feat: implement issue #577 — advisory-bot gate strands PRs forever: pushedDate=null disables both absent-bot timeout fallbacks

[don-petry]

Closes #577

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 minute and 29 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fc40bc09-f90d-4b70-88e2-99edf6ac00ce

📥 Commits

Reviewing files that changed from the base of the PR and between dc7ea44 and 15adf90.

📒 Files selected for processing (2)

• scripts/lib/advisory-review-gate.sh
• tests/dev-lead/unit/test_advisory_review_gate.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-577-20260611-2308

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[gemini-code-assist]

Code Review

This pull request updates the advisory review gate script to use the head commit's committer date instead of the deprecated pushedDate GraphQL field, which now returns null. This ensures cherry-picked commits are correctly evaluated. It also updates the quiescence fallback logic to handle cases where the head commit time is unavailable, and adds corresponding unit tests. The reviewer suggested a valuable optimization to fetch the committer date directly using a single GraphQL query, which reduces API calls and avoids fragile URL parsing.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #592
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-12T00:03:28Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-12T00:03:28Z

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 15adf90cadd220be5c84bfe77195e45ad92b0552
Review mode: triage-approved (single reviewer)

Summary

Bug fix for issue #577: the advisory-bot gate's two absent-bot timeout fallbacks were silently disabled because GitHub deprecated pushedDate (now returns null). The fix replaces pushedDate with commit.committer.date via GraphQL (preserving cherry-pick protection — committer date reflects when the cherry-pick was applied) and decouples the quiescence fallback from head_time_raw so it can still fire from latest_sub_at alone when head time is unavailable. Two new regression tests cover the GraphQL-returns-old-committer-date and head-time-unavailable scenarios; the existing cherry-pick test is updated. Triage cleared this as low-risk and the assessment looks correct.

Linked issue analysis

Closes #577. The proposed fix in the issue lists three options: (1) replace pushedDate with a reliable timestamp like the head commit's committer date, (2) make missing bots optional, or (3) decouple quiescence from head_time_raw. This PR implements (1) and (3) — the most direct fix that preserves cherry-pick protection. The cherry-pick guard is intact because committer.date is set at cherry-pick time, not author time, so old commits cherry-picked just now will have a recent committer date and won't bypass the gate.

Findings

No blocking issues. The change is well-scoped, well-commented, and the new helper _get_head_committer_date improves readability over the prior inline GraphQL call. Test coverage is thorough: head-age timeout regression with old committer date, quiescence fallback when head time is unavailable, plus the updated cherry-pick test. All CI checks (shellcheck, bats, CodeQL, SonarCloud, secret scan, etc.) pass. The one CANCELLED review/review check is the prior run superseded by the new commit (expected behavior per recent commit a828f8a).

CI status

All required checks SUCCESS: shellcheck, bats, validate-agent-profiles, CodeQL (actions + python), SonarCloud, gitleaks, agent-shield, dependency-audit (others SKIPPED for missing ecosystems), unit-tests, dev-lead workflows. The one CANCELLED check (review / review job 80927130654) is the earlier run superseded by the new commit — the rerun (job 80927131843) completed SUCCESS. SonarCloud Quality Gate: passed, 0 new issues.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.