PR Review Agent — failures detected 2026-05-08

[github-actions]

1. Executive Summary

Status: BLOCKING
Period: 2026-05-07T08:45:52Z – 2026-05-08T06:05:17Z
Result: 10 of 10 runs failed (100%)

Key findings:

• Bot authenticates as don-petry (GH_PAT_WORKFLOWS) and attempts to APPROVE PRs authored by don-petry, which GitHub's API forbids — this terminates every session on the first candidate PR
• Session-abort-on-any-failure logic (session_aborted=1) means one bad PR blocks all 13 remaining candidates in every batch
• Secondary script bug at review-one-pr.sh:137 (malformed integer comparison) fires on every run but is non-fatal; Copilot rubber duck always fails with unknown --target flag

Action required: Filter PRs whose author matches the reviewing identity from list-prs.sh, or treat "cannot approve own PR" as a skippable error rather than session-fatal.

---

2. Failure Breakdown

Failure Category	Affected Runs	Example Error Message
Cannot approve own PR (GitHub API)	10 / 10	failed to create review: GraphQL: Review Can not approve your own pull request (addPullRequestReview)
Session abort cascade (all other candidates skipped)	10 / 10	Session aborted early after failure on …/pull/1 (exit code 1). Skipped 13 remaining candidate(s)
Shell integer comparison bug	10 / 10	scripts/review-one-pr.sh: line 137: [: 0\n0: integer expression expected
Copilot CLI breaking change (--target flag removed)	4 / 10 (tier-2 runs)	error: unknown option '--target' (Did you mean --agent?)
Missing token scope (warning, non-fatal)	10 / 10	! Missing required token scopes: 'read:org'

---

3. Error Patterns

Pattern 1 — Cannot approve own PR

failed to create review: GraphQL: Review Can not approve your own pull request (addPullRequestReview)
ERROR: gh pr review failed with exit code 1

• Step: "Review each PR (cascade)" → scripts/review-one-pr.sh → scripts/post-pr-review.sh
• Root cause: GH_PAT_WORKFLOWS is a token belonging to don-petry. don-petry/self-private/pull/1 (always first in the candidate list) was authored by don-petry. GitHub's API unconditionally rejects self-approvals. The script calls gh pr review --approve using the GH_TOKEN env var, which is set to GH_PAT_WORKFLOWS (don-petry's PAT). Because review-one-pr.sh treats any non-zero exit from the review command as fatal, it exits 1, which in turn triggers session_aborted=1 in the outer loop and skips all remaining PRs.

Pattern 2 — Shell integer comparison bug

scripts/review-one-pr.sh: line 137: [: 0
0: integer expression expected

• Step: "Review each PR" → scripts/review-one-pr.sh line 137
• Root cause: A [ "$var" -ge 0 ]-style comparison where $var expands to a multi-line or newline-terminated value (e.g. 0\n). The shell splits on the newline, making the operand invalid. Non-fatal — the script continues — but the cosmetic stderr output confirms the cycle-count variable is not being read cleanly.

Pattern 3 — Copilot --target flag removed

error: unknown option '--target'
(Did you mean --agent?)
Try 'copilot --help' for more information.

• Step: "Review each PR" → tier-2 rubber duck path in scripts/review-one-pr.sh
• Root cause: The script calls gh copilot suggest --target (or similar), but a recent update to gh copilot removed the --target flag. The rubber duck step is explicitly treated as best-effort (continuing with deep review only), so this is non-fatal. Affects runs 💡 OWASP Agentic Top 10 Security Posture Scoring for the Agent Fleet #636, chore(deps): bump the actions group across 1 directory with 8 updates #640, 💡 Anthropic Usage & Cost API Integration for Ground-Truth Budget Tracking #643, feat: implement issue #638 — Feature Ideation doesn't enhance human ideas #644.

