feat(ci): route non-functional PRs to a triage-only review path - #9193
Closed
yiliang114 wants to merge 22 commits into
Closed
feat(ci): route non-functional PRs to a triage-only review path#9193yiliang114 wants to merge 22 commits into
yiliang114 wants to merge 22 commits into
Conversation
Small behavior-neutral maintenance PRs (internal renames, formatting, comment/JSDoc fixes) currently go through the full multi-stage triage, review, and verification pipeline. Add a conservative Stage 1f route in the triage skill that classifies such PRs (100%-certainty bar, risky surfaces excluded, unattended runs only) and marks them with the existing status/on-hold label, and make the automatic PR-review lane check the live label before invoking the model. Explicit /review asks and review_requested always bypass the skip.
github-actions
Bot
added
the
review/self-reported
Collaborator
Collaborator
|
Thanks for the PR! Template looks good ✓ Problem: real and quantified, not theoretical — #7411 counted 26 fork PRs of ≤40 lines among the 300 most recent, each paying the full three-stage triage + automated review cost for changes that carry no observable risk. The issue scopes the fix precisely: route only behavior-neutral maintenance, keep everything behavior-changing on the full path. Direction: aligned. The change stays entirely inside the automation layer (workflow + triage skill docs + contract tests), no product surface, and it honours the issue's non-goals: nothing blocks merging, and a maintainer can always pull a full review. Size: no core paths touched. At the current head: 278 production lines (124 workflow gate + 154 triage skill contract) vs 647 test lines — still tests-heavy, which is the right shape for a routing rule whose dangerous failure mode is a silently skipped review. Below every Stage 0 threshold. Approach: the scope remains right, and since the last pass the one design question I had raised — the exemption label not recording the commit it was applied at — has been resolved head-on: the skip now requires a bot marker comment pinned to the LIVE head/base SHA pair, a stale pin strips the label and invalidates the marker, and base retargets are caught through a new Risk: no elevated risk signals — no Stage 1e high-risk paths matched, no core modules, no runtime code. Moving on to code review. 🔍 中文说明感谢贡献！ 模板完整 ✓ 问题： 真实且有量化数据，不是理论性问题——#7411 统计了最近 300 个 PR 中有 26 个不超过 40 行的 fork PR，它们没有任何可观测风险，却都要走完整的三阶段 triage + 自动评审流程。issue 也精确划定了范围：只路由行为中性的维护性改动，行为变化类 PR 仍走完整流程。 方向： 对齐。改动完全在自动化层（workflow + triage skill 文档 + 契约测试），不涉及产品面，并遵守 issue 的非目标：不阻塞合并，maintainer 随时可以发起完整评审。 规模： 未触及核心路径。当前 head：生产代码 278 行（124 行 workflow 门 + 154 行 triage skill 契约），测试 647 行——仍是测试占大头，对于一个危险失败模式是"悄悄跳过评审"的路由规则来说，这是正确的形态。低于所有 Stage 0 阈值。 方案： 范围依然合理，且上一轮我提出的唯一设计问题——豁免标签不记录打标时的提交——已被正面解决：跳过现在要求有一条钉在实时 head/base SHA 对上的 bot 标记评论；过期 pin 会被摘除标签并作废标记；base 重定向通过新增的、以 风险： 无升级风险信号——未命中 Stage 1e 高风险路径，不涉及核心模块，不涉及产品运行时代码。 进入代码审查 🔍 — Qwen Code · qwen3.8-max Reviewed at |
Collaborator
Code reviewMy independent baseline for #7411 was: classify where the diff is already being read (triage), signal with the existing Verified against the integration points as they exist on
The one reservation from my last pass — the label not tracking the commit it was applied at — is fully resolved by the head/base pin + stale strip + marker invalidation, including the subtle follow-ons (the stale-bot exemption is stripped with the label; invalidating rather than deleting the marker keeps a later manual park from re-hitting the stale branch). Nothing further owed on it. Non-blocking, already deferred under the round-15 convergence posture — naming them so they stay visible, not as asks: the upsert-failure warning branch remains unreachable in the harness, the Testing evidence — the PR's own CI, fully settled at Final CI results for
One row per check name (latest run); skipped checks omitted; failures sort first. / 每个检查名一行（取最新一次运行），省略 skipped，失败项排在最前。 What no lane can settle — stated plainly rather than papered over: the live end-to-end wiring (triage pins a real trivial PR → the automatic lane skips on the next event) is only observable in production after merge, and the author proposes back-testing against the 26 historical small fork PRs once real triage runs exist. The behavioural claim this PR actually makes — the gate skips exactly when label + live pin agree, and fails open on every other path — is substantiated by the suite above executing the real This is a CI-automation change with no user-visible surface, so no real-scenario testing applies on this unattended run: N/A. 中文说明代码审查：我对 #7411 的独立方案是——在本来就读 diff 的 triage 环节分类、用已有的 对照
