Skip to content

[Fix] Reviewed fork PRs cannot enter merge queue - #1455

Merged
edelauna merged 1 commit into
mainfrom
fix/fork-review-gate-merge-queue
Aug 30, 2026
Merged

[Fix] Reviewed fork PRs cannot enter merge queue#1455
edelauna merged 1 commit into
mainfrom
fix/fork-review-gate-merge-queue

Conversation

@zoomote

@zoomote zoomote Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

​Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

  • Publish a successful advisory review gate when a trusted reconciliation sees a fork PR ready for maintainer review.
  • Remove the fork-only pending gate phase while preserving read-only handling for fork-originated review events.
  • Update the workflow harness to cover the fork maintainer handoff.

Why this change was made

The main merge queue uses ALLGREEN, so it treats every reported status as blocking even when that status is not listed as required. The fork-only pending advisory gate left otherwise mergeable PRs such as #1443 unable to enter the queue after CI, CodeRabbit, and human approval all passed.

Impact

Reviewed fork PRs can enter the merge queue once they reach the maintainer handoff. Native required CI and review protections remain authoritative, and fork-originated review events still avoid privileged metadata writes.

There is no rendered extension UI change.

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Review process

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

  1. Required CI checks pass.
  2. The workflow starts CodeRabbit automatically.
  3. For eligible human-authored PRs, CodeRabbit reviews and approves the latest commit.
  4. A human maintainer reviews and approves after CodeRabbit.

Current step: The required review sequence passed. Remaining merge requirements apply.

@codecov

codecov Bot commented Aug 30, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@edelauna

Copy link
Copy Markdown
Contributor

@CodeRabbit review

@coderabbitai

coderabbitai Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e9ad6862-4040-4a53-bb48-580696ff257d

📥 Commits

Reviewing files that changed from the base of the PR and between ad05c1c and 8ec3ac7.

📒 Files selected for processing (2)
  • .github/workflows/label-pr-review-state.yml
  • src/services/__tests__/pr-review-state-workflow.test.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (1)
  • GitHub Check: platform-unit-test (windows-latest)
🧰 Additional context used
📓 Path-based instructions (9)
Check persistence and lifecycle invariants: awaited atomic writes, rollback or explicit partial-failure behavior, cross-window state consistency, stale listeners/watchers, cancellation, idempotency, and safe restart/resume without lost or d...

⚙️ CodeRabbit configuration file

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
Require regression coverage at the lowest valid harness with behavior-focused assertions, including relevant negative, error, false/unset, and boundary cases. Check cleanup and deterministic async behavior and prefer shared typed test helpe...

⚙️ CodeRabbit configuration file

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
Check strict typing and exhaustive behavior across normal, boundary, error, cancellation, retry, and compatibility paths. Verify promises and errors are handled, existing helpers are reused, and new code introduces no `any`, unjustified dou...

⚙️ CodeRabbit configuration file

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
Require full commit SHA pins, least-privilege permissions, safe expression and shell interpolation, and trusted metadata handling. Privileged workflows must never check out, execute, install from, or otherwise trust a fork PR head.

⚙️ CodeRabbit configuration file

Files:

  • .github/workflows/label-pr-review-state.yml
Verify extension/webview contracts, cancellation and error propagation, VS Code lifecycle correctness, and behavior under retries and partial failure. Check listeners, resources, and providers are disposed without stale state or duplicate w...

⚙️ CodeRabbit configuration file

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
Act as an adversarial second-opinion reviewer. Verify PR claims against implementation, contracts, and tests. Trace changed inputs through normal, boundary, error, cancellation, retry, and default paths and their consumers. Seek plausible c...

⚙️ CodeRabbit configuration file

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
Add focused tests for UI binding and save behavior, persistence or normalization, and the value returned by `getStateToPostToWebview()`, including true and false/unset cases when defaults could hide omissions.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
Fix lint violations in new TypeScript code instead of suppressing them.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
After editing a file, run ESLint with pruning and zero warnings for that relative file, and confirm its suppression count did not increase.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

  • src/services/__tests__/pr-review-state-workflow.test.ts
🔇 Additional comments (2)
.github/workflows/label-pr-review-state.yml (1)

291-291: LGTM!

Also applies to: 678-678

src/services/__tests__/pr-review-state-workflow.test.ts (1)

1389-1404: LGTM!


📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes
    • Fork-based pull requests now receive a successful review gate when ready for maintainer handoff.
    • Removed the separate pending approval state that could block eligible pull requests.
  • Tests
    • Updated workflow coverage to verify successful maintainer handoff behavior for fork-based pull requests.

Walkthrough

The workflow no longer applies a fork-specific failing gate during the ready-for-maintainer phase. The test now verifies that fork pull requests receive a successful gate with a “Ready for human maintainer” description.