Pattern 4 — Missing read:org scope

! Missing required token scopes: 'read:org'
- Token scopes: 'repo', 'workflow'

• Step: "Verify auth" → gh auth status
• Root cause: GH_PAT_WORKFLOWS has repo and workflow but not read:org. gh auth status reports this as a warning. The list-prs.sh script appears to function (14 PRs are enumerated) so the missing scope is not currently causing enumeration failures, but may cause issues for org-visibility queries.

---

4. Token Scope Analysis

Token / Secret	Scopes Present	Scopes Missing	Recommendation
GH_PAT_WORKFLOWS (used as GH_TOKEN)	repo, workflow	read:org	Add read:org to the PAT in GitHub settings if org-level PR listing or org membership checks are needed
GH_PAT_WORKFLOWS (used for approvals)	repo (includes PR write)	N/A for scope — identity is the problem	Token authenticates as don-petry; cannot approve PRs authored by don-petry. Either use a dedicated bot account PAT (e.g. petry-review-bot) for the approval step, or create a GitHub App installation token

---

5. Recommendations

1. Filter self-authored PRs from the candidate list [CRITICAL]

• What: In scripts/list-prs.sh, add a filter that drops any PR whose .author.login matches the identity that will perform the approval (currently don-petry via GH_PAT_WORKFLOWS). Example: pipe the PR list through gh pr view --json author and exclude matches against $REVIEWER_USER.
• Why: GitHub forbids self-approval at the API level; this will always fail until addressed.
• Expected impact: Eliminates 100% of current failures for this PR. The remaining 13 candidate PRs will be processed normally.
• Urgency: CRITICAL — causes 100% workflow failure.

2. Degrade "cannot approve own PR" to a skippable error, not session-fatal [HIGH]

• What: In the "Review each PR (cascade)" loop in pr-review.yml (or in scripts/review-one-pr.sh), detect exit code 1 with the specific GraphQL message and map it to exit code 100 (no-op) rather than triggering session_aborted=1. Alternatively, add a new exit code (e.g. 3) for "self-review attempted" and handle it with continue rather than break.
• Why: Defense-in-depth — even after fixing test issue from agent #1, future self-authored PRs entering the candidate pool should not abort the entire session.
• Expected impact: Any similar edge case gracefully skips the offending PR and continues processing the queue.
• Urgency: HIGH — complements fix test issue from agent #1 as a safety net.

3. Fix the shell integer comparison bug at review-one-pr.sh:137 [MEDIUM]

• What: Find the variable assignment that produces a newline-terminated value and strip it: e.g. change var=$(some_command) to var=$(some_command | tr -d '\n') or use var="${var%%$'\n'*}". The specific variable is the one holding the review cycle count.
• Why: Produces stderr noise on every run; if the malformed value is used in a conditional elsewhere it could cause silent logic errors.
• Expected impact: Clean logs; correct cycle-count gating behavior.
• Urgency: MEDIUM — currently non-fatal but hides logic errors.

4. Fix or remove the Copilot --target flag [MEDIUM]

• What: In whichever script invokes gh copilot suggest --target …, replace --target with --agent (per the CLI's own suggestion) or remove the flag if it was for model selection. Update the invocation to match the current gh copilot CLI contract.
• Why: Every tier-2 rubber duck call fails silently; the cross-validation value of the duck review is lost.
• Expected impact: Restores rubber duck reviews on tier-2 escalations.
• Urgency: MEDIUM — degraded review quality but not blocking.

5. Add read:org scope to GH_PAT_WORKFLOWS [LOW]

• What: Regenerate GH_PAT_WORKFLOWS with repo, workflow, and read:org scopes; update the secret in repo settings (gh secret set GH_PAT_WORKFLOWS).
• Why: gh auth status warns about the missing scope on every run; org-level API calls may silently return incomplete data.
• Expected impact: Eliminates the scope warning; ensures org membership and org PR listing queries work correctly.
• Urgency: LOW — not causing visible failures today.

---

6. Health Score

Health: 1/10 — The review engine logic works correctly but every batch is immediately killed by an unguarded self-approval attempt on a permanently-open self-authored PR that heads every candidate list.