fix: settle reactions and clean verdicts from one authoritative run - #54
Open
cestercian wants to merge 1 commit into
Open
cestercian wants to merge 1 commit into
cestercian wants to merge 1 commit into
Conversation
Three findings, one root: every publication and every reaction was decided from one run's local view. Five review rounds added a condition per site; this is the mechanism those findings wanted. Identity: GET /user has no authenticated user for an installation token, so the fallback hard-coded github-actions[bot] and a custom App's 👀 never matched the delete filter. The 👀 POST already returns the author; that login is carried in $RUNNER_TEMP/cr-actor, and settle also asks the installation for its app slug. github-actions[bot] is last, not first. Authority: a run may publish a clean verdict or settle reactions only when it still describes the current head (unknown = no) and no newer sibling of the same workflow exists. The head comparison used to live only in the thumb step, after the clean review — including the issue-comment fallback, which has no commit association — had already been posted. Both call sites now consult scripts/authority.mjs. The 👍 is still placed and never withdrawn (Continuum-AI-Corp#40). A stale run simply does not get addThumb. Tests: 32 new, covering identity order, superseded heads, newer siblings, User-token decline, the CLI, and that action.yml no longer guesses the Actions bot.
![orcacode-review[bot]](https://avatars.githubusercontent.com/in/4254738?s=60&v=4){kind=small}
There was a problem hiding this comment.
🐳 OrcaCode Review
✅ No findings — nothing to flag in this PR. Great work!
OrcaCode Review — Route Smarter. Ship Safer. Spend Less.
Engine-reported: 415 calls · 35.7M tokens · 99% cached
❤️ Share · Install OrcaCode Review
Free on GitHub — the review runs on your own OrcaRouter key. If it helped, a shout-out goes a long way.
Share: X · Reddit · LinkedIn
Follow: X · Discord · LinkedIn · OrcaRouter
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Orca-Code-Review — push 1
✅ no blocking findings
Summary
Fixes #39.
Reaction settle and clean-verdict publishing used per-site local guesses (hard-coded
github-actions[bot], head check only on the thumb step). That let superseded runs publish “✅ No findings” and mishandle 👀 for custom App installations.This adds
scripts/authority.mjsas one planner for both call sites:/user, then{app_slug}[bot], withgithub-actions[bot]last.addThumb.Test plan
node --test scripts/*.test.mjs— 599 passed (32 new authority tests)