sync from touchless-bot infra/bot-ci@88ae573887b2

Author: touchless-bot[bot]

.synced-from

@@ -1 +1 @@
-e8261f8856460a1953ef16162fa33422fcf26de9
+88ae573887b21f17713c6b72c9a6dc77dab1d90a

actions/second-look/action.yml

@@ -45,9 +45,6 @@ inputs:
     required: false
   openai-model:
     required: false
-  mode:
-    description: "advisory (default): the check is never red; enforce: a block or a failed review turns it red"
-    required: false
   budget-usd:
     description: "the Claude reviewer's spend cap per run (default 3)"
     required: false
@@ -177,7 +174,6 @@ runs:
         SECOND_LOOK_OPENAI_API_KEY: ${{ inputs.openai-api-key }}
         SECOND_LOOK_ANTHROPIC_MODEL: ${{ inputs.anthropic-model }}
         SECOND_LOOK_OPENAI_MODEL: ${{ inputs.openai-model }}
-        SECOND_LOOK_MODE: ${{ inputs.mode }}
         SECOND_LOOK_BUDGET_USD: ${{ inputs.budget-usd }}
         SECOND_LOOK_REPORTS_DIRECTORY: ${{ runner.temp }}/second-look-reports
         SECOND_LOOK_DEFAULT_RULES: ${{ github.action_path }}/rules.md

actions/second-look/approveHintOf.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /**
  * second look's check on the pr, in a dispatched run: `start` opens it on the head while the
- * review runs, `abandon` closes it when the run ended without a review, unless something already did (the relay's
- * forced approval turns it green and cancels the run). synthesize.ts closes it
+ * review runs, `abandon` closes it when the run ended without a review, unless something already closed it.
+ * synthesize.ts closes it
  * with the verdict. best effort: without the app's checks permission there's just no check,
  * and the review comment still posts.
  *
@@ -30,7 +30,7 @@ const main = async () => {
     const id = process.env.SECOND_LOOK_CHECK_RUN_ID
     if (!id) return console.log("second look: no check to close")
     const current = await fetch(`https://api.github.com/repos/${repository}/check-runs/${id}`, { headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json" } })
-    if (current.ok && ((await current.json()) as { status?: string }).status === "completed") return console.log("second look: the check is already closed (a forced approval?), leaving it")
+    if (current.ok && ((await current.json()) as { status?: string }).status === "completed") return console.log("second look: the check is already closed, leaving it")
     await sendCheckRun({ token, repository, id, body: checkAbandonedOf({ result: process.env.SECOND_LOOK_RESULT || "failure", detailsUrl }) })
     return console.log(`second look: closed the check on ${repository} (${id})`)
   }

actions/second-look/checkRun.ts

@@ -1,6 +1,6 @@
 import type { Verdict } from "./types.ts"
 
-/** the check second look puts on a pr it was asked to review, named like the old required check */
+/** the check second look puts on a pr it reviews, named like the old required check */
 export const checkName = "Second Look (beta)"
 
 /** the body that opens the check on the pr's head while the review runs */
@@ -16,14 +16,16 @@ export const checkStartOf = ({ headSha, detailsUrl, requestedBy }: { headSha: st
 })
 
