feat: implement issue #1407 — [Phase 4] Demote dev-lead-retry from normal-path driver to a true backstop — resume blocked states event-first - #1489
Conversation
…rmal-path driver to a true backstop — resume blocked states event-first
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Warning Review limit reached
Next review available in: 32 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe PR adds event-driven resume handling for rate-limited dev-lead work. It adds shared suppression checks for human review and automation budgets, retains the cron as a safety net, updates the interaction contract, and adds Bats coverage. ChangesDev-lead resume flow
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:L
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1489 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces an event-first resume mechanism (scripts/dev-lead-resume.sh) to immediately wake blocked or rate-limited dev-lead states upon receiving clearing events, such as review submissions or successful check runs. It unifies the stop-condition logic under a single pr_resume_suppressed gate shared by both the resume script and the safety-net cron, ensuring that both paths respect human-gated labels and per-PR automation budgets. The feedback recommends utilizing $BATS_TEST_TMPDIR in the new BATS unit tests instead of manually creating and cleaning up temporary directories with mktemp -d and rm -rf to leverage automatic per-test isolation and cleanup.
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dev-lead-reusable.yml:
- Around line 566-571: Update the environment configuration for the resume step
invoking dev-lead-resume.sh: remove the github.token fallback from GH_TOKEN and
retain only secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS. Add a pre-run
validation that fails when both PAT secrets are empty, before the script
executes, while preserving GH_PAT_WORKFLOWS as the migration fallback.
In `@scripts/dev-lead-retry.sh`:
- Around line 230-239: After fetching the PR object, validate its `.state`
before evaluating labels or dispatch conditions: continue only when it is
`"open"` and return 0 for every other state, including closed or missing state.
Update the relevant retry function around the fetched `pr_obj`, and add a
regression test proving closed PRs cannot reach `dispatch_ci_retry` or
`dispatch_reviews_retry`.
In `@scripts/lib/pr-automation-budget.sh`:
- Around line 111-126: Update the automation-event retrieval flow around
gather_pr_automation_events so API failures are distinguishable from a valid
empty event list; when comments, commits, or reviews retrieval fails, propagate
that failure and return 0 to suppress resumption rather than evaluating the
budget as available. Add regression coverage for each failed retrieval path.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 02ff095a-349c-4d4d-b088-84620fce11a9
📒 Files selected for processing (9)
.github/workflows/dev-lead-retry.yml.github/workflows/dev-lead-reusable.ymlinteraction-contracts/dev-lead.ymlscripts/dev-lead-resume.shscripts/dev-lead-retry.shscripts/lib/pr-automation-budget.shtests/dev-lead/unit/test_dev_lead_resume.batstests/dev-lead/unit/test_dev_lead_retry_pr_escalation.batstests/test_pr_automation_budget.bats
|
@coderabbitai resolve |
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
✅ Action performedComments resolved and changes approved. |
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
Auto-dismissed (#617): coderabbitai[bot] CHANGES_REQUESTED on a superseded commit. The bot re-reviews the new head automatically — a valid concern will return as a fresh review.
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
1 similar comment
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-08T22:53:15Z. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 491e5b99c7acfdfa717842f856bac92e2cf3a779
Review mode: triage-approved (single reviewer)
Summary
Phase 4 of #1407: demotes the dev-lead-retry 2h cron from normal-path convergence driver to a genuine safety-net backstop, and adds an event-first resume path. A new resume job in dev-lead-reusable.yml fires on a review-submitted or check_run-success clearing event and runs scripts/dev-lead-resume.sh, which reuses scan_pr_for_rate_limits so its dispatch and stop-condition are identical to the cron. Both paths now route through a single shared pr_resume_suppressed gate (human-gate label + per-PR automation budget). Adds a best-effort dispatch-dedup guard and makes budget-event collection fail-closed on API error. Well covered by new/expanded bats tests.
Linked issue analysis
Closes #1407 (Phase 4). The diff substantively implements the stated ACs: event fast-path added and the interaction-contract LEAK closed (event_fast_path populated, timer role -> safety-net); AC#3 (single shared stop-condition across timer + event paths) realized via pr_resume_suppressed; AC#5 (frozen ring-0 caller stub untouched) upheld — new triggers ride existing forwarded events and caller-stub-freeze is green.
Findings
No blocking findings.
- Security: new resume job follows the established Bridge A pattern used by ci-relay — SHA-pinned actions/checkout (v7.0.1), minimal perms (contents:write, pull-requests:read, issues:read), persist-credentials:false, sparse-checkout limited to scripts/. PAT (secrets.GH_PAT_*) is required because GITHUB_TOKEN cannot fire the downstream repository_dispatch; no hardcoded secrets. The if: guard excludes 'dev-lead / ' check-runs to prevent self-trigger recursion.
- Robustness: gather_pr_automation_events now returns non-zero on any gh API failure and pr_resume_suppressed suppresses fail-closed on that — sound anti-runaway behavior during outages.
- Minor (non-blocking): the dispatch-dedup guard (post-before-dispatch) is inherently best-effort and has a TOCTOU window under true concurrency; acknowledged in-code and harmless since any duplicate dispatch is still budget-gated.
- Secret-scanning MCP tool (run_secret_scanning) not available in this environment; gitleaks CI check passed.
CI status
All required checks green (shellcheck, bats, actionlint, caller-stub-freeze, validate-interaction-contracts, validate-caller-inputs, caller-permissions, CodeQL, Secret scan gitleaks, SonarCloud, agent-shield, etc.). CANCELLED entries are superseded dev-lead dispatch/ci-relay concurrency cancellations, not failures. CodeRabbit APPROVED with threads resolved; no unanswered human-reviewer questions.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
2 participants
User description
Closes #1407
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Resume blocked dev-lead runs immediately after clearing events
What Changed
Impact
✅ Faster recovery after successful checks✅ Fewer unnecessary two-hour retry delays✅ Fewer automated retry loops on human-gated or exhausted PRs💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
New Features
Bug Fixes
Tests