feat: implement issue #1340 — dev-lead fix-bot reverts its own fix on neutral Copilot 'overview' comments → net no-op PRs that falsely close compliance issues

[don-petry]

Closes #1340

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Bug Fixes

  • Prevented automated review fixes from silently canceling themselves when they produce no net changes.
  • Added safeguards to flag no-op fixes for human attention, disable auto-merge, and avoid misleading completion notifications.
  • Clarified that neutral or informational review comments should not trigger changes.

• Maintenance

  • Updated the PR review workflow to use the stable workflow channel.
  • Expanded workflow drift-check exceptions to accommodate the updated configuration.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 30 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 121e0575-0fc2-4bf6-90e8-f27f86eb89c6

📥 Commits

Reviewing files that changed from the base of the PR and between ad9b041 and 903647d.

📒 Files selected for processing (2)

• scripts/dev-lead-fix-reviews.sh
• scripts/template_stub_drift.sh

📝 Walkthrough

Walkthrough

The PR adds net-zero diff protection to dev-lead fix flows, updates prompts to ignore neutral reviews, and repins the PR review mention workflow to its stable channel while adjusting drift-check handling.

Changes

No-op fix protection

Layer / File(s)	Summary
Neutral review guardrails prompts/dev-lead/fix-bot-comment.md, prompts/dev-lead/fix-reviews.md	Neutral overview and COMMENTED reviews are treated as non-actionable, and committed changes must not be reverted for them.
Net-zero fix handling scripts/dev-lead-fix-reviews.sh	Empty base-to-head diffs are flagged for human attention, not pushed, and prevented from restoring auto-merge or completing normal cleanup.
No-op guard validation tests/dev-lead/unit/test_fix_reviews.bats	Tests cover net-zero and non-empty diffs, push and marker behavior, auto-merge handling, and prompt guidance.

Workflow repin

Layer / File(s)	Summary
Stable workflow reference .github/workflows/pr-review-mention.yml, scripts/template_stub_drift.sh	The reusable workflow uses the stable ref, secret guidance is updated, and the caller is added to the template drift allowlist.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant FixIntent
  participant commit_and_push
  participant GitHub
  FixIntent->>commit_and_push: process fix intent
  commit_and_push->>commit_and_push: compare base-to-head diff
  commit_and_push->>GitHub: flag net-zero PR and disable auto-merge
  commit_and_push-->>FixIntent: return status 3
  FixIntent-->>GitHub: skip push and terminal cleanup

Loading

Possibly related PRs

• petry-projects/.github-private#285: Overlaps in the dev-lead prompts and post-commit intent flow.
• petry-projects/.github-private#297: Overlaps in no-change handling and auto-merge behavior.
• petry-projects/.github-private#1312: Overlaps in the commit_and_push flow.

Suggested labels: needs-human-review

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR's main change: fixing dev-lead no-op behavior on neutral Copilot overview comments.
Linked Issues check	✅ Passed	The changes implement #1340 by treating neutral/COMMENTED reviews as non-actionable and adding a no-op guard with tests.
Out of Scope Changes check	✅ Passed	The workflow, prompt, script, and test edits all support the #1340 fix and do not introduce unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-1340-20260721-1159

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #1343
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-21T13:01:39Z

[gemini-code-assist]

Code Review

This pull request implements a no-op guard mechanism to prevent pushing self-cancelling fixes that result in a net-zero diff against the base branch, which would otherwise auto-close compliance issues without resolving them. It updates prompt guidelines, adds a net-zero check and flagging logic in the script, and introduces corresponding unit tests. The review feedback suggests improving the newly added BATS tests by using $BATS_TEST_TMPDIR for isolated test execution and ensuring that negative assertions on grep check for an exact exit status of 1 to avoid false passes on unexpected errors.

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-21T13:01:39Z

[Copilot]

Pull request overview

Implements the #1340 mitigation in the dev-lead “fix” loop to prevent self-cancelling fix passes (where the bot reverts its own fix and produces a net-zero PR diff that could still auto-close Closes #N compliance issues). This adds both behavioral guardrails in the fix workflow and prompt-level guidance to avoid treating neutral Copilot “overview” content as actionable review feedback.