上一轮我唯一的保留意见——标签不记录打标时的提交——已由 head/base pin + 过期摘除 + 标记作废完整解决，包括细微的后续（stale 豁免随标签一并摘除；作废而非删除标记，避免日后人工 park 再撞过期分支）。此项不再有欠账。 非阻塞、已在第 15 轮收敛姿态下延期——点名只是为了保持可见，不作为本轮要求：upsert 失败警告分支在 harness 中仍不可达； 测试证据： 任何通道都无法落定的部分——直说而不粉饰：端到端实时链路（triage 给真实小 PR 打 pin → 自动通道在下一事件跳过）只有合并后才能在生产观测，作者计划在有真实 triage 运行后用 26 个历史小 fork PR 回测。本 PR 真正的行为主张——门恰好在"标签 + 实时 pin 一致"时跳过、其余路径一律失败放行——已由上述套件执行真实 本 PR 为 CI 自动化改动、无用户可见界面，无人值守运行的真实场景测试为：N/A。 — Qwen Code · qwen3.8-max Reviewed at |
Collaborator
|
Confidence: 4/5 — clean across every stage and the prior reservation is fully resolved; the named remainder is a handful of deferred probe-level nits, none blocking. Stepping back: this started as a capacity optimization and, through fifteen review rounds, became something better — a small pair of gates whose failure modes are all named and pinned. The dangerous direction (a risky change silently skipping review) is closed by construction: a 100%-certainty classifier contract that fails closed, exclusions for every risky surface, and a skip that needs both the live label and a bot-authored pin matching the live head/base pair. The cheap direction (one extra full review) is where every read failure, race, and ambiguity resolves. Explicit asks never touch the gate at all. My independent proposal for #7411 was exactly this shape, with the one insistence that the exemption be pinned to the triaged commit — the current head does that and extends it to the base SHA, catching retargets through a new The 4 rather than 5: three probe-level gaps stay on the record from the review ledger (the upsert-failure warning branch is unreachable in the harness, the In six months this reads as two conservative gates with sharp tests, not machinery. Approving, pinned to the reviewed commit. 中文说明置信度：4/5 —— 各阶段均干净，上一轮的保留意见已完整解决；剩下的只是若干延期下来的探针级小项，均不阻塞。 退一步看：这个 PR 从一个容量优化起步，经过十五轮评审，变成了更好的东西——一对小门，其所有失败模式都被点名并锁定。危险方向（有风险的改动悄悄跳过评审）在构造上被封死：100% 确定性、失败关闭的分类契约，排除所有风险面，且跳过必须同时满足实时标签 + bot 作者身份、与实时 head/base 对匹配的 pin。廉价方向（多跑一次完整评审）则是所有读取失败、竞态与歧义的归宿。显式请求根本不碰这道门。 我对 #7411 的独立方案正是这个形态，且唯一坚持的是豁免必须钉在被 triage 的提交上——当前 head 做到了，并扩展到 base SHA，通过新增的 给 4 而不是 5 的原因：评审台账上仍有三项探针级缺口在案（upsert 失败警告分支在 harness 中不可达； 六个月后回看，这是两道带锋利测试的保守小门，而不是一台机器。批准，钉在所评审的提交上。 — Qwen Code · qwen3.8-max Reviewed at |
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
commented
Aug 15, 2026
Collaborator
Author
|
Closeout from resolve-pr-comments automation: Changed: no product code. The failed review job stopped during Checkout base branch, so I requested a failed-job rerun. Verified: rerun request was accepted by GitHub. Pending: rerun CI and automatic review on the current head. |
qwen-code-ci-bot
requested changes
Aug 15, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not reviewed: reverse audit — did not converge within the reverse-audit round cap of 5.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
仅完成部分审查，审查缺口已披露。
未审查：反向审计——在 5 轮的反审轮数上限内未收敛。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
The status/on-hold label is applied once at open time by Stage 1f and is never invalidated, so a PR earning it with a benign v1 would silently skip the automatic review lane for every later push of arbitrary content — a fork contributor could smuggle behaviour changes past review with zero classifier error. - Stage 1f now also posts a marker comment pinning the skip to the triaged head SHA (`<!-- qwen-triage on-hold sha=<HEAD_SHA> -->`) - the skip fires only while that pin matches the LIVE head: a push after triage moves the head (triage does not re-run on synchronize), so the new diff goes to the review lane; a manually applied parked label has no marker and never skips; an unreadable head fails open like the label read - pin the new behaviour with workflow step tests (matching pin skips, stale pin reviews, marker-less label reviews, unreadable head fails open) and a Stage 1f doc pin for the marker instruction
qwen-code-ci-bot
requested changes
Aug 15, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not reviewed: reverse audit — stopped at the round cap of 5 without converging (rounds 3 and 4 reported findings; round 5 was dry).
