ci(github-action): update action https://github.com/misospace/pr-reviewer-action (v3.3.0 ➔ v3.4.1) #2316

Merged

GiorgioAresu merged 1 commit from renovate/https-github.com-misospace-pr-reviewer-action-3.x into main 2026-10-10 00:18:34 +02:00

Conversation 2 Commits 1 Files changed 1 +1 -1

renovate-bot commented 2026-10-07 23:03:05 +02:00

Collaborator

• Copy link
• Copy Markdown

This PR contains the following updates:

Package	Type	Update	Change
https://github.com/misospace/pr-reviewer-action	action	minor	v3.3.0 → v3.4.1

---

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

misospace/pr-reviewer-action (https://github.com/misospace/pr-reviewer-action)

v3.4.1

Compare Source

Bug Fixes

• model: keep 5xx on the tier retry budget (#​1006) (#​1007) (106f284)

v3.4.0

Compare Source

3.4.0 is about attribution. A reviewer earns its keep by blocking a PR only for something the PR actually did, and by claiming only what it can prove. Both halves got real work here: a proof layer that can now handle a requirement enforced across several seams instead of demanding one blessed location, and a cluster of verdict fixes that stop a red check from landing on the author's doorstep when the real cause was a degraded model run, a check that merely got cancelled, or a question nobody can answer from the diff.

The headline is distributed enforcement for requirement tracing (#​981). Declare a rule's seams in .github/pr-reviewer-owners.yml, and the reviewer must cite every seam — its own enforcement location and its own matching test — before it will call the requirement met. A cross-cutting standard that used to be unverifiable by construction is now provable, and only from a topology the model can't author.

Nothing breaks and nothing needs reconfiguring. One default changed in the direction of blocking less, and two opt-in paths shifted; all three are spelled out in Upgrading so a stricter gate than you expect never surprises you.

If your specialists should run on a different model than your primary, that is finally a first-class input:

- uses: misospace/pr-reviewer-action@v3
  with:
    ai-base-url: ${{ vars.AI_BASE_URL }}
    ai-api-key: ${{ secrets.AI_API_KEY }}
    ai-model: ${{ vars.AI_MODEL }}
    # deep-review specialists can run somewhere else entirely
    ai-specialist-model: ${{ vars.SPECIALIST_MODEL }}
    ai-specialist-api-key: ${{ secrets.SPECIALIST_API_KEY }}

Requirements that span more than one place

• Distributed enforcement (#​981, closes #​962): a rule in .github/pr-reviewer-owners.yml may declare groups — named seams, each with its own owners globs and optional tests globs. The requirement is met only when the reviewer cites every declared seam with a distinct enforcement location and a distinct matching test (an injective match, so one citation cannot cover two seams). The topology is read from the base ref: the model cannot declare its own requirement distributed, and a model-supplied symbol is excluded from the predicate. Caps at four seams and fails closed past that; a groups block yielding fewer than two valid seams degrades to a plain ownership rule with a warning.
• Deterministic state proofs (#​990, closes #​985): a fourth proof shape, structural_state, for requirements whose truth is a property of repository state rather than runtime behavior or a dedicated test — ".dockerignore must not exclude assets/" is provable by re-deriving the assertion from the cited non-source file. The classifier is deliberately strict: containment is enforced (paths with .. or symlink components fail closed), compound assertions are rejected, and a trailing test-demand adjunct is stripped before the polarity check.
• A verdict with an empty trace no longer reads as a coverage gap (#​963, closes #​959): when the reviewer cited real locations in prose but the trace array came back empty, the review now says not-traced-by-reviewer instead of falsely reporting "no valid enforcement location", and a bounded one-pass repair re-asks the primary route for the missing ids. It never overwrites a claim that already exists, and it stands down if you have replaced the trace fragment.
• Hyphenated code spans are atomic (#​1001): `api-key` no longer splits into the prose words api and key, which was enough to let a fabricated "api key" phrase scope a requirement into a redaction-only diff and raise a false requirement_trace_incomplete.

All of this stays behind requirement-trace: true, as before. Nothing here turns on by default.

The reviewer stops blocking on things the PR didn't do

• Verification asks never block (#​986): a category: verification finding is excluded from every blocking determination. Under the default strict policy a finding set of only verification asks publishes as approve; findings_severity_gated never escalates on them; verdict-policy: model relaxes a model request_changes when the entire open set is asks. A major verification finding could block a PR before — it cannot now.
• A degraded run cannot fail the gate (#​987): a request_changes produced by a degraded model run — the availability fallback with no evidence, or on-model-failure: notice — no longer trips fail-on-request-changes. The bypass is provenance-gated on the verdict source, so ordinary primary and fallback verdicts are untouched, and deterministic blocks (evidence blockers, a required check in mode: fail, an incomplete requirement trace) still block.
• CI restatements stop counting as review findings (#​995): check conclusions are carried raw instead of being collapsed to failure, so cancelled, timed_out and action_required read as themselves; superseded runs are deduplicated by name keeping the latest; every run of the reviewer's own workflow is excluded. The section is framed as context-only, and a finding with no code anchor whose message is nothing but a check name plus a status predicate is capped to info. A request_changes whose every finding just re-announces a red check now approves — CI already gates that merge on its own. The match is anchored and strict on purpose: false negatives beat deterministic false approvals.
• Non-retryable HTTP errors fail fast (#​987, closes #​978): a 403 exits immediately instead of walking the whole retry ladder — roughly ten minutes at the defaults — before the fallback is even attempted. Retryable statuses (429, 500, 502, 503, 504) are unchanged.
• A ../ inside a comment is not a path-handling risk (#​968, closes #​960): comment spans are blanked before the content classifier scans, so a JSDoc mentioning ../events/types.js stops firing path_handling_changes and stops demanding a must_check on a clean diff. Surviving mentions are still recorded as a discounted provenance signal, and CSS hex colours, URL schemes and unspaced floor division are correctly left as code.
• The diff stops calling itself truncated (#​992): the corpus headings are now # PR Diff and # PR Files, and the truncation caveat comes only from the in-band marker a real cut appends. Small PRs stop claiming their diff was truncated in the model's Unknowns section.

