fix(auto-merge): harden mutable review evidence by devantler · Pull Request #575 · devantler-tech/actions

devantler · 2026-07-12T13:57:34Z

🤖 AI Engineer (automated)

Summary

order verdict-bearing CodeRabbit reviews by submission time so an edit to an older approval cannot hide a later red verdict;
keep edited COMMENTED review bodies ordered by their edit time;
require the full pre-merge table status cell itself to equal ✅ Passed;
add red regressions for edited approvals and explanation-column spoofing, plus the reverse positive verdict case.

Why

PR #553 merged before its late current-head Codex review exposed these two fail-closed defects. The separate claim about PullRequest.isInMergeQueue was checked against the live GitHub schema and exact production query, refuted, replied to, and resolved without a code change.

Validation

bash .github/tests/test-enable-auto-merge-pentad-gate.sh (40 fixtures)
shellcheck .scripts/check-merge-gates.sh .github/tests/test-enable-auto-merge-pentad-gate.sh
bash -n .scripts/check-merge-gates.sh .github/tests/test-enable-auto-merge-pentad-gate.sh
jq empty across every merge-gate fixture
git diff --check
independent read-only review: clean

Fixes #574
Follow-up to #553

github-code-quality · 2026-07-12T13:57:48Z

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall coverage remains at 50%, unchanged from the main branch.

C# / code-coverage/dotnet

The overall coverage remains at 100%, unchanged from the main branch.

_{Updated July 12, 2026 13:58 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

github-actions · 2026-07-12T14:00:15Z

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes	no	no	0.5s
✅ GO	revive	2	0	0	10.35s
✅ REPOSITORY	betterleaks	yes	no	no	0.46s
✅ REPOSITORY	checkov	yes	no	no	20.49s
✅ REPOSITORY	gitleaks	yes	no	no	0.08s
✅ REPOSITORY	git_diff	yes	no	no	0.02s
✅ REPOSITORY	osv-scanner	yes	no	no	0.68s
✅ REPOSITORY	secretlint	yes	no	no	0.83s
✅ REPOSITORY	syft	yes	no	no	1.86s
✅ REPOSITORY	trivy	yes	no	no	13.78s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.23s
✅ REPOSITORY	trufflehog	yes	no	no	6.07s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters COPYPASTE_JSCPD,GO_REVIVE,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG

Show us your support by starring ⭐ the repository

devantler · 2026-07-12T14:01:28Z

🤖 AI Engineer (automated)

@codex review for verdict chronology and full CodeRabbit pre-merge status-cell parsing

chatgpt-codex-connector · 2026-07-12T14:05:32Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: bf433c3821

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

devantler · 2026-07-12T14:06:24Z

🤖 AI Engineer (automated)

@coderabbitai review

coderabbitai · 2026-07-12T14:06:35Z

@devantler I'll review the PR now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-07-12T14:06:38Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c53eaf51-a17d-4785-a88e-2396b25388a8

📥 Commits

Reviewing files that changed from the base of the PR and between 9713532 and bf433c3.

📒 Files selected for processing (10)

.github/tests/merge-gate-fixtures/cr-approval-edited-after-changes-requested/comments.json
.github/tests/merge-gate-fixtures/cr-approval-edited-after-changes-requested/reviews.json
.github/tests/merge-gate-fixtures/cr-approval-edited-after-dismissal/comments.json
.github/tests/merge-gate-fixtures/cr-approval-edited-after-dismissal/reviews.json
.github/tests/merge-gate-fixtures/cr-changes-requested-then-approval/comments.json
.github/tests/merge-gate-fixtures/cr-changes-requested-then-approval/reviews.json
.github/tests/merge-gate-fixtures/index.json
.github/tests/merge-gate-fixtures/premerge-full-pass-only-in-explanation/comments.json
.github/tests/merge-gate-fixtures/premerge-full-pass-only-in-explanation/reviews.json
.scripts/check-merge-gates.sh

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

.github/tests/**

📄 CodeRabbit inference engine (AGENTS.md)

Place deliberately bad fixtures for gating-workflow tests outside the gate's normal scan scope.

Files:

.github/tests/merge-gate-fixtures/cr-changes-requested-then-approval/comments.json
.github/tests/merge-gate-fixtures/cr-approval-edited-after-dismissal/reviews.json
.github/tests/merge-gate-fixtures/cr-approval-edited-after-changes-requested/reviews.json
.github/tests/merge-gate-fixtures/premerge-full-pass-only-in-explanation/comments.json
.github/tests/merge-gate-fixtures/cr-approval-edited-after-dismissal/comments.json
.github/tests/merge-gate-fixtures/cr-approval-edited-after-changes-requested/comments.json
.github/tests/merge-gate-fixtures/index.json
.github/tests/merge-gate-fixtures/cr-changes-requested-then-approval/reviews.json
.github/tests/merge-gate-fixtures/premerge-full-pass-only-in-explanation/reviews.json

🔇 Additional comments (12)

.github/tests/merge-gate-fixtures/index.json (1)

98-109: LGTM!