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
仅完成部分审查，审查缺口已披露。
未审查：reverse audit — stopped at the round cap of 5 without converging (rounds 3 and 4 reported findings; round 5 was dry)。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
added 2 commits
August 15, 2026 21:35
# Conflicts: # scripts/tests/qwen-pr-review-workflow.test.js
commented
Aug 15, 2026
Collaborator
Author
|
Closeout: merged latest main to clear the conflict, then fixed triage-only marker validation to filter bot-authored marker comments, avoid pipefail+grep false negatives, and give the test shell a HOME. Verified qwen-pr-review workflow test, Prettier, and diff check. Pending: status/on-hold label policy remains a maintainer decision. |
qwen-code-ci-bot
requested changes
Aug 15, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Not explored to full depth (tool budget reached): "agent 6c": none — no check was cut short..
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
未探索到全部深度（达到工具调用预算）："agent 6c"：none — no check was cut short.。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
Round-3 review of the triage-only route (#7411): - The marker match no longer pipes `printf '%s\n' "$MARKERS"` into `grep -Fq`: under `set -o pipefail`, grep -q exits at the first match and closes the pipe, printf dies on EPIPE with 141, and pipefail surfaces the producer failure as FALSE — with >64 KB of bot comment bodies (busy PRs) the skip silently never fired while the summary claimed the opposite. The marker check is now a pipe-free `[[ "$MARKERS" == *"..."* ]]` pattern match; the label check keeps exact-line semantics via a herestring (`grep -Fxq <<< "$LABELS"`, no producer pipe). Regression test: the stub emits a 300 KB bot comment body alongside the marker and the skip must still fire — mutation-verified red against the old shape. - Pin the author-filter jq expression verbatim in the positive and forged-marker tests (the stub does its own filtering, so the '.user.login' substring alone let select(.user.login != "") and dropped-login mutants survive). - Stage 1f posts its pin marker through the author-scoped upsert-bot-comment.sh (lookup marker is the SHA-less prefix) instead of a bare `gh pr comment`, so a re-run PATCHes the existing marker instead of minting a byte-identical duplicate. - The triage-only Stage 1 wording qualifies the "no review verdict will post" promise for the ready_for_review race (the review lane starts immediately on that action while triage takes minutes).
commented
Aug 15, 2026
Collaborator
Author
|
Closeout from resolve-pr-comments: Changed: aligned the triage workflow test with the current upsert-bot-comment marker flow, fixing the exact Ubuntu failure assertion. Verified: targeted qwen-triage workflow vitest for the failed assertion, Prettier, and diff check passed. Note: the full local script file still has unrelated long-running verify tests that timed out under the 5s local timeout. Pending: post-push CI/review. |
doudouOUC
requested changes
Aug 15, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not explored to full depth (tool budget reached): "You are review agent 6a — Agent 6a: Undirected audit —…": none — all checks completed within budget.; "You are review agent 6b — Agent 6b: Undirected audit — 3…": 无 — 我在预算内完成了所有检查。; "You are review agent 1a — Agent 1a: Line-by-line…": 无.