Trust, provenance, and secrets

• Managed-body provenance is authenticated before a skip (#​973): precheck now resolves the run's own forge identity and requires a managed comment's or review's author to match before that body may supply a skip fingerprint or a carried verdict. Copying a published fingerprint into a newer comment no longer makes the next run skip the model and carry an approve. Missing or mismatched ownership fails closed — a fresh review, never a silent skip.
• Managed reads paginate (#​971): on long-lived PRs the latest managed review is found, instead of a stale page-one verdict being carried forward.
• Redaction covers the verified sk- families (#​991, #​997, #​1002): bare and hyphenated OpenAI sk- keys are masked in published prose, and the dashed families are masked in repository source evidence — sk-proj-, sk-ant-api03-, sk-or-v1-, plus the marker- and shape-pinned sk-svcacct-, sk-admin-, sk-None-, sk-ant-oat01- and sk-ant-admin01-. Entropy and marker guards keep ordinary same-prefix paths like docs/sk-proj-deployment-runbook-notes from being redacted. The accepted residual: an oat01 token continuing past its 40-character body is masked whole rather than partially.
• Forgejo discovers its own CI status (#​984): the review job no longer deadlocks waiting on its own still-running status. Auto-discovery needs Forgejo v16.0+ (the release that introduced the run-jobs API), and excludes a pending status only when that API proves a single-job run whose html_url path matches the status target_url path on the runner's origin. Multi-job reviewer workflows and older instances still want an explicit CI_STATUS_CONTEXT; older instances warn immediately and fall back to bounded waiting. No new permissions — the call uses the existing token.

Where you can see it

• Blocking findings land on the failed check (#​988, closes #​975): every blocker and major becomes a ::error:: annotation with its file and line on the check run, plus a Severity / Category / Message / File table in the Actions step summary. Model-derived text is redacted and escape-flattened first, so a finding cannot forge a newline or break out of its fence to promote itself into workflow output.
• Specialists can run on their own model (#​979, closes #​966): ai-specialist-model, ai-specialist-base-url, ai-specialist-api-format and ai-specialist-api-key define a specialist profile; ai-specialist-correctness-model, ai-specialist-security-model and ai-specialist-tests-model override the model for one role. Unset fields inherit the primary route. Invalid specialist config fails soft back to primary inheritance — it can never redirect the main review. Workflow inputs only: never PR-controlled, never repo-configurable.
• Drafts are skipped deterministically (#​972): no review attempt at all, including a forced ai-review label or /ai-review command. Marking the PR ready re-opens it. If you added your own if: !github.event.pull_request.draft guard, you can drop it.

Routing

• auto always starts on primary (#​965): there is no longer a deterministic pre-primary route to the smart model. Smart is reached only when a completed primary verdict sets smart_review_requested, bounded to one rerun — the reviewer-requested escalation contract from #​721, now with no back door. The inert escalate_on_* sibling flags are formally gone from the contract. This only affects you if you set review-routing-mode: auto.

Upgrading

Pin to v3.4.0, or the floating v3 tag, which now follows this build. Immutable-version and SHA pins must be bumped deliberately.

Three behaviors changed, all in the direction of blocking less. None require a config change.

• verdict-policy: strict (the default) — a category: verification finding no longer blocks, even tagged major (#​986). A verification-only finding set publishes as approve-with-findings.
• fail-on-request-changes: true (opt-in) — a request_changes from a degraded run (availability fallback with no evidence, or on-model-failure: notice) no longer fails the check (#​987). Deterministic blocks still do.
• review-routing-mode: auto (opt-in) — PRs that could previously skip straight to the smart model now always get a primary review first (#​965).

Worth knowing:

• No input renames or removals. Every input's current contract lives in docs/inputs.md.
• New keys are additive: the ai-specialist-* inputs, and groups inside .github/pr-reviewer-owners.yml.
• On Forgejo, CI auto-discovery requires v16.0+; older instances warn and fall back to CI_STATUS_CONTEXT.
• The retired parity/snapshot harness is gone (#​983). npm run typecheck && npm test is now the sole developer gate, and the coverage it pinned lives on in focused tests-v3/ regressions.