Changes:

• Add a no-op guard in dev-lead-fix-reviews.sh that detects when the PR’s net diff vs base is empty after a fix pass, then flags the PR, disables auto-merge, and refuses to push.
• Update fix-reviews / fix-bot-comment control flow to handle the new “no-op guard aborted push” outcome without posting misleading terminal markers or re-enabling auto-merge.
• Extend dev-lead prompts and unit tests to cover #1340 behaviors (no-op guard + “COMMENTED overview is neutral” guidance).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
tests/dev-lead/unit/test_fix_reviews.bats	Adds unit coverage for the new net-zero no-op guard and prompt guidance assertions.
scripts/dev-lead-fix-reviews.sh	Implements the net-zero diff guard + PR flagging/escalation behavior and integrates new return code handling.
prompts/dev-lead/fix-reviews.md	Adds explicit instruction that COMMENTED/overview reviews are neutral and must not trigger reverts.
prompts/dev-lead/fix-bot-comment.md	Adds explicit instruction to ignore neutral overview/summary bot comments unless they contain actionable findings.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

Auto-dismissed (#617): coderabbitai[bot] CHANGES_REQUESTED on a superseded commit. The bot re-reviews the new head automatically — a valid concern will return as a fresh review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality gate passed with 0 new issues, 0 security hotspots
Files changed: None
Skipped: N/A — no issues reported
Status: ✅ No actionable bot findings; PR is analysis-clean
```
The PR is ready to proceed—all CI checks are passing or in progress, and the quality gate is clean.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 903647dda751fb3e109e9687feceec38f30ee9a3
Review mode: triage-approved (single reviewer)

Summary

Implements issue #1340's two proposed fixes for the dev-lead fix-bot self-cancelling loop: (1) explicit prompt guidance in fix-reviews.md and fix-bot-comment.md that COMMENTED/overview reviews are neutral and must never trigger reverting the PR's own changes, and (2) a no-op guard in scripts/dev-lead-fix-reviews.sh (pr_nets_to_zero + flag_noop_pr) that refuses to push when the base…head diff nets to zero, posts a deduped human-attention comment, adds the needs-human-review label, disables auto-merge, and suppresses the EXIT-trap auto-merge restore. Callers propagate the new return code 3 so no false 'applied' marker is posted and threads are not auto-resolved. Six new bats tests cover both intents, the non-net-zero happy path, auto-merge suppression, and prompt content. Two bundled maintenance changes: pr-review-mention.yml moves from @pr-review-mention/v2-next to the @pr-review-mention/stable channel (sanctioned mutable first-party ref per AGENTS.md 'Release channel tags & the mutable-ref exception'; caller-stub-freeze, stub-structure, and template-drift checks all pass), and template_stub_drift.sh normalizes trailing newlines symmetrically when hashing the template side — a narrow fix that does not mask genuine content drift, replacing an earlier broader allowlist approach that CodeRabbit correctly flagged (thread resolved).

Linked issue analysis

Issue #1340 (open): fix-bot misreads neutral Copilot overview comments as change-requests, reverts its own fix, and the resulting net-zero PR would falsely auto-close compliance issues. Both proposed mitigations are substantively implemented: prompt-level 'never act on COMMENTED/overview' guidance and the post-commit net-zero push guard. The guard deliberately fails open (warns and proceeds) when the base is unverifiable — shallow-clone deepening, missing merge-base, and diff-failure cases are each handled explicitly, so a broken environment never blocks a legitimate push. Scope matches the issue; PR correctly carries Closes #1340.

Findings

No blocking findings.

• Correctness: return-code-3 plumbing is sound — cp_rc=1 (no changes) still flows to the existing no-changes path; cp_rc=3 skips thread resolution, terminal markers, and try_enable_auto_merge; _AM_NEEDS_RESTORE=0 prevents the EXIT trap from re-enabling auto-merge. Guard is scoped to fix-reviews/fix-bot-comment intents only.
• Security: no injection vectors (comment bodies built from internal vars via gh CLI args); no permission or secrets-mapping changes in the workflow stub (secrets lines are unchanged context); NOSONAR on the channel ref is documented and consistent with AGENTS.md's audited mutable-ref exception.
• Minor (non-blocking): _template_drift_committed_sha classifies a genuinely empty or >1MB template file (contents API omits inline content) as MISSING rather than comparing; acceptable for small workflow stubs.
• Secret scan: run_secret_scanning MCP tool not available in this environment — noted, not fabricated; gitleaks CI check passed.

CI status

All required checks green at 903647d: shellcheck, bats, unit-tests, CodeQL, SonarCloud, Agent Security Scan, AgentShield, gitleaks, actionlint, template-drift, caller-stub-freeze, stub-structure, validate-caller-inputs, caller-permissions, and both later 'review / review' runs SUCCESS. One earlier 'review / review' run shows CANCELLED — superseded by a subsequent successful run of the same check at the same SHA (concurrency cancellation), not a failure. All 12 review threads (gemini, copilot, coderabbit) are resolved, including CodeRabbit's Major drift-allowlist finding, which the final revision replaced with the narrower newline-normalization fix.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: fix-reviews)

PR: #1343
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-21T14:50:51Z