Not reviewed: reverse audit — no auditor was launched with a prompt this skill builds — the pass that hunts what the rest of the review missed ran, if at all, without the method its brief carries.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
仅完成部分审查，审查缺口已披露。
未探索到全部深度（达到工具调用预算）："You are review agent 6a — Agent 6a: Undirected audit —…"：none — all checks completed within budget.；"You are review agent 6b — Agent 6b: Undirected audit — 3…"：无 — 我在预算内完成了所有检查。；"You are review agent 1a — Agent 1a: Line-by-line…"：无。
未审查：反向审计——没有审计 agent 是用本 skill 构建的 prompt 启动的——负责搜寻评审其余部分遗漏问题的这道工序，即便运行过，也缺失了 brief 承载的方法。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— deepseek-v4-flash via Qwen Code /review (v0.21.11)
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
已审查——无阻断问题。 建议见行内评论。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
- skill doc: post the on-hold marker BEFORE applying the label and fail closed if the upsert fails (a label without the pin would skip review for every future push) - skill doc: mirror the ready_for_review race hedge into the ZH half of the Stage 1f comment (both halves post in one comment) - retag the misplaced (#9219) provenance citations to (#9193) at the remaining sites (workflow, step summary, skill doc, tests); the marker-pin assertion itself was already aligned in 1430f84 - tests: supply genuine bot markers in the lookalike-label and label-absent skip-gate tests so the exact-label and label gates are each the only failing gate (kills the relaxed-match / dropped-gate mutants); pin the step-level GH_TOKEN env on 'Resolve PR context'
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
已审查——无阻断问题。 建议见行内评论。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
…nale (#9193) - R5-4: the skip gate's fail-open paths now write distinct summary lines per failed read (label read failed / head SHA unreadable / marker comments unreadable) instead of silence or a false stale-pin claim; a failed marker read can no longer report 'not pinned to the live head' for a mismatch never observed. Tests pin all three diagnostics, with a new harness knob that fails only the comments read. - R5-2: the fail-closed rationale in the Stage 1f doc described the pre-pin label-only behaviour ('a label without the pin would skip every future push'), contradicting the shipped gate (label AND pin required; label-without-pin runs the review lane). Rewritten to the actual harm of a partial state: the outcome promise broken while the unpinned label leaves the automatic lane running. - R4-4: cross-artifact identity test tying the skill-doc marker writer (upsert prefix + template) to the skip-gate reader literal, so a one-sided rename of the shared prefix fails the suite.
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed. Suggestions are inline.
Not reviewed: reverse audit — stopped at the round cap of 5 without converging (rounds 1-4 reported findings; round 5 was dry).
Not explored to full depth (tool budget reached): "agent 3c": none — no check was cut short..
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
仅完成部分审查，审查缺口已披露。 建议见行内评论。
未审查：reverse audit — stopped at the round cap of 5 without converging (rounds 1-4 reported findings; round 5 was dry)。
未探索到全部深度（达到工具调用预算）："agent 3c"：none — no check was cut short.。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
R6-7: the recorded gh-call assertions matched only the bare endpoint substrings, so deleting --paginate from the labels/comments reads kept the suite green — a pin beyond page 1 (a re-triage after 100+ comments) would be invisible to the gate, which would then misreport 'not pinned' and burn a full review on every event: silent, fail-open, undiagnosable. Pin both list reads including the flag, the same shape the sibling triage/autofix suites use. Mutation-verified: dropping --paginate from the comments read now fails exactly the skip test.