Also applies to: 150-153

.github/tests/merge-gate-fixtures/cr-approval-edited-after-changes-requested/reviews.json (1)

1-22: LGTM!

.github/tests/merge-gate-fixtures/cr-approval-edited-after-dismissal/reviews.json (1)

1-22: LGTM!

.github/tests/merge-gate-fixtures/premerge-full-pass-only-in-explanation/comments.json (1)

1-9: LGTM!

.github/tests/merge-gate-fixtures/premerge-full-pass-only-in-explanation/reviews.json (1)

1-10: LGTM!

.github/tests/merge-gate-fixtures/cr-changes-requested-then-approval/reviews.json (1)

1-22: LGTM!

.github/tests/merge-gate-fixtures/cr-approval-edited-after-changes-requested/comments.json (1)

1-9: LGTM!

.github/tests/merge-gate-fixtures/cr-approval-edited-after-dismissal/comments.json (1)

1-9: LGTM!

.github/tests/merge-gate-fixtures/cr-changes-requested-then-approval/comments.json (1)

1-9: LGTM!

.scripts/check-merge-gates.sh (3)

65-73: LGTM!

103-107: LGTM!

233-253: LGTM!

📝 Walkthrough

Walkthrough

The merge-gate script now orders CodeRabbit verdicts and related cutoff timestamps by submitted_at rather than edit-aware timestamps. Full pre-merge tables are parsed by status cell, ignoring header-like values and requiring every status to equal ✅ Passed. New fixtures cover edited or dismissed reviews, review ordering, and passing text appearing only in explanations.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: hardening auto-merge against mutable review evidence.
Description check	✅ Passed	The description is directly related to the fixture and parser changes in this PR.
Linked Issues check	✅ Passed	The changes address `#574` by preserving verdict chronology, tightening pre-merge row parsing, and adding fail-closed regressions.
Out of Scope Changes check	✅ Passed	The added fixtures and script updates all support the linked auto-merge gate fixes and do not appear unrelated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{Comment @coderabbitai help to get the list of available commands.}

devantler · 2026-07-12T15:09:51Z

🤖 Generated by the Daily AI Engineer

@coderabbitai review

coderabbitai · 2026-07-12T15:10:03Z

@devantler I'll review the PR now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

fix(auto-merge): harden mutable review evidence

bf433c3

devantler added security automation github_actions labels Jul 12, 2026

github-project-automation Bot added this to 🌊 Project Board Jul 12, 2026

devantler added security automation github_actions labels Jul 12, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Jul 12, 2026

botantler-1 Bot approved these changes Jul 12, 2026

View reviewed changes

devantler marked this pull request as ready for review July 12, 2026 15:03

devantler merged commit 9c8b35b into main Jul 12, 2026
110 checks passed

devantler deleted the claude/auto-merge-post-merge-hotfix branch July 12, 2026 17:07

github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Jul 12, 2026

botantler-1 Bot mentioned this pull request Jul 12, 2026

chore(main): release 9.0.11 #578

Merged

coderabbitai Bot mentioned this pull request Jul 14, 2026

Avoid validate-go-project concurrency collisions #587

Closed

botantler-1 Bot mentioned this pull request Jul 14, 2026

chore(main): release 10.0.0 #591

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(auto-merge): harden mutable review evidence#575

fix(auto-merge): harden mutable review evidence#575
devantler merged 1 commit into
mainfrom
claude/auto-merge-post-merge-hotfix

devantler commented Jul 12, 2026

Uh oh!

github-code-quality Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

devantler commented Jul 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 12, 2026

Uh oh!

devantler commented Jul 12, 2026

Uh oh!

coderabbitai Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 12, 2026 •

edited

Loading

Walkthrough

Uh oh!

devantler commented Jul 12, 2026

Uh oh!

coderabbitai Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

devantler commented Jul 12, 2026

Summary

Why

Validation

Uh oh!

github-code-quality Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

Go / code-coverage/test

C# / code-coverage/dotnet

Uh oh!

github-actions Bot commented Jul 12, 2026

✅MegaLinter analysis: Success

Notices

Uh oh!

devantler commented Jul 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 12, 2026

Uh oh!

devantler commented Jul 12, 2026

Uh oh!

coderabbitai Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

devantler commented Jul 12, 2026

Uh oh!

coderabbitai Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-code-quality Bot commented Jul 12, 2026 •

edited

Loading

coderabbitai Bot commented Jul 12, 2026 •

edited

Loading

coderabbitai Bot commented Jul 12, 2026 •

edited

Loading

coderabbitai Bot commented Jul 12, 2026 •

edited

Loading