Full changelog: https://github.com/misospace/pr-reviewer-action/compare/v3.3.0...v3.4.0

Generated changelog (release-please)

Features

• precheck: skip draft PRs deterministically (#​972) (3634ed5)
• requirement-trace: support distributed enforcement (#​981) (306d92c), closes #​962
• specialists: trusted model-profile overrides (#​966) (#​979) (d791545)

Bug Fixes

• ci-evidence: carry raw check conclusions (#​995) (97a24ba)
• classification: ignore ../ inside comments (#​960) (#​968) (811dfcc)
• corpus: stop labelling every PR diff as truncated (#​992) (605b7ee)
• forgejo: auto-discover own CI status (#​984) (e579697)
• gate: put the blocking findings on the failed check and in the step summary (#​975) (#​988) (e5106a1)
• model: stop retrying non-retryable HTTP errors, unblock degraded verdicts (#​987) (0911d88), closes #​978
• precheck: authenticate managed-body provenance before skips (#​973) (0f5ef1f)
• precheck: paginate GitHub managed reads (#​971) (aac8a77)
• precheck: paginate GitHub managed reads (#​971) (fa8903c)
• redact: mask dashed sk- key families in source evidence (#​997) (54436f3)
• redact: mask OpenAI-style sk- keys in published prose (#​991) (ad8fa7f), closes #​989
• redact: mask remaining verified sk- families (#​1002) (fcdf907)
• requirement-trace: accept deterministic state proofs (#​985) (#​990) (ce437eb)
• requirement-trace: repair a verdict with no trace claims (#​959) (#​963) (079f485)
• requirements: treat hyphenated code spans as atomic subject terms (#​1001) (9ef0c65)
• routing: drop direct-smart pre-routing (#​965) (200ef91)
• routing: drop direct-smart pre-routing (#​965) (bbea21c)
• routing: encode primary-only first pass in code (735f664)
• routing: prebuild smart corpus for escalation (f1070f2)
• verdict: verification asks never block a PR (#​986) (9b488d4)

Chores

• remove the retired parity/snapshot harness (#​983) (cbc8f47)