qwen-code-ci-bot
requested changes
Aug 16, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not reviewed: reverse audit — did not converge within the reverse-audit round cap of 5.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
仅完成部分审查，审查缺口已披露。
未审查：反向审计——在 5 轮的反审轮数上限内未收敛。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
#9193) Round-9 critical: clause 2 ('whitespace/formatting change with no token-level semantic change') is worded for tokenized languages — in YAML/Makefile/shell/Dockerfile a pure re-indent hunk changes the parse tree while every line's token sequence stays identical, yet passed every written precondition (only .github/workflows/** was excluded) and would skip the review lane: the exact false skip the section names as the dangerous failure mode. - clause 2 now forbids the certification in files where whitespace IS syntax (YAML indentation, Makefile recipe tabs, shell/Dockerfile line continuations) - the precondition exclusions extend to non-workflow YAML anywhere, Makefile, Dockerfile, and .github/scripts/** - the Stage 1f test block pins both the new exclusions and the carve-out wording
commented
Aug 16, 2026
Collaborator
Author
|
Closeout for this patrol: no code pushed by this run because the branch advanced concurrently and is now mergeable. Resolved the remaining late-round test-hardening trackers as out-of-scope for this PR. No active review threads remain on the latest head. |
qwen-code-ci-bot
requested changes
Aug 16, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
commented
Aug 16, 2026
Collaborator
Author
|
Closeout from resolve-pr-comments automation: Changed: pinned triage-only skip markers to both head and base SHA and updated the workflow docs/tests. Verified: focused triage workflow and PR review workflow tests passed. Intentionally not changed: wording-only late-round suggestions. Pending: CI/review are running. |
qwen-code-ci-bot
requested changes
Aug 16, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
added 2 commits
August 17, 2026 00:10
…ches (#9193) When the review lane runs because status/on-hold is not pinned to the live head/base, remove the label too. It sits in the stale.yml exempt-pr-labels and Stage 1f applies it only once at open time, so without this a PR would skip review and never age out via the stale bot.
…ge 1f (#9193) - require the marker to START a bot comment body (startswith), so a forged pin embedded in a larger bot comment cannot skip the lane - write the marker to a per-run mktemp file instead of a fixed /tmp path - document the head/base pair requirement consistently - pin the base-SHA fetch/empty guard, the mktemp+rm, and the marker-before-label ordering in the triage test
qwen-code-ci-bot
requested changes
Aug 16, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
commented
Aug 16, 2026
Collaborator
Author
|
Merged latest main, fixed triage-only retarget handling, preserved manual on-hold labels, tightened the doc fail-closed snippet, and resolved the current review threads. Intentionally not changed: delete-failure mutation-only harness expansion. Verified: focused |
R2-6 follow-up: the gate's "Failed to remove stale status/on-hold" branch was unreachable in the harness — the stub's */labels* case answered the `-X DELETE` call first and always exited 0, so no test could ever fail the delete. Consequence: unwrapping the `if` around the DELETE survived the whole suite, yet under the step's `set -euo pipefail` a transient API error or rate limit would then abort the entire Resolve PR context step before `should_run=true` is written, hard-failing the review workflow. Add a deleteFails stub mode (a quoted `*"-X DELETE"*` case ordered before the labels answer, failing when CONTEXT_DELETE_FAIL=1) and a test asserting the failure summary plus that the gate still writes should_run=true. The existing negative pins already cover manual-park/matching-pin no-DELETE behaviour.
qwen-code-ci-bot
requested changes
Aug 16, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed.
Not reviewed: reverse audit — ran all 5 rounds (the cap) without two consecutive dry rounds (rounds 3-5 all reported findings; every reported finding was verified).
Not explored to full depth (tool budget reached): "agent 3a": none — no check was cut short..
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
仅完成部分审查，审查缺口已披露。
未审查：reverse audit — ran all 5 rounds (the cap) without two consecutive dry rounds (rounds 3-5 all reported findings; every reported finding was verified)。
未探索到全部深度（达到工具调用预算）："agent 3a"：none — no check was cut short.。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
Round-13 review, two Criticals plus three hardenings: - CRITICAL (#9091-class race): an edited run without a base change is a guaranteed no-op, yet joined the shared qwen-pr-review-pr-{N} concurrency group — a routine title/body edit could supersede a PENDING synchronize run (pending runs are replaced by the newest queued run, cancel-in-progress notwithstanding) and the pushed head would silently never review. Carve edited-without-changes.base out of the PR group into the per-run group, mirroring review_requested; base-retarget edits keep the shared group (superseding a stale pending run there reviews live state). Verbatim group pin updated. - CRITICAL (TOCTOU): Stage 1f read BASE_SHA fresh at outcome-post time while HEAD_SHA follows the capture-once/re-read-before-post discipline — a retarget landing mid-run minted a pin matching the NEW base pair, skipping a diff the triage never certified. Capture BASE_SHA once at review start alongside HEAD_SHA and re-read/compare before the outcome post, bailing on a moved base (exact mirror of the head guard). Triage-suite pins updated to the compare shape. - Reclaim the wasted preamble: the same edited clause now gates precheck-pr, authorize and review-pr at the job level (the in-step early exit stays as the tie-breaker). - Invalidate the stale marker comment when the stale-pin strip succeeds: markers are upserted but never deleted, so a later manually re-applied park label hit the stale-strip again instead of the manual-park carve-out. The strip now rewrites the marker via upsert-bot-comment.sh --update-only with a non-marker body. - Pin the '- edited' trigger subscription itself (the behavioural harness bypasses the on: block; deleting the line kept the suite green). Suites: triage 140/140, pr-review 174 green + 2 pre-existing root-user env failures unrelated to this change. eslint + prettier clean.
qwen-code-ci-bot
requested changes
Aug 16, 2026
left a comment
Collaborator
There was a problem hiding this comment.
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
R13-1: the invalidation upsert ran under the step's GITHUB_TOKEN (github-actions[bot]), but upsert-bot-comment.sh scopes its lookup to the AUTHENTICATED login and the marker is authored by the triage agent under QWEN_CODE_BOT_TOKEN/CI_BOT_PAT (qwen-code-ci-bot) — so --update-only exited 0 with "no existing comment; nothing to update" and never PATCHed. The marker kept its prefix forever, the manual-park carve-out stayed unreachable on every Stage-1f-routed PR, and a later manually re-applied park label got stripped again on the next event. Bind the marker author's token inline on the invalidation call (mirroring the sibling upsert sites' CI_BOT_PAT binding) and extend the harness: the stub answers `gh api user` per token (only the bot token resolves to the marker author), lists a marker authored by that bot, and the stale-strip test now pins that the PATCH lands with the invalidated body. Mutation-verified: dropping the inline override removes the PATCH and fails the new pins. Suites green (2 pre-existing root-env failures unrelated); eslint + prettier clean.
left a comment
Collaborator
There was a problem hiding this comment.
Partially reviewed — gaps disclosed. Suggestions are inline.
Not reviewed: reverse audit — ran all 5 rounds (the cap) without two consecutive dry rounds (rounds 3-5 all reported findings; every reported finding was verified).
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
中文说明
仅完成部分审查，审查缺口已披露。 建议见行内评论。
未审查：reverse audit — ran all 5 rounds (the cap) without two consecutive dry rounds (rounds 3-5 all reported findings; every reported finding was verified)。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
— qwen3.8-max via Qwen Code /review (v0.21.12)
commented
Aug 17, 2026
Collaborator
Author
|
Closeout from resolve-pr-comments: no code changes. Resolved the latest late-round routing/comment/test-hardening suggestions as out of scope for this already-expanded triage-only routing PR; the manual status/on-hold re-park policy change was intentionally not introduced.\n\n |
commented
Aug 18, 2026
Collaborator
Author
|
@qwen-code /review --timeout=360 |
commented
Aug 18, 2026
Contributor
|
Qwen Code review request accepted. Review is queued in workflow run. |
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed.
3 Suggestion-level finding(s) this review confirmed are already reported on this PR and are not repeated:
- Stage 1f status/on-hold reuse inherits stale.yml exemption — already reported (comment 3789921538, R4-1 canonical tracker, maintainer policy decision pending)
- vacuous 'fix' exclusion probe in qwen-triage-workflow.test.js — already reported (comment 3791791119, R9-3; author declined as late-round hardening)
- two-author marker reader vs one-author invalidator silent no-op — already reported (comment 3793402936, R14-2)
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
Deferred under the convergence posture (round 15, not a blocker) — recorded, not requested in this round:
.github/workflows/qwen-code-pr-review.yml:393 — [review] R14-1 routing comment block omits the edited+base-change routing shape.github/workflows/qwen-code-pr-review.yml:777 — [review] R14-2 --update-only flag on the invalidation call pinned by no test.github/workflows/qwen-code-pr-review.yml:778 — [review] R14-3 upsert-failure warning branch unreachable in the harness.qwen/skills/triage/references/pr-workflow.md:66 — [review] R14-4 signature-block BASE_SHA discipline pinned by no test.github/workflows/qwen-code-pr-review.yml:753 — [review] R14-5 marker invalidation reachable only inside the stale-strip branch
中文说明
已审查。
本轮确认的 3 条建议级发现已在 PR 上报告过，不再重复发布（列表见上方英文部分）。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
收敛姿态下延后（第 15 轮，非阻断）——已记录，本轮不要求修改：共 5 条（原文未翻译，列表见上方英文部分）。
— qwen3.8-max via Qwen Code /review (v0.21.13)
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed — no blockers.
1 Suggestion-level finding(s) this review confirmed are already reported on this PR and are not repeated:
- Stage 1f in-flight-race exception wording is keyed to ready_for_review only (opened/delay-timer desync) — already reported and author-deferred (comment 3791791126, R9-9 thread)
Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.
Deferred under the convergence posture (round 15, not a blocker) — recorded, not requested in this round:
.github/workflows/qwen-code-pr-review.yml:776 — [probe] mktemp failure in the marker-invalidation block aborts the whole step.github/workflows/qwen-code-pr-review.yml:713 — [review] skipped runs still pay the job's repair preamble and full-history checkoutscripts/tests/qwen-pr-review-workflow.test.js:2598 — [probe] the invalidation call's failure branch is unpinned — the if-guard mutation survives.github/workflows/qwen-code-pr-review.yml:777 — [probe] the invalidated body's 'no reader-prefix' property is pinned by no test
中文说明
已审查——无阻断问题。
本轮确认的 1 条建议级发现已在 PR 上报告过，不再重复发布（列表见上方英文部分）。
未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。
收敛姿态下延后（第 15 轮，非阻断）——已记录，本轮不要求修改：共 4 条（原文未翻译，列表见上方英文部分）。
— qwen3.8-max via Qwen Code /review (v0.21.13)
commented
Aug 19, 2026
Collaborator
Author
|
@qwen-code /triage |
Collaborator
|
Sandboxed verification: The verification job did not complete (checkout, runner, or setup error) and produced no report. See the workflow run for details. 中文 — 判定：
|
yiliang114
enabled auto-merge
August 19, 2026 08:30
commented
Aug 19, 2026
Collaborator
Author
|
Closing this for now after stepping back and looking at the cost/benefit — the mechanism works as designed, but I don't think the return justifies the upkeep. The hit rate is likely too low to matter. #7411 counted 26 fork PRs of ≤40 lines among the 300 most recent (~9%). After the precondition filters — no The maintenance cost is permanent. The marker grammar now lives in three artifacts (skill doc, workflow YAML, contract tests) that must stay in sync, on top of the A cheaper path already exists. The workflow already downgrades docs-only PRs to medium effort and tightens budgets for micro diffs (<25 lines). If the capacity pain persists, extending that effort-downgrade lane is a few lines of change with no new routing state, no label semantics, and no SHA pinning to keep consistent. So: closing, not on correctness grounds — CI is green and the review threads all converged — but because the payoff looks too thin for the ongoing complexity. If small-PR review cost keeps hurting, a minimal version along the effort-downgrade direction seems like the better next step. 中文说明先关掉这个 PR。机制本身按设计工作(CI 全绿、review 线程全部收敛),但投入产出比不划算:
如果以后小 PR 的 review 成本问题依然突出,建议用 effort 降级方向的最小版本重新开始。 |
auto-merge was automatically disabled
August 19, 2026 14:17
Pull request was closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
This PR teaches the automation to match review depth to risk for the smallest, most mechanical contributions, as requested in #7411. The triage skill gains a new Stage 1f route: when an unattended triage run sees a PR it can certify with 100% confidence as behavior-neutral maintenance (internal renames, formatting, comment/JSDoc-only edits), it posts the usual Stage 1 summary, applies the existing
status/on-holdlabel, and stops — no Stage 2 code review, no Stage 3 verdict, no approval. The automatic PR-review lane inqwen-code-pr-review.ymlthen checks the live labels before invoking the model and skips the automatic run whilestatus/on-holdis present. Nothing blocks merging: a maintainer can always pull a full review with@qwen-code /review(explicit triggers never hit the label check), and removing the label re-enables the automatic lane on the next push.Why it's needed
Today every PR — including one-line comment fixes — goes through three-stage triage, multiple automated review passes, tests, and several long bot comments. #7411 counted 26 fork PRs of 40 lines or fewer among the 300 most recent PRs whose orchestration and model cost exceeded the value and risk of the change, while occupying review capacity needed by higher-risk PRs. The issue explicitly scopes this as routing behavior-neutral maintenance to a lighter outcome, keeping behavior-changing small PRs (bug fixes, user-facing docs/CLI help, links, system prompts, security/data-loss/compatibility) on the full path.
