ci: label a PR that closes an issue its own author opened - #7630
Merged
Conversation
Some PRs fix an issue the PR author themselves reported — self-reported
and self-fixed. That is not wrong, but the problem was never
independently validated, so a reviewer wants to check the issue is real,
not only that the fix is correct. This applies a `review/self-reported`
label so that shows at a glance and can be filtered.
A small pull_request_target workflow, metadata only (it never checks out
the PR's code): it reads the PR's closingIssuesReferences ("Fixes/Closes
#N" plus the Development-sidebar links) and, if any of those issues was
opened by the PR author, adds the label; it removes the label if the
link is later re-pointed or dropped. PR-controlled values reach the
script only through env, never interpolated into the run body.
Collaborator
|
Thanks for the PR! Template looks good ✓ Problem: this is a real workflow friction point — reviewers currently have to open each linked issue to check whether the reporter and the PR author are the same person. The label surfaces that at a glance. Not a bug fix, but a genuine process improvement with a clear motivation. Direction: aligned. Small, additive CI tooling that helps maintainers spot self-reported PRs. Doesn't touch auth, sandbox, model selection, telemetry, release, or any public contract. No CHANGELOG reference needed for CI-only changes. Size: not applicable — no core paths touched. 192 additions across 2 files (workflow + test). Approach: the scope feels right. One workflow file, one test file, no unrelated changes. The Moving on to code review. 🔍 中文说明感谢贡献！ 模板完整 ✓ 问题：这是一个真实的工作流痛点——评审者目前需要点开每个关联 issue 才能确认报告者和 PR 作者是否为同一人。标签让这个信息一目了然。不是 bug 修复，而是有明确动机的流程改进。 方向：对齐。小型、增量的 CI 工具，帮助维护者识别自报 PR。不涉及认证、沙箱、模型选择、遥测、发布或任何公共契约。CI 变更无需 CHANGELOG 引用。 规模：不适用——未触及核心路径。2 个文件共 192 行新增（workflow + 测试）。 方案：范围合理。一个 workflow 文件、一个测试文件，无无关改动。 进入代码审查 🔍 — Qwen Code · qwen3.8-max-preview Reviewed at |
Collaborator
Code ReviewIndependent proposal: I'd write a Findings: no critical blockers, no convention violations. The implementation is clean:
Real-Scenario TestingRan the workflow's bash script directly with a stubbed All scenarios behave correctly. Injection attempt is neutralized by the env-only pattern. 中文说明代码审查独立方案： 我会写一个 发现： 无关键阻塞项，无规范违反。实现干净：
真实场景测试用桩 — Qwen Code · qwen3.8-max-preview Reviewed at |
Collaborator
|
Confidence: 5/5 — clean across every stage; would merge without hesitation. This is exactly the kind of PR I like to see: small, focused, solves a real workflow problem, and the author clearly thought about security. The My independent proposal matched the implementation almost line-for-line. Nothing to cut, nothing missing. If I had to maintain this in six months, I'd thank the author — the comments explain the why, the fail-open semantics are documented, and the label name is a single constant. 中文说明置信度：5/5 —— 每个阶段都干净；毫不犹豫可以合并。 这正是我喜欢看到的 PR：小型、聚焦、解决真实工作流问题，作者显然认真考虑了安全性。 我的独立方案与实现几乎逐行一致。无需删减，无遗漏。半年后维护这个代码，我会感谢作者——注释解释了"为什么"，fail-open 语义有文档，标签名是单个常量。 — Qwen Code · qwen3.8-max-preview Reviewed at |
qwen-code-ci-bot
previously approved these changes
Jul 24, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, looks ready to ship. ✅
The repo's .yamllint.yml enforces quoted-strings (quote-type single, required). The initial workflow left name, on/types, permissions, concurrency group, runs-on, and the env values unquoted, failing the Test job's yaml lint. Single-quote them (double where a value contains single quotes, block scalar for the if), matching the qwen-fleet-shepherd style. No behaviour change.
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
Collaborator
Author
|
@qwen-code /takeover |
qwen-code-dev-bot
added
the
autofix/takeover
Collaborator
|
🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. Remove the 中文说明🤝 已接管：autofix 循环现在管理此 PR —— 将持续处理新的评审反馈与 base 冲突，直到移除标签或达到轮次上限。移除 |
doudouOUC
previously requested changes
Jul 24, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline. 1 Suggestion-level finding(s) could not be anchored to a changed line and were dropped; nothing further to act on here.
— qwen3.7-max via Qwen Code /review
Track whether the closingIssuesReferences query succeeded (API_OK) and gate label removal on it, so an API blip can no longer masquerade as "no self-reported link" and strip a correct label. Also re-run on synchronize so a commit-message "Fixes #N" link updates the label, add a fail-open regression test, and use the root yaml dependency in the test.
Collaborator
|
🤖 Addressed the latest review feedback (round 1/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 1/100 轮）。改动内容与我反驳保留之处如下： Review feedback addressedAll four findings were implemented in one commit ( 1. Fail-open contradiction strips a correct label on API failure — implemented (Critical, rc:3642606809)The Fix: distinguish API failure from empty results. The query now runs inside 2. Fail-open paths untested — implemented (Suggestion, rc:3642606812)The 3.
|
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline.