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/misospace/pr-reviewer-action](https://github.com/misospace/pr-reviewer-action) | action | minor | `v3.3.0` → `v3.4.1` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>misospace/pr-reviewer-action (https://github.com/misospace/pr-reviewer-action)</summary> ### [`v3.4.1`](https://github.com/misospace/pr-reviewer-action/releases/tag/v3.4.1) [Compare Source](https://github.com/misospace/pr-reviewer-action/compare/v3.4.0...v3.4.1) ##### Bug Fixes - **model:** keep 5xx on the tier retry budget ([#&#8203;1006](https://github.com/misospace/pr-reviewer-action/issues/1006)) ([#&#8203;1007](https://github.com/misospace/pr-reviewer-action/issues/1007)) ([106f284](https://github.com/misospace/pr-reviewer-action/commit/106f284271f4f77dfbb0b3d3da659dcab61348e2)) ### [`v3.4.0`](https://github.com/misospace/pr-reviewer-action/releases/tag/v3.4.0) [Compare Source](https://github.com/misospace/pr-reviewer-action/compare/v3.3.0...v3.4.0) 3.4.0 is about **attribution**. A reviewer earns its keep by blocking a PR only for something the PR actually did, and by claiming only what it can prove. Both halves got real work here: a proof layer that can now handle a requirement enforced across several seams instead of demanding one blessed location, and a cluster of verdict fixes that stop a red check from landing on the author's doorstep when the real cause was a degraded model run, a check that merely got cancelled, or a question nobody can answer from the diff. The headline is **distributed enforcement** for requirement tracing ([#&#8203;981](https://github.com/misospace/pr-reviewer-action/issues/981)). Declare a rule's seams in `.github/pr-reviewer-owners.yml`, and the reviewer must cite *every* seam — its own enforcement location and its own matching test — before it will call the requirement met. A cross-cutting standard that used to be unverifiable by construction is now provable, and only from a topology the model can't author. Nothing breaks and nothing needs reconfiguring. One default changed in the direction of blocking *less*, and two opt-in paths shifted; all three are spelled out in [Upgrading](#upgrading) so a stricter gate than you expect never surprises you. If your specialists should run on a different model than your primary, that is finally a first-class input: ```yaml - uses: misospace/pr-reviewer-action@v3 with: ai-base-url: ${{ vars.AI_BASE_URL }} ai-api-key: ${{ secrets.AI_API_KEY }} ai-model: ${{ vars.AI_MODEL }} # deep-review specialists can run somewhere else entirely ai-specialist-model: ${{ vars.SPECIALIST_MODEL }} ai-specialist-api-key: ${{ secrets.SPECIALIST_API_KEY }} ``` #### Requirements that span more than one place - **Distributed enforcement** ([#&#8203;981](https://github.com/misospace/pr-reviewer-action/issues/981), closes [#&#8203;962](https://github.com/misospace/pr-reviewer-action/issues/962)): a rule in `.github/pr-reviewer-owners.yml` may declare `groups` — named seams, each with its own `owners` globs and optional `tests` globs. The requirement is `met` only when the reviewer cites every declared seam with a distinct enforcement location *and* a distinct matching test (an injective match, so one citation cannot cover two seams). The topology is read from the **base ref**: the model cannot declare its own requirement distributed, and a model-supplied `symbol` is excluded from the predicate. Caps at four seams and fails closed past that; a `groups` block yielding fewer than two valid seams degrades to a plain ownership rule with a warning. - **Deterministic state proofs** ([#&#8203;990](https://github.com/misospace/pr-reviewer-action/issues/990), closes [#&#8203;985](https://github.com/misospace/pr-reviewer-action/issues/985)): a fourth proof shape, `structural_state`, for requirements whose truth is a property of repository state rather than runtime behavior or a dedicated test — "`.dockerignore` must not exclude `assets/`" is provable by re-deriving the assertion from the cited non-source file. The classifier is deliberately strict: containment is enforced (paths with `..` or symlink components fail closed), compound assertions are rejected, and a trailing test-demand adjunct is stripped before the polarity check. - **A verdict with an empty trace no longer reads as a coverage gap** ([#&#8203;963](https://github.com/misospace/pr-reviewer-action/issues/963), closes [#&#8203;959](https://github.com/misospace/pr-reviewer-action/issues/959)): when the reviewer cited real locations in prose but the trace array came back empty, the review now says `not-traced-by-reviewer` instead of falsely reporting "no valid enforcement location", and a bounded one-pass repair re-asks the primary route for the missing ids. It never overwrites a claim that already exists, and it stands down if you have replaced the trace fragment. - **Hyphenated code spans are atomic** ([#&#8203;1001](https://github.com/misospace/pr-reviewer-action/issues/1001)): `` `api-key` `` no longer splits into the prose words `api` and `key`, which was enough to let a fabricated "api key" phrase scope a requirement into a redaction-only diff and raise a false `requirement_trace_incomplete`. All of this stays behind `requirement-trace: true`, as before. Nothing here turns on by default. #### The reviewer stops blocking on things the PR didn't do - **Verification asks never block** ([#&#8203;986](https://github.com/misospace/pr-reviewer-action/issues/986)): a `category: verification` finding is excluded from every blocking determination. Under the default `strict` policy a finding set of only verification asks publishes as approve; `findings_severity_gated` never escalates on them; `verdict-policy: model` relaxes a model `request_changes` when the entire open set is asks. A `major` verification finding could block a PR before — it cannot now. - **A degraded run cannot fail the gate** ([#&#8203;987](https://github.com/misospace/pr-reviewer-action/issues/987)): a `request_changes` produced by a degraded model run — the availability fallback with no evidence, or `on-model-failure: notice` — no longer trips `fail-on-request-changes`. The bypass is provenance-gated on the verdict source, so ordinary primary and fallback verdicts are untouched, and deterministic blocks (evidence blockers, a required check in `mode: fail`, an incomplete requirement trace) still block. - **CI restatements stop counting as review findings** ([#&#8203;995](https://github.com/misospace/pr-reviewer-action/issues/995)): check conclusions are carried raw instead of being collapsed to `failure`, so `cancelled`, `timed_out` and `action_required` read as themselves; superseded runs are deduplicated by name keeping the latest; every run of the reviewer's own workflow is excluded. The section is framed as context-only, and a finding with no code anchor whose message is *nothing but* a check name plus a status predicate is capped to `info`. A `request_changes` whose every finding just re-announces a red check now approves — CI already gates that merge on its own. The match is anchored