feat: implement issue #1437 — auto-rebase: run approval-survival spike; fix this repo's pr-quality ruleset if confirmed

[don-petry]

User description

Closes #1437

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Document auto-rebase approval-survival findings and defer ruleset changes for human review

What Changed

• Added a spike report describing how to test whether auto-rebase updates dismiss existing approvals
• Confirmed that GitHub cannot limit a bypass to only stale-approval settings; a bypass would skip all pull request quality gates in the ruleset
• Recorded that no workflow or ruleset changes were made and handed the remaining decision to a human owner
• Documented the available options, including testing approval survival, splitting rulesets, or accepting a fleet-wide review-policy relaxation

Impact

✅ No unintended review-policy relaxation
✅ Clear approval-survival verification steps
✅ Explicit human handoff for review-integrity decisions

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	b94056a	Aug 02, 2026 · 19:45	19:46

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b5515548-0bf5-4c4c-8790-1c0a130498af

📥 Commits

Reviewing files that changed from the base of the PR and between d14a702 and b94056a.

📒 Files selected for processing (1)

• docs/initiatives/auto-rebase-approval-survival-spike.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Document spike: auto-rebase update-branch vs approval survival under pr-quality

📝 Documentation 🕐 Less than 10 minutes

AI Description

• Add spike write-up for whether update-branch dismisses approvals under pr-quality ruleset.
• Document human-run protocol to empirically verify approval survival on a real PR timeline.
• Record verified constraint: GitHub ruleset bypass is ruleset-wide (not per-rule), requiring a
 human decision.

Diagram

graph TD
  A(["#1437 Question"]) --> B["Human runs spike PR"] --> C{"Approval dismissed?"}
  C -->|"No"| D(["Close #1437 (evidence)"])
  C -->|"Yes"| E["Need human decision"] --> F{"Fallback option"}
  F -->|"B: Split rulesets"| G["New ruleset architecture"] --> H(["Implement + roll out"])
  F -->|"C: Fleet-wide relax"| I(["Re-open decision + accept risk"])
  subgraph Legend
    direction LR
    _t(["Terminator"]) ~~~ _p["Process"] ~~~ _d{"Decision"}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Automated repro in a sandbox repo

• ➕ Produces repeatable evidence without risking production rulesets
• ➕ Could be run in CI with a dedicated bot identity to eliminate multi-actor friction
• ➖ Still requires two distinct identities and permissions; may be blocked by org policy
• ➖ May not perfectly match this repo’s exact ruleset/branch protections

2. Use GitHub audit/timeline APIs only (no PR experiment)

• ➕ Fast, no side-effectful PR creation
• ➖ Cannot answer the core question without an actual update-branch push and resulting events
• ➖ Would be speculative (the spike explicitly avoids relying on docs/assumptions)

3. Proactively split rulesets without waiting for empirical result

• ➕ Unblocks a future fix path immediately if stripping is confirmed
• ➕ Aligns with the documented constraint that bypass scoping is ruleset-wide
• ➖ Introduces a review-integrity architecture change across affected repos without confirming it’s needed
• ➖ Requires stable, distinguishable automation identity; may force additional auth/app work

Recommendation: Keep this PR as documentation-only (it correctly avoids making an implicit review-integrity tradeoff). Next step should be option A from the doc: run the human-operated spike to confirm whether approvals are actually dismissed. Only if stripping is observed should the team consider the documented structural fix (ruleset split), because GitHub’s ruleset model cannot scope bypass to just the stale-approval parameters without exempting the automation from the entire PR-quality gate set.

Files changed (1) +121 / -0

Documentation (1) +121 / -0

auto-rebase-approval-survival-spike.mdAdd spike write-up and decision tree for approval survival under auto-rebase +121/-0

Add spike write-up and decision tree for approval survival under auto-rebase

• Introduces a spike document describing the open question, a human-run verification protocol, and a verified constraint that GitHub ruleset bypasses are ruleset-wide (not per-rule). Concludes with an explicit decision tree and handoff requiring a human choice; no workflows or rulesets are changed.

docs/initiatives/auto-rebase-approval-survival-spike.md

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[gemini-code-assist]

Code Review

This pull request adds a new documentation file, auto-rebase-approval-survival-spike.md, which details a spike investigating whether the auto-rebase update-branch merge method dismisses human approvals under GitHub's ruleset configuration. The document covers the empirical verification protocol, explains that GitHub's ruleset model does not support scoping bypasses to specific rules, and presents a decision tree requiring human resolution. There are no review comments, and I have no feedback to provide on these changes.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-reviews (no-changes)

Agent reasoning

Addressed 0 threads:
  (No open review threads to address)
Test verification: pass — unit-tests CI check completed with "success"; only
  changed file is a documentation file (no code regressions possible); bats
  not available locally but CI already verified.
Files changed: none
```

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: b94056a3f9dd9522dca808f265494735636a55f9
Review mode: triage-approved (single reviewer)

Summary

Docs-only PR: adds docs/initiatives/auto-rebase-approval-survival-spike.md (+121/-0), the spike report for issue #1437 (AC2 of epic #1416). The report documents (a) a human-operator protocol for the empirical approval-survival test that the automated dev-lead run cannot execute, and (b) a decisive, live-verified architectural finding: GitHub's ruleset model has no per-rule/per-parameter bypass — bypass_actors is ruleset-level, so the narrow actor-scoped bypass the issue asked for is not expressible. No workflow or ruleset was changed. The triage tier's low-risk assessment is confirmed.

Linked issue analysis

Closes #1437. The issue explicitly mandated: if per-rule actor scoping isn't supported, do not silently fall back to a fleet-wide relax — stop and flag dev-lead:needs-human for an explicit human decision. That is precisely what this PR does: it records the finding, changes nothing, and the dev-lead:needs-human label is applied on the issue. The decision tree (option A: run the empirical spike; option B: split the ruleset with a dedicated automation identity; option C: accept the fleet-wide relax, explicitly non-recommended) gives the human owner the full option set. One non-blocking observation: merging will auto-close #1437 via "Closes #1437" while the human decision itself remains outstanding — that continuation is tracked by the dev-lead:needs-human label and epic #1416, which appears intentional.

Findings

No blocking findings.

• Content accuracy spot-check: the claim that dismiss_stale_reviews_on_push / require_last_push_approval are parameters of a single pull_request rule and that bypass_actors is ruleset-level (whole-ruleset exemption) is consistent with GitHub's ruleset model and with the in-repo release-channel-tags.json precedent the doc cites.
• The doc correctly notes today's auto-rebase runs as GITHUB_TOKEN, so option B would first require a dedicated identity — a useful caveat that prevents a premature ruleset split.
• Secret scan: run_secret_scanning MCP tool not available in this session; gitleaks CI check passed and the diff contains prose only — no secrets observed.

CI status

All completed checks green: Lint, ShellCheck, unit-tests, CodeQL (actions + python), Secret scan (gitleaks), Agent Security Scan, agent-shield, SonarCloud (quality gate passed, 0 new issues), holdout-guard, Compile agentic workflows, guard. Skipped jobs are conditional (dependency-audit ecosystems, dependabot-automerge, ci-relay). Bot reviews (gemini-code-assist, Qodo) reported no issues; no unresolved review threads.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-02T20:50:57Z.