— qwen3.7-max via Qwen Code /review
Collaborator
|
🤖 Addressed the latest review feedback (round 2/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 2/100 轮）。改动内容与我反驳保留之处如下： Review feedback addressed[rc:3642931301] Missing
|
qwen-code-ci-bot
approved these changes
Jul 24, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
No issues found. LGTM! ✅
— qwen3.7-max via Qwen Code /review
yiliang114
approved these changes
Jul 24, 2026
yiliang114
left a comment
yiliang114
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. Clean workflow design — pull_request_target is safe here because it never checks out PR code, only reads metadata via gh CLI. Env-only interpolation pattern is correct. Fail-open on API failure (never strips a correct label) is the right call. Test coverage is thorough including the injection safety check.
— qwen3.8-max-preview via Qwen Code /review
github-actions
Bot
added
the
skip-changelog-auto
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Applies a
review/self-reportedlabel to any PR that closes an issue its own author opened — self-reported and self-fixed — so a reviewer sees it at a glance and can filter for it.Why
Most fixes close an issue someone else reported, so the problem was independently validated before the fix. When the reporter and the PR author are the same person, that validation is missing: the review should confirm the issue is real and worth fixing, not only that the diff is correct. Today that requires opening the linked issue and checking who filed it; the label surfaces it in the PR list.
How
A small
pull_request_targetworkflow (opened/edited/reopened). It is metadata only — it never checks out the PR's code, which is what makespull_request_targetsafe here:closingIssuesReferencesvia GraphQL — this covers bothFixes/Closes #Nkeywords and issues linked through the Development sidebar — and the login that opened each.review/self-reported(creating the label on first use). If a later edit re-points or drops the link so none is self-reported → removes it, so the label never lies.Hardening (
pull_request_target): PR-controlled values (number, author, repo) reach the script only throughenv:, never interpolated into therun:body; permissions are the minimum (issues: writeto manage the label,pull-requests: writeto apply it); it is gated toQwenLM/qwen-code. Any API failure is fail-open — it never strips a correct label on a blip.Reviewer Test Plan
How to verify
npx vitest run scripts/tests/pr-self-report-label.test.js— extracts the realrun:block and replays it under bash with a stubbedgh, over: self-reported issue → add; one match among several linked → add; link re-pointed to another author (or dropped) → remove; state already correct → no change; PR closing no issue → no label. Plus a guard that the block contains no${{ }}interpolation (the injection-safe pattern).==→!=) turns the three behavioural tests red.js-yamlparses; therun:block passesbash -n; actionlint 1.7.12 clean; prettier clean.Fixes #<an-issue-you-filed>→ it getsreview/self-reported; edit the body to drop the reference → the label clears.Tested on
Risk & Scope
review/self-reportedis a singleenv:constant — trivial to rename if you prefer another (e.g.status/self-reported).Fixes/Closes #Nkeywords fire onedited; a purely sidebar-linked issue added later (no PR event) is picked up on the nextedited/reopened, not instantly. Good enough for the common case; a scheduled sweep could close that gap later if it matters.中文说明
本 PR 做了什么
给任何"关闭了由其作者本人提出的 issue"的 PR(自己报、自己修)打上
review/self-reported标签,让评审者一眼看到、并能筛选。为什么
大多数修复关闭的是别人报的 issue,问题在修复前已被独立验证。当报告者与 PR 作者是同一人时,这层验证缺失:评审应确认这个问题是真的、值得修,而不仅是 diff 对不对。现在这需要点开关联 issue 看是谁提的;标签把它直接暴露在 PR 列表里。
怎么做
一个小的
pull_request_targetworkflow(opened/edited/reopened),纯 metadata —— 从不 checkout PR 代码,这正是pull_request_target在此安全的原因:closingIssuesReferences(既含Fixes/Closes #N关键字,也含 Development 侧栏链接的 issue)及各自的开启者 login。review/self-reported(首次使用时创建该标签)。若之后编辑把链接改指他人/移除、致无自报 issue → 摘除,标签绝不说谎。加固(
pull_request_target): PR 可控值(编号、作者、仓库)只经env:进入脚本,绝不插入run:正文;权限最小化;仅限QwenLM/qwen-code。任一 API 失败均 fail-open,绝不因抖动误摘正确标签。评审验证
npx vitest run scripts/tests/pr-self-report-label.test.js—— 抽出真实run:块、桩gh回放(自报→add;多个关联其一匹配→add;改指他人/移除→remove;状态已对→no change;不关闭任何 issue→不打标),外加"块内无${{ }}插值"的守卫。==→!=)翻转,三个行为测试转红。run:块过bash -n;actionlint 1.7.12 clean;prettier clean。Fixes #<你提的issue>的 PR → 得到review/self-reported;编辑移除该引用 → 标签清除。风险与范围
review/self-reported是单个env:常量,想改名(如status/self-reported)很容易。Fixes/Closes #N关键字在edited时触发;纯侧栏后加的链接(无 PR 事件)会在下次edited/reopened时被捕获,而非即时。常见情形足够;若需要可后续加定时补扫。