Reviewer Test Plan
How to verify
The route is deliberately conservative, and the tests pin that conservatism rather than paraphrasing it:
npm run test:scripts -- scripts/tests/qwen-pr-review-workflow.test.js scripts/tests/qwen-triage-workflow.test.js— 255/255 pass. The newqwen pr review triage-only skip (#7411)block executes the realResolve PR contextbash with a stubghand asserts: automatic review is skipped only when the LIVE label query returnsstatus/on-hold(exact match —status/on-hold-extendeddoes not skip); a failed label read fails OPEN and still reviews; explicit/reviewcomments andreview_requestednever skip and never even query labels. Verified red-before/green-after: with the workflow change stashed, the skip test fails.triage skill non-functional routing (#7411)block pins the Stage 1f contract words: fail-closed fallback ("when in doubt, take the full path"), unattended-only scope, the exclusion list (fix titles, core paths, workflows, manifests/lockfiles, schema/generated files, model-visible text, user-facing docs/CLI help, broken links, high-risk paths), the 100-production-line cap, the existing-label-only rule, and the terminal exit before Stage 2.actionlinton the modified workflow: clean. Prettier on the changed files: clean.Evidence (Before & After)
N/A — CI-automation change, no user-visible/TUI surface.
Tested on
Environment (optional)
Vitest workflow/skill contract tests plus actionlint; no runtime or sandbox involved.
Risk & Scope
/review,review_requested, and dispatch always run, and no merge blocker is added (per the issue's non-goals)./reviewcost discussion in /review skill consume large amount of tokens #6264; the approval-policy proposal in Proposal: remove automated PR approvals — triage gates only, approval authority returns to maintainers #9182.stale.yml, which already exemptsstatus/on-holdPRs from staleness — a triage-only PR will not be auto-closed by the stale bot while the label stands. Also note open PR feat(review): wire --resume through /review, review run and the CI retry #9153 touches the same workflow file (different area:--resumewiring); a rebase may be needed depending on merge order.Linked Issues
Fixes #7411
中文说明
这个 PR 做了什么
本 PR 让自动化流水线按风险匹配评审深度，处理最小、最机械的贡献（#7411）。triage skill 新增 Stage 1f 路由：当无人值守的 triage 运行遇到一个可以 100% 确定是行为中性维护性改动的 PR（内部重命名、格式化、仅注释/JSDoc 修改）时，照常发布 Stage 1 摘要，打上已有的
status/on-hold标签，然后停止——不进 Stage 2 代码评审、不出 Stage 3 结论、不做 approve。qwen-code-pr-review.yml的自动评审通道在调用模型前检查实时标签，只要status/on-hold存在就跳过自动评审。合并不受任何阻塞：maintainer 随时可以用@qwen-code /review拉起完整评审（显式触发永远不走标签检查），移除标签后下次推送即恢复自动评审。为什么需要
目前每个 PR——哪怕只改一行注释——都要走三阶段 triage、多轮自动评审、测试和若干条冗长的机器人评论。#7411 统计最近 300 个 PR 里有 26 个不超过 40 行的 fork PR，其编排和模型成本超过了改动本身的价值和风险，还占用了更高风险 PR 需要的评审精力。issue 明确把范围限定为：把行为中性的维护性改动导向轻量结果，而会改变行为的小 PR（bug 修复、面向用户的文档/CLI 帮助、链接、系统提示词、安全/数据丢失/兼容性）仍走完整流程。
评审者测试计划
如何验证
该路由刻意保守，测试锁定的是这些保守约束本身，而不是转述：
npm run test:scripts -- scripts/tests/qwen-pr-review-workflow.test.js scripts/tests/qwen-triage-workflow.test.js