and strict on purpose: false negatives beat deterministic false approvals. - **Non-retryable HTTP errors fail fast** ([#&#8203;987](https://github.com/misospace/pr-reviewer-action/issues/987), closes [#&#8203;978](https://github.com/misospace/pr-reviewer-action/issues/978)): a 403 exits immediately instead of walking the whole retry ladder — roughly ten minutes at the defaults — before the fallback is even attempted. Retryable statuses (429, 500, 502, 503, 504) are unchanged. - **A `../` inside a comment is not a path-handling risk** ([#&#8203;968](https://github.com/misospace/pr-reviewer-action/issues/968), closes [#&#8203;960](https://github.com/misospace/pr-reviewer-action/issues/960)): comment spans are blanked before the content classifier scans, so a JSDoc mentioning `../events/types.js` stops firing `path_handling_changes` and stops demanding a `must_check` on a clean diff. Surviving mentions are still recorded as a discounted provenance signal, and CSS hex colours, URL schemes and unspaced floor division are correctly left as code. - **The diff stops calling itself truncated** ([#&#8203;992](https://github.com/misospace/pr-reviewer-action/issues/992)): the corpus headings are now `# PR Diff` and `# PR Files`, and the truncation caveat comes only from the in-band marker a real cut appends. Small PRs stop claiming their diff was truncated in the model's Unknowns section. #### Trust, provenance, and secrets - **Managed-body provenance is authenticated before a skip** ([#&#8203;973](https://github.com/misospace/pr-reviewer-action/issues/973)): precheck now resolves the run's own forge identity and requires a managed comment's or review's author to match before that body may supply a skip fingerprint or a carried verdict. Copying a published fingerprint into a newer comment no longer makes the next run skip the model and carry an `approve`. Missing or mismatched ownership fails closed — a fresh review, never a silent skip. - **Managed reads paginate** ([#&#8203;971](https://github.com/misospace/pr-reviewer-action/issues/971)): on long-lived PRs the latest managed review is found, instead of a stale page-one verdict being carried forward. - **Redaction covers the verified `sk-` families** ([#&#8203;991](https://github.com/misospace/pr-reviewer-action/issues/991), [#&#8203;997](https://github.com/misospace/pr-reviewer-action/issues/997), [#&#8203;1002](https://github.com/misospace/pr-reviewer-action/issues/1002)): bare and hyphenated OpenAI `sk-` keys are masked in published prose, and the dashed families are masked in repository source evidence — `sk-proj-`, `sk-ant-api03-`, `sk-or-v1-`, plus the marker- and shape-pinned `sk-svcacct-`, `sk-admin-`, `sk-None-`, `sk-ant-oat01-` and `sk-ant-admin01-`. Entropy and marker guards keep ordinary same-prefix paths like `docs/sk-proj-deployment-runbook-notes` from being redacted. The accepted residual: an `oat01` token continuing past its 40-character body is masked whole rather than partially. - **Forgejo discovers its own CI status** ([#&#8203;984](https://github.com/misospace/pr-reviewer-action/issues/984)): the review job no longer deadlocks waiting on its own still-running status. Auto-discovery needs **Forgejo v16.0+** (the release that introduced the run-jobs API), and excludes a pending status only when that API proves a single-job run whose `html_url` path matches the status `target_url` path on the runner's origin. Multi-job reviewer workflows and older instances still want an explicit `CI_STATUS_CONTEXT`; older instances warn immediately and fall back to bounded waiting. No new permissions — the call uses the existing token. #### Where you can see it - **Blocking findings land on the failed check** ([#&#8203;988](https://github.com/misospace/pr-reviewer-action/issues/988), closes [#&#8203;975](https://github.com/misospace/pr-reviewer-action/issues/975)): every blocker and major becomes a `::error::` annotation with its file and line on the check run, plus a Severity / Category / Message / File table in the Actions step summary. Model-derived text is redacted and escape-flattened first, so a finding cannot forge a newline or break out of its fence to promote itself into workflow output. - **Specialists can run on their own model** ([#&#8203;979](https://github.com/misospace/pr-reviewer-action/issues/979), closes [#&#8203;966](https://github.com/misospace/pr-reviewer-action/issues/966)): `ai-specialist-model`, `ai-specialist-base-url`, `ai-specialist-api-format` and `ai-specialist-api-key` define a specialist profile; `ai-specialist-correctness-model`, `ai-specialist-security-model` and `ai-specialist-tests-model` override the model for one role. Unset fields inherit the primary route. Invalid specialist config fails soft back to primary inheritance — it can never redirect the main review. Workflow inputs only: never PR-controlled, never repo-configurable. - **Drafts are skipped deterministically** ([#&#8203;972](https://github.com/misospace/pr-reviewer-action/issues/972)): no review attempt at all, including a forced `ai-review` label or `/ai-review` command. Marking the PR ready re-opens it. If you added your own `if: !github.event.pull_request.draft` guard, you can drop it. #### Routing - **`auto` always starts on primary** ([#&#8203;965](https://github.com/misospace/pr-reviewer-action/issues/965)): there is no longer a deterministic pre-primary route to the smart model. Smart is reached only when a completed primary verdict sets `smart_review_requested`, bounded to one rerun — the reviewer-requested escalation contract from [#&#8203;721](https://github.com/misospace/pr-reviewer-action/issues/721), now with no back door. The inert `escalate_on_*` sibling flags are formally gone from the contract. This only affects you if you set `review-routing-mode: auto`. #### Upgrading Pin to `v3.4.0`, or the floating `v3` tag, which now follows this build. Immutable-version and SHA pins must be bumped deliberately. Three behaviors changed, all in the direction of blocking less. None require a config change. - **`verdict-policy: strict` (the default)** — a `category: verification` finding no longer blocks, even tagged `major` ([#&#8203;986](https://github.com/misospace/pr-reviewer-action/issues/986)). A verification-only finding set publishes as approve-with-findings. - **`fail-on-request-changes: true` (opt-in)** — a `request_changes` from a *degraded* run (availability fallback with no evidence, or `on-model-failure: notice`) no longer fails the check ([#&#8203;987](https://github.com/misospace/pr-reviewer-action/issues/987)). Deterministic blocks still do. - **`review-routing-mode: auto` (opt-in)** — PRs that could previously skip straight to the smart model now always get a primary review first ([#&#8203;965](https://github.com/misospace/pr-reviewer-action/issues/965)). Worth knowing: - No input renames or removals. Every input's current contract lives in [docs/inputs.md](https://github.com/misospace/pr-reviewer-action/blob/v3.4.0/docs/inputs.md). - New keys are additive: the `ai-specialist-*` inputs, and `groups` inside `.github/pr-reviewer-owners.yml`. - On Forgejo, CI auto-discovery requires v16.0+; older instances warn and fall back to `CI_STATUS_CONTEXT`. - The retired parity/snapshot harness is gone ([#&#8203;983](https://github.com/misospace/pr-reviewer-action/issues/983)). `npm run typecheck && npm test` is now the sole developer gate, and the coverage it pinned lives on in focused `tests-v3/` regressions. **Full changelog:** <https://github.com/misospace/pr-reviewer-action/compare/v3.3.0...v3.4.0> <details> <summary>Generated changelog (release-please)</summary> ##### Features - **precheck:** skip draft PRs deterministically ([#&#8203;972](https://github.com/misospace/pr-reviewer-action/issues/972)) ([3634ed5](https://github.com/misospace/pr-reviewer-action/commit/3634ed5ef2ec87bc377a83c9798509db166b535a)) - **requirement-trace:** support distributed enforcement ([#&#8203;981](https://github.com/misospace/pr-reviewer-action/issues/981)) ([306d92c](https://github.com/misospace/pr-reviewer-action/commit/306d92c3692b2f45b7d0b6b469eda51ce60cd8cd)), closes [#&#8203;962](https://github.com/misospace/pr-reviewer-action/issues/962) - **specialists:** trusted model-profile overrides ([#&#8203;966](https://github.com/misospace/pr-reviewer-action/issues/966)) ([#&#8203;979](https://github.com/misospace/pr-reviewer-action/issues/979)) ([d791545](https://github.com/misospace/pr-reviewer-action/commit/d791545b57c93eb5b11265e52aa5f641cdbbe26c)) ##### Bug Fixes - **ci-evidence:** carry raw check conclusions ([#&#8203;995](https://github.com/misospace/pr-reviewer-action/issues/995)) ([97a24ba](https://github.com/misospace/pr-reviewer-action/commit/97a24bafa9234553fffde3b49665000375ce6e79)) - **classification:** ignore `../` inside comments ([#&#8203;960](https://github.com/misospace/pr-reviewer-action/issues/960)) ([#&#8203;968](https://github.com/misospace/pr-reviewer-action/issues/968)) ([811dfcc](https://github.com/misospace/pr-reviewer-action/commit/811dfccc1007f28b0db389a4d5a2e684a36be06e)) - **corpus:** stop labelling every PR diff as truncated ([#&#8203;992](https://github.com/misospace/pr-reviewer-action/issues/992)) ([605b7ee](https://github.com/misospace/pr-reviewer-action/commit/605b7eef7ea0dbe94b538122097e3abbb4eb9590)) - **forgejo:** auto-discover own CI status ([#&#8203;984](https://github.com/misospace/pr-reviewer-action/issues/984)) ([e579697](https://github.com/misospace/pr-reviewer-action/commit/e5796977b9aeb3dcff0c4a79b06fd31f123bba75)) - **gate:** put the blocking findings on the failed check and in the step summary ([#&#8203;975](https://github.com/misospace/pr-reviewer-action/issues/975)) ([#&#8203;988](https://github.com/misospace/pr-reviewer-action/issues/988)) ([e5106a1](https://github.com/misospace/pr-reviewer-action/commit/e5106a1820f6fc539045fad2a06068066ce68d76)) - **model:** stop retrying non-retryable HTTP errors, unblock degraded verdicts ([#&#8203;987](https://github.com/misospace/pr-reviewer-action/issues/987)) ([0911d88](https://github.com/misospace/pr-reviewer-action/commit/0911d88f1a2d7959b859700f220f1f11785aecd2)), closes [#&#8203;978](https://github.com/misospace/pr-reviewer-action/issues/978) - **precheck:** authenticate managed-body provenance before skips ([#&#8203;973](https://github.com/misospace/pr-reviewer-action/issues/973)) ([0f5ef1f](https://github.com/misospace/pr-reviewer-action/commit/0f5ef1fb1239b5e5e3a7138e0fbdf5f16de97f7c)) - **precheck:** paginate GitHub managed reads ([#&#8203;971](https://github.com/misospace/pr-reviewer-action/issues/971)) ([aac8a77](https://github.com/misospace/pr-reviewer-action/commit/aac8a77e0034a446eeb959ecd1c88acb7cb28f39)) - **precheck:** paginate GitHub managed reads ([#&#8203;971](https://github.com/misospace/pr-reviewer-action/issues/971)) ([fa8903c](https://github.com/misospace/pr-reviewer-action/commit/fa8903c0b96320fd8d6beec3c07c5c544874290f)) - **redact:** mask dashed sk- key families in source evidence ([#&#8203;997](https://github.com/misospace/pr-reviewer-action/issues/997)) ([54436f3](https://github.com/misospace/pr-reviewer-action/commit/54436f360bec016dd77ff9f216f75e1a3b7b8417)) - **redact:** mask OpenAI-style sk- keys in published prose ([#&#8203;991](https://github.com/misospace/pr-reviewer-action/issues/991)) ([ad8fa7f](https://github.com/misospace/pr-reviewer-action/commit/ad8fa7f53c83614ba31c997f16dcc6576ed14437)), closes [#&#8203;989](https://github.com/misospace/pr-reviewer-action/issues/989) - **redact:** mask remaining verified sk- families ([#&#8203;1002](https://github.com/misospace/pr-reviewer-action/issues/1002)) ([fcdf907](https://github.com/misospace/pr-reviewer-action/commit/fcdf9077bd8a2f7946fed2039121ec67d02c6d9e)) - **requirement-trace:** accept deterministic state proofs ([#&#8203;985](https://github.com/misospace/pr-reviewer-action/issues/985)) ([#&#8203;990](https://github.com/misospace/pr-reviewer-action/issues/990)) ([ce437eb](https://github.com/misospace/pr-reviewer-action/commit/ce437ebecf43f08c676df8184cc614e9607abfc6)) - **requirement-trace:** repair a verdict with no trace claims ([#&#8203;959](https://github.com/misospace/pr-reviewer-action/issues/959)) ([#&#8203;963](https://github.com/misospace/pr-reviewer-action/issues/963)) ([079f485](https://github.com/misospace/pr-reviewer-action/commit/079f4856efd223d457fa7ed13a08f06a5ecd7786)) - **requirements:** treat hyphenated code spans as atomic subject terms ([#&#8203;1001](https://github.com/misospace/pr-reviewer-action/issues/1001)) ([9ef0c65](https://github.com/misospace/pr-reviewer-action/commit/9ef0c656720c26ea4640459d7745485b349acb59)) - **routing:** drop direct-smart pre-routing ([#&#8203;965](https://github.com/misospace/pr-reviewer-action/issues/965)) ([200ef91](https://github.com/misospace/pr-reviewer-action/commit/200ef916496962e887e3a77fc52d57154618e1fc)) - **routing:** drop direct-smart pre-routing ([#&#8203;965](https://github.com/misospace/pr-reviewer-action/issues/965)) ([bbea21c](https://github.com/misospace/pr-reviewer-action/commit/bbea21cbd87325941cebdc82d4e7dad9004267d3)) - **routing:** encode primary-only first pass in code ([735f664](https://github.com/misospace/pr-reviewer-action/commit/735f6647a62d6e11fbe86e68f60f7480387b36aa)) - **routing:** prebuild smart corpus for escalation ([f1070f2](https://github.com/misospace/pr-reviewer-action/commit/f1070f25732160bc024deb9c699343d1fcddfd56)) - **verdict:** verification asks never block a PR ([#&#8203;986](https://github.com/misospace/pr-reviewer-action/issues/986)) ([9b488d4](https://github.com/misospace/pr-reviewer-action/commit/9b488d492d60e4f26a2ea781afddc832ac887a4f)) ##### Chores - remove the retired parity/snapshot harness ([#&#8203;983](https://github.com/misospace/pr-reviewer-action/issues/983)) ([cbc8f47](https://github.com/misospace/pr-reviewer-action/commit/cbc8f47867e13626f58ce96f9a4ec467d9139c57)) </details> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzMuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEzMy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItYWN0aW9uIiwicmVub3ZhdGUvZ2l0aHViLXJlbGVhc2UiLCJ0eXBlL21pbm9yIl19-->