Changes

Fork PR maintainer handoff

Layer / File(s) Summary
Pass the maintainer handoff gate
.github/workflows/label-pr-review-state.yml, src/services/__tests__/pr-review-state-workflow.test.ts
The workflow uses a passing gate for all ready-for-maintainer pull requests. The test verifies this behavior for scheduled fork pull requests with CodeRabbit approval.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 8ec3a

Reviewed fork pull requests will receive a passing advisory gate at the maintainer handoff while required CI and review protections remain authoritative; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: edelauna

🚥 Pre-merge checks | ✅ 5 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the change, reason, impact, and lack of UI changes. It does not include the required linked GitHub Issue, detailed Test Procedure, or completed Pre-Submission Checklist. Add an approved issue reference such as "Closes: #123". Add reproducible test steps, including the test command and expected fork maintainer-handoff result. Complete the Pre-Submission Checklist and include required documentation or contact…
Regression Evidence ⚠️ Warning The PR changes both fork maintainer and fork approved handoffs to publish a successful gate. The updated test covers only the fork maintainer phase, with CodeRabbit approval and no maintainer ap… Keep the maintainer-handoff test and add a focused fork test with CodeRabbit approval, a later permitted maintainer approval, and eventName: "schedule". Assert a successful review gate with the approved-phase description, such as `"requ…
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: fixing reviewed fork pull requests that cannot enter the merge queue.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Trust And Persistence Invariants ✅ Passed The pull request introduces no violations of trust and persistence invariants. ## Summary of Changes The PR modifies two files: 1. .github/workflows/label-pr-review-state.yml - Removes special fork …
Full details: Description check

Resolution

Add an approved issue reference such as "Closes: #123". Add reproducible test steps, including the test command and expected fork maintainer-handoff result. Complete the Pre-Submission Checklist and include required documentation or contact details where applicable.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

Full details: Regression Evidence

Explanation

The PR changes both fork maintainer and fork approved handoffs to publish a successful gate. The updated test covers only the fork maintainer phase, with CodeRabbit approval and no maintainer approval. It removes the previous fork test's maintainer approval, so no focused test now covers a fork PR after a valid maintainer approval, where the new code uses the approved phase and description. Existing approval tests use same-repository PRs.

Resolution

Keep the maintainer-handoff test and add a focused fork test with CodeRabbit approval, a later permitted maintainer approval, and eventName: "schedule". Assert a successful review gate with the approved-phase description, such as "required review sequence passed".

Full details: Trust And Persistence Invariants

Explanation

The pull request introduces no violations of trust and persistence invariants. ## Summary of Changes The PR modifies two files: 1. .github/workflows/label-pr-review-state.yml - Removes special fork PR handling at the maintainer handoff stage 2. src/services/__tests__/pr-review-state-workflow.test.ts - Updates test to verify the new behavior ## Key Change Previously, when a fork PR reached the maintainer handoff (readyForMaintainer condition), the workflow published a PENDING gate with the message "Fork review completed. Native GitHub review protections remain authoritative." The new code publishes a SUCCESS gate with the actual phase message instead. ## Security Analysis The change does not introduce the failure conditions listed in the custom check: 1. No secrets or PII leakage: The updateReviewGate function operates on public data (PR head SHA and HTML URL). No sensitive information is exposed. 2. No unvalidated input trust: Input originates from authenticated GitHub API calls. No user-supplied or unvalidated data is executed. 3. No approval bypass: The gate state still depends on prior workflow validation. The PR must pass CodeRabbit approval before reaching the readyForMaintainer condition. The phase logic (maintainerApprovedAfterCodeRabbit) is unchanged and enforces approval requirements. 4. No state loss: The updateReviewGate call is properly awaited. No async function calls lack await, no non-atomic writes, and no omitted default propagation occurs. 5. No lifecycle resource leaks: No new connections or resources are opened without cleanup. The workflow uses standard GitHub API calls with proper error handling. ## Fork PR Protection Retained The workflow retains its fork-protection mechanism: updateReviewGate includes an early return when isReadOnlyRun && isForkPR(pr) is true. This guard prevents write operations on fork PRs triggered by pull_request_review events (which run from a fork with limited permissions). The change only affects non-read-only runs (schedule and pull_request_target events), where the workflow has appropriate permissions to publish status updates for reviewed fork PRs entering the merge queue.

  • Fix all pre-merge checks with AI
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/fork-review-gate-merge-queue

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

src/services/__tests__/pr-review-state-workflow.test.ts

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@edelauna
edelauna marked this pull request as ready for review August 30, 2026 18:40
@edelauna
edelauna added this pull request to the merge queue Aug 30, 2026
Merged via the queue into main with commit b18b6f0 Aug 30, 2026
30 checks passed
@edelauna
edelauna deleted the fix/fork-review-gate-merge-queue branch August 30, 2026 19:19
WHMHammer pushed a commit to WHMHammer/Zoo-Code that referenced this pull request Aug 31, 2026
Co-authored-by: Roomote <roomote@roomote.dev>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants