fail closed on unresolved authors

Merged
KH
5mo ago
+1326-80

User description

Summary\n- Fail closed when REVIEW_AUTHORS is configured but the PR author cannot be resolved.\n- Keep unset allowlists open, and keep the non-member skip branch intact.\n- Restage the pr-reviewer bundle, runner, and persona artifacts so deployment uses the updated behavior.\n\n## Validation\n- npm run test:review\n- 4/4 focused reviewer tests passing\n\n## Notes\n- Bundle drift is confined to the restaged reviewer patch set and generated deployment artifacts.\n- Repo-wide npm test is still blocked by the separate linear-tsc lane, which is intentionally out of scope here.

Summary by cubic

Fail closed when REVIEW_AUTHORS is set but the PR author can’t be resolved, preventing unintended reviews. Also updates the persona/runner and adds a small esbuild-based test harness.

  • New Features

    • Strict author allowlist: skip when the author is unresolved or not in REVIEW_AUTHORS; if unset, review all authors.
    • Persona updates: add optional REVIEW_AUTHORS and SKIP_LABELS (defaults to "no-agent-relay-review"), make SLACK_CHANNEL optional, declare github/slack integrations, set cloud: true.
    • Runner now accepts agents exported via defineAgent and forwards triggers/schedules/watch.

  • Refactors

    • Restaged pr-reviewer bundle and deployment artifacts.
    • Added scripts/test.mjs, npm run test:review, focused allowlist tests, and dev dependency on esbuild for building test targets.

CodeAnt-AI Description

Skip reviews when the PR author cannot be confirmed

What Changed

  • When REVIEW_AUTHORS is set and the PR author cannot be resolved, the reviewer now skips the PR instead of proceeding.
  • PRs from authors not listed in REVIEW_AUTHORS are skipped with a clear reason.
  • The reviewer now exposes REVIEW_AUTHORS in its settings, makes the Slack channel optional, and keeps its GitHub/Slack connections declared for deployment.
  • Added focused tests for allowed authors, blocked authors, unresolved authors, and the open-allowlist case.

Impact

✅ Fewer unintended PR reviews
✅ Clearer skip reasons for author-based review rules
✅ Safer review gating when author data is missing

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.