fix: harden reviewer-bot reconcile freshness

.github/actions/reviewer-bot-source/action.yml

@@ -0,0 +1,18 @@
+name: Reviewer Bot Source
+description: Select the trusted checked-out reviewer-bot source root.
+outputs:
+  bot-src-root:
+    description: Absolute path to the trusted reviewer-bot source checkout.
+    value: ${{ steps.source-root.outputs.bot-src-root }}
+runs:
+  using: composite
+  steps:
+    - id: source-root
+      shell: bash
+      run: |
+        if [ ! -f "$GITHUB_WORKSPACE/scripts/reviewer_bot.py" ]; then
+          echo "reviewer-bot source checkout is missing scripts/reviewer_bot.py" >&2
+          exit 1
+        fi
+        printf 'bot-src-root=%s\n' "$GITHUB_WORKSPACE" >> "$GITHUB_OUTPUT"
+        printf 'BOT_SRC_ROOT=%s\n' "$GITHUB_WORKSPACE" >> "$GITHUB_ENV"

.github/workflows/reviewer-bot-issue-comment-direct.yml

@@ -23,30 +23,16 @@ jobs:
     steps:
       - name: Install uv
         run: python -m pip install uv
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-          repo = os.environ['GITHUB_REPOSITORY']
-          ref = os.environ['GITHUB_SHA']
-          req = urllib.request.Request(
-              f'https://api.github.com/repos/{repo}/tarball/{ref}',
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Checkout trusted bot source
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Run reviewer bot
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EVENT_NAME: issue_comment
           EVENT_ACTION: created

.github/workflows/reviewer-bot-issues.yml

@@ -22,30 +22,16 @@ jobs:
     steps:
       - name: Install uv
         run: python -m pip install uv
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-          repo = os.environ['GITHUB_REPOSITORY']
-          ref = os.environ['GITHUB_SHA']
-          req = urllib.request.Request(
-              f'https://api.github.com/repos/{repo}/tarball/{ref}',
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Checkout trusted bot source
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Run reviewer bot
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EVENT_NAME: issues
           EVENT_ACTION: ${{ github.event.action }}

.github/workflows/reviewer-bot-pr-comment-router.yml

@@ -28,29 +28,17 @@ jobs:
     steps:
       - name: Install uv
         run: python -m pip install uv
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-          req = urllib.request.Request(
-              f"https://api.github.com/repos/{os.environ['GITHUB_REPOSITORY']}/tarball/{os.environ['GITHUB_SHA']}",
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Checkout trusted bot source
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Route PR comment
         id: route
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PAYLOAD_PATH: ${{ runner.temp }}/deferred-comment.json
         run: |
@@ -164,6 +152,7 @@ jobs:
                   'source_workflow_file': '.github/workflows/reviewer-bot-pr-comment-router.yml',
                   'source_run_id': int(os.environ['GITHUB_RUN_ID']),
                   'source_run_attempt': int(os.environ['GITHUB_RUN_ATTEMPT']),
+                  'source_artifact_name': f"reviewer-bot-comment-context-{os.environ['GITHUB_RUN_ID']}-attempt-{os.environ['GITHUB_RUN_ATTEMPT']}",
                   'source_event_name': 'issue_comment',
                   'source_event_action': 'created',
                   'source_event_key': f"issue_comment:{comment['id']}",
@@ -197,35 +186,24 @@ jobs:
     needs: [route-pr-comment]
     runs-on: ubuntu-latest
     permissions:
+      # Temporary lock debt: contents:write is allowed only for the existing lock-ref API operations.
       contents: write
       issues: write
       pull-requests: write
       actions: read
     steps:
       - name: Install uv
         run: python -m pip install uv
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-          req = urllib.request.Request(
-              f"https://api.github.com/repos/{os.environ['GITHUB_REPOSITORY']}/tarball/{os.environ['GITHUB_SHA']}",
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Checkout trusted bot source
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Run reviewer bot
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EVENT_NAME: issue_comment
           EVENT_ACTION: created

.github/workflows/reviewer-bot-pr-metadata.yml

@@ -22,28 +22,16 @@ jobs:
     steps:
       - name: Install uv
         run: python -m pip install uv
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-          req = urllib.request.Request(
-              f"https://api.github.com/repos/{os.environ['GITHUB_REPOSITORY']}/tarball/{os.environ['GITHUB_SHA']}",
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Checkout trusted bot source
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Run reviewer bot
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EVENT_NAME: pull_request_target
           EVENT_ACTION: ${{ github.event.action }}

.github/workflows/reviewer-bot-pr-review-dismissed-observer.yml

@@ -21,6 +21,7 @@ jobs:
           COMMIT_ID: ${{ github.event.review.commit_id }}
           REVIEW_AUTHOR: ${{ github.event.review.user.login }}
           REVIEW_AUTHOR_ID: ${{ github.event.review.user.id }}
+          SOURCE_DISMISSED_AT: ${{ github.event.review.dismissed_at }}
         run: |
           python - <<'PY'
           import json, os
@@ -36,6 +37,7 @@ jobs:
               'source_event_key': f"pull_request_review_dismissed:{os.environ['REVIEW_ID']}",
               'pr_number': int(os.environ['PR_NUMBER']),
               'review_id': int(os.environ['REVIEW_ID']),
+              'source_dismissed_at': os.environ['SOURCE_DISMISSED_AT'],
               'source_commit_id': os.environ['COMMIT_ID'],
               'actor_login': os.environ['REVIEW_AUTHOR'],
               'actor_id': int(os.environ['REVIEW_AUTHOR_ID']),

.github/workflows/reviewer-bot-preview.yml

@@ -36,28 +36,16 @@ jobs:
     steps:
       - name: Install uv
         run: python -m pip install uv
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-          req = urllib.request.Request(
-              f"https://api.github.com/repos/{os.environ['GITHUB_REPOSITORY']}/tarball/{os.environ['GITHUB_SHA']}",
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Checkout trusted bot source
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Run reviewer bot preview
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EVENT_NAME: workflow_dispatch
           EVENT_ACTION: ''

.github/workflows/reviewer-bot-privileged-commands.yml

@@ -18,6 +18,7 @@ jobs:
   privileged-command-executor:
     runs-on: ubuntu-latest
     permissions:
+      # Temporary lock debt: contents:write is allowed only for the existing lock-ref API operations.
       contents: write
       issues: write
       pull-requests: write
@@ -27,27 +28,9 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
       - name: Install uv
         run: python -m pip install uv
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-
-          req = urllib.request.Request(
-              f"https://api.github.com/repos/{os.environ['GITHUB_REPOSITORY']}/tarball/{os.environ['GITHUB_SHA']}",
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Document isolated privileged execution boundary
         run: |
           {
@@ -57,6 +40,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Execute persisted privileged command
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EVENT_NAME: workflow_dispatch
           EVENT_ACTION: execute-pending-privileged-command

.github/workflows/reviewer-bot-reconcile.yml

@@ -17,7 +17,6 @@ env:
 
 jobs:
   reconcile:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       # Temporary lock debt: contents:write is allowed only for the existing lock-ref API operations.
@@ -36,26 +35,13 @@ jobs:
           run-id: ${{ github.event.workflow_run.id }}
           repository: ${{ github.repository }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Fetch trusted bot source tarball
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          python - <<'PY'
-          import io, os, tarfile, urllib.request
-          from pathlib import Path
-          req = urllib.request.Request(
-              f"https://api.github.com/repos/{os.environ['GITHUB_REPOSITORY']}/tarball/{os.environ['GITHUB_SHA']}",
-              headers={'Authorization': f"Bearer {os.environ['GITHUB_TOKEN']}", 'Accept': 'application/vnd.github+json'},
-          )
-          target = Path(os.environ['RUNNER_TEMP']) / 'reviewer-bot-src'
-          target.mkdir(parents=True, exist_ok=True)
-          with urllib.request.urlopen(req) as response:
-              data = response.read()
-          with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
-              archive.extractall(target)
-          roots = list(target.iterdir())
-          print(f'BOT_SRC_ROOT={roots[0]}', file=open(os.environ['GITHUB_ENV'], 'a', encoding='utf-8'))
-          PY
+      - name: Checkout trusted bot source
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ github.sha }}
+      - name: Select trusted bot source
+        id: bot-source
+        uses: ./.github/actions/reviewer-bot-source
       - name: Select deferred payload
         run: |
           python - <<'PY'
@@ -69,6 +55,7 @@ jobs:
           PY
       - name: Run trusted reconcile
         env:
+          BOT_SRC_ROOT: ${{ steps.bot-source.outputs.bot-src-root }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           EVENT_NAME: workflow_run
           EVENT_ACTION: completed