renovate-bot added the

renovate/github-action

renovate/github-release

type/minor

labels 2026-10-07 23:03:05 +02:00

renovate-bot added 1 commit 2026-10-07 23:03:05 +02:00

ci(github-action): update action https://github.com/misospace/pr-reviewer-action (v3.3.0 ➔ v3.4.0) baaebcd4a9

lab-assistant-bot commented 2026-10-07 23:03:10 +02:00

Collaborator

• Copy link
• Copy Markdown

No rendered changes.

_{konflate 0.6.4 · rendered 5a25a73 · full diff →}

<!-- konflate:pr-2316 --> No rendered changes. _{konflate 0.6.4 · rendered `5a25a73` · [full diff →](https://konflate.aresu.eu/#/pr/2316)}

forgejo-actions added the

area/ci

label 2026-10-07 23:03:11 +02:00

forgejo-actions commented 2026-10-07 23:04:35 +02:00

• Copy link
• Copy Markdown

AI Automated Review

Analysis engine: minimax/MiniMax-M2-7-anthropic (anthropic) — primary route · pr-reviewer-action v3.4.1

Findings (1 info)

Severity	Location	Finding
Info	.forgejo/konflate-evidence-providers.json	The evidence providers config file referenced by the workflow (`.forgejo/konflate-evidence-providers.json`) was not found at the corpus lookup stage; konflate rendered-diff evidence for this PR is therefore unavailable. This is a pre-existing condition, not introduced by this PR. Verify the file exi

Approve — this is a clean Renovate version-bump of misospace/pr-reviewer-action from v3.3.0 to v3.4.1, a single-line SHA-pinned reference update with no configuration changes.

The PR body faithfully surfaces all changes across the skipped v3.4.0 release (which this PR bridges in one jump): distributed enforcement with .github/pr-reviewer-owners.yml groups, structural_state proof shape, not-traced-by-reviewer verdict fix, hyphenated-code-span atomisation, and verification-asks never blocking. The actual v3.4.1 patch on top adds only a bug fix (5xx retriable statuses staying on the tier budget). No breaking changes, no new required inputs, and no reconfiguration needed — consistent with the upstream "Nothing breaks and nothing needs reconfiguring" note.

Claims to falsify (1/1 held, 4 unverified — feature opt-in, not applicable until owner rules are declared):

• Claim 1–4 (distributed enforcement, structural_state, not-traced-by-reviewer, hyphenated spans): all scoped behind requirement-trace: true and .github/pr-reviewer-owners.yml; this repo already has claim-falsification: "true" but has no groups blocks or structural_state requirements declared, so none of these are exercised by the current diff. They are unverified, not violated.
• Claim 5 (category: verification never blocking): functional; no evidence of contradiction.

Changed files: 1 file, 1 line — .forgejo/workflows/pr-reviewer.yaml, the uses SHA and its inline comment.

Non-blocking caveats:

• The evidence-providers-file: .forgejo/konflate-evidence-providers.json input points to a file the konflate evidence provider could not locate. This is pre-existing (not introduced by this PR) and the PR description notes the same, but the provider config and file should be reconciled.
• CI is currently failing (actionlint, yamllint) on the PR head — these are lint failures on the same commit, unrelated to the action version change, and gate on their own.

<!-- ai-pr-reviewer --> <!-- ai-pr-reviewer:{"version":1,"head_sha":"5a25a73384d99f08a9182d9f56123d8256546ce6","base_sha":"e4ef22e042087fc45274af924e8fd9cc94e7233a","review_result":"findings","review_route":"primary","cache_hit_ratio":0.249,"tool_budget":24,"tool_budget_source":"tier-default","tool_calls":6,"tool_rounds":6,"max_rounds":24,"context_budget":65536,"context_peak":15917,"action_version":"v3.4.1"} --> <!-- ai-pr-review-sha:5a25a73384d99f08a9182d9f56123d8256546ce6 --> <!-- ai-pr-review-fingerprint:40e9d41341c4272706d84f645f0e3167467027345bf6d8b3f7e5f620ca09f0ba|cfg:b86cffc4d39ca3d5e6adac977a53851d4c4034b3d113b3888d6ebfc083fff76b --> # AI Automated Review _Analysis engine: minimax/MiniMax-M2-7-anthropic (anthropic) — primary route · pr-reviewer-action v3.4.1_ ### Findings (1 info) | Severity | Location | Finding | | --- | --- | --- | | Info | `.forgejo/konflate-evidence-providers.json` | The evidence providers config file referenced by the workflow (\`.forgejo/konflate-evidence-providers.json\`) was not found at the corpus lookup stage; konflate rendered-diff evidence for this PR is therefore unavailable. This is a pre-existing condition, not introduced by this PR. Verify the file exi | **Approve** — this is a clean Renovate version-bump of `misospace/pr-reviewer-action` from v3.3.0 to v3.4.1, a single-line SHA-pinned reference update with no configuration changes. The PR body faithfully surfaces all changes across the skipped v3.4.0 release (which this PR bridges in one jump): distributed enforcement with `.github/pr-reviewer-owners.yml` groups, `structural_state` proof shape, `not-traced-by-reviewer` verdict fix, hyphenated-code-span atomisation, and verification-asks never blocking. The actual v3.4.1 patch on top adds only a bug fix (5xx retriable statuses staying on the tier budget). No breaking changes, no new required inputs, and no reconfiguration needed — consistent with the upstream "Nothing breaks and nothing needs reconfiguring" note. **Claims to falsify (1/1 held, 4 unverified — feature opt-in, not applicable until owner rules are declared):** - Claim 1–4 (distributed enforcement, `structural_state`, `not-traced-by-reviewer`, hyphenated spans): all scoped behind `requirement-trace: true` and `.github/pr-reviewer-owners.yml`; this repo already has `claim-falsification: "true"` but has no `groups` blocks or `structural_state` requirements declared, so none of these are exercised by the current diff. They are unverified, not violated. - Claim 5 (`category: verification` never blocking): functional; no evidence of contradiction. **Changed files:** 1 file, 1 line — `.forgejo/workflows/pr-reviewer.yaml`, the `uses` SHA and its inline comment. **Non-blocking caveats:** - The `evidence-providers-file: .forgejo/konflate-evidence-providers.json` input points to a file the konflate evidence provider could not locate. This is pre-existing (not introduced by this PR) and the PR description notes the same, but the provider config and file should be reconciled. - CI is currently failing (`actionlint`, `yamllint`) on the PR head — these are lint failures on the same commit, unrelated to the action version change, and gate on their own.

renovate-bot changed title from ci(github-action): update action https://github.com/misospace/pr-reviewer-action (v3.3.0 ➔ v3.4.0) to ci(github-action): update action https://github.com/misospace/pr-reviewer-action (v3.3.0 ➔ v3.4.1) 2026-10-08 01:02:18 +02:00

renovate-bot force-pushed renovate/https-github.com-misospace-pr-reviewer-action-3.x from baaebcd4a9 to 5a25a73384 2026-10-08 01:02:18 +02:00 Compare

GiorgioAresu merged commit 45b1360dd1 into main 2026-10-10 00:18:33 +02:00

GiorgioAresu referenced this pull request from a commit 2026-10-10 00:18:35 +02:00

Merge pull request 'ci(github-action): update action https://github.com/misospace/pr-reviewer-action (v3.3.0 ➔ v3.4.1)' (#2316) from renovate/https-github.com-misospace-pr-reviewer-action-3.x into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/bootstrap

  

area/ci

  

area/kubernetes

  

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

renovate/container

  

renovate/github-action

  

renovate/github-release

  

renovate/grafana-dashboard

  

renovate/helm

  

renovate/terraform

  

type/digest

  

type/major

  

type/minor

  

type/patch

  

wontfix

This will not be worked on

No labels

area/bootstrap

area/ci

area/kubernetes

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

renovate/container

renovate/github-action

renovate/github-release

renovate/grafana-dashboard

renovate/helm

renovate/terraform

type/digest

type/major

type/minor

type/patch

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GiorgioAresu/home-ops!2316

No description provided.