 /**
- * the body that closes the check with the review's outcome: a pass is green and anything else
- * neutral, unless enforcing, where a block (the review requests changes either way) or a failed review is red
+ * the body that closes the check with the review's outcome. outside the beta scope the check is informational: a pass
+ * is green ("no changes requested", never an approval) and anything else neutral, never red. on a beta-enabled pr it
+ * enforces: a pass is an approval, and a block (the review requests changes either way) or a failed review is red
  */
-export const checkEndOf = ({ verdict, error, enforcing, commentUrl }: { verdict?: Verdict; error?: string; enforcing: boolean; commentUrl?: string }) => {
+export const checkEndOf = ({ verdict, error, betaEnabled, commentUrl }: { verdict?: Verdict; error?: string; betaEnabled: boolean; commentUrl?: string }) => {
   const link = commentUrl ? `\n\n[The review](${commentUrl})` : ""
-  if (error || !verdict) return { status: "completed", conclusion: enforcing ? "failure" : "neutral", output: { title: "Couldn't review", summary: `${error ?? "no verdict"}${link}` } }
-  if (verdict.verdict === "pass") return { status: "completed", conclusion: "success", output: { title: "Approved", summary: `${verdict.summary}${link}` } }
-  return { status: "completed", conclusion: enforcing ? "failure" : "neutral", output: { title: "Changes requested", summary: `${verdict.summary}${link}` } }
+  const notPassing = betaEnabled ? "failure" : "neutral"
+  if (error || !verdict) return { status: "completed", conclusion: notPassing, output: { title: "Couldn't review", summary: `${error ?? "no verdict"}${link}` } }
+  if (verdict.verdict === "pass") return { status: "completed", conclusion: "success", output: { title: betaEnabled ? "Approved" : "No changes requested", summary: `${verdict.summary}${link}` } }
+  return { status: "completed", conclusion: notPassing, output: { title: "Changes requested", summary: `${verdict.summary}${link}` } }
 }
 
 /** the body that closes a check whose run didn't get to a review (cancelled by a newer request, or a job failed) */

actions/second-look/checkRunBodyOf.ts

@@ -72,9 +72,9 @@ const reportSectionOf = (report: AgentReport) => {
  * the sticky comment, kept short: the call, the reviewer's summary, each new finding in a line (linking the ones
  * on the diff, in the review at `reviewUrl`) and links to the earlier threads (`followUps`) that are fixed or still
  * open. the ticket fit and testing, each tester's steps and the intended architecture sit collapsed below.
- * `error` replaces the summary when the main reviewer didn't answer.
+ * `error` replaces the summary when the main reviewer didn't answer. `betaEnabled` is whether a pass is an approval
  */
-export const commentBodyOf = ({ verdict, error, reports, reviewer, reviewerModel, harness, headSha, scopeReason, onDiff = new Set(), reviewUrl, followUps = [] }: {
+export const commentBodyOf = ({ verdict, error, reports, reviewer, reviewerModel, harness, headSha, scopeReason, onDiff = new Set(), reviewUrl, followUps = [], betaEnabled = false }: {
   verdict?: Verdict
   error?: string
   reports: AgentReport[]
@@ -86,12 +86,13 @@ export const commentBodyOf = ({ verdict, error, reports, reviewer, reviewerModel
   onDiff?: ReadonlySet<Finding>
   reviewUrl?: string
   followUps?: ThreadOutcome[]
+  betaEnabled?: boolean
 }) => {
   const cost = reports.reduce((total, report) => total + (report.costUsd ?? 0), 0)
   const linked = threadKeysLinkedOf(followUps.map(({ thread }) => thread))
   const lines = [
     commentMarker,
-    headlineOf({ verdict, open: followUps.filter(({ status }) => status !== "fixed").length }),
+    headlineOf({ verdict, open: followUps.filter(({ status }) => status !== "fixed").length, betaEnabled }),
     "",
     verdict ? linked(verdict.summary) : `The main reviewer didn't answer: ${error ?? "unknown error"}. The testers' reports are below.`,
     ...(verdict?.findings.length ? ["", ...verdict.findings.map(findingLineOf(onDiff, linked, reviewUrl))] : []),

actions/second-look/commentBodyOf.ts

@@ -5,10 +5,11 @@ const countOf = (count: number, noun: string) => (count ? [`${count} ${noun}${co
 
 /**
  * the first line of the review and the summary comment: the call, then what's behind it, like
- * "**Second Look (beta): changes requested** · 2 warnings, 1 nit, 3 still open". `open` is earlier threads not fixed yet
+ * "**Second Look (beta): changes requested** · 2 warnings, 1 nit, 3 still open". `open` is earlier threads not fixed yet.
+ * a pass reads "approved" only on a beta-enabled pr, where it is one; elsewhere it's "no changes requested"
  */
-export const headlineOf = ({ verdict, open = 0 }: { verdict?: Verdict; open?: number }) => {
-  const call = !verdict ? "couldn't finish" : verdict.verdict === "pass" ? "approved" : "changes requested"
+export const headlineOf = ({ verdict, open = 0, betaEnabled = false }: { verdict?: Verdict; open?: number; betaEnabled?: boolean }) => {
+  const call = !verdict ? "couldn't finish" : verdict.verdict === "block" ? "changes requested" : betaEnabled ? "approved" : "no changes requested"
   const findings = verdict?.findings ?? []
   const counts = [
     ...countOf(findings.filter(({ severity }) => severity === "warning").length, "warning"),

actions/second-look/headlineOf.ts

@@ -2,15 +2,14 @@
 /**
  * second look's wrap-up when a run ended without a review (and wasn't cancelled): the relay already
  * told the pr a review is coming, so this says it isn't, with a link to the run, as a comment review
- * that tags the author with the force-approval hint (a plain pr comment when a review can't be posted). best effort.
+ * (a plain pr comment when a review can't be posted). best effort.
  *
  *   node notifyUnfinished.ts
  *
  * env: SECOND_LOOK_POST_TOKEN (clanker-in-chief's PAT) or GITHUB_TOKEN (the app, issues + pull requests write),
  * SECOND_LOOK_REPOSITORY (validated by prepare), SECOND_LOOK_NUMBER, SECOND_LOOK_RESULT, SECOND_LOOK_STAGE,
  * GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID.
  */
-import { approveHintOf } from "./approveHintOf.ts"
 import { unfinishedReplyOf } from "./unfinishedReplyOf.ts"
 
 const main = async () => {
@@ -25,9 +24,7 @@ const main = async () => {
       ...(body === undefined ? {} : { body: JSON.stringify(body) }),
     })
   const detailsUrl = `${process.env.GITHUB_SERVER_URL || "https://github.com"}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
-  const pull = await api(`pulls/${number}`)
-  const author = pull.ok ? ((await pull.json()) as { user?: { login?: string } }).user?.login : undefined
-  const body = `${unfinishedReplyOf({ result: process.env.SECOND_LOOK_RESULT || "failure", stage: process.env.SECOND_LOOK_STAGE || "review", detailsUrl })}\n\n${approveHintOf(author)}`
+  const body = unfinishedReplyOf({ result: process.env.SECOND_LOOK_RESULT || "failure", stage: process.env.SECOND_LOOK_STAGE || "review", detailsUrl })
   const review = await api(`pulls/${number}/reviews`, { event: "COMMENT", body })
   if (review.ok) return console.log(`second look: told ${repository}#${number} the run didn't finish (comment review)`)
   const comment = await api(`issues/${number}/comments`, { body })

actions/second-look/isEnforcing.ts

@@ -2,9 +2,9 @@ import type { InlineComment } from "./inlineCommentsOf.ts"
 import type { ReviewEvent } from "./reviewEventOf.ts"
 
 /**
- * submits one review on `commitId` as `event`, carrying the new inline comments; every run gets one, so the pr always
- * shows an approval, a change request or a comment from second look. github answers 422 when the poster can't approve
- * or request changes (its own pr), so that one goes in as a plain comment review instead. resolves to the review's url
+ * submits one review on `commitId` as `event` (reviewEventOf.ts), carrying the new inline comments; every run gets one,
+ * so the pr always shows a change request or a comment from second look (an approval only on a beta-enabled pr). github
+ * answers 422 when the poster can't approve or request changes (its own pr), so that one goes in as a plain comment review instead. resolves to the review's url
  * and the event it went in as
  */
 export const postReview = async ({ token, repository, number, commitId, event, comments, body, fetchImpl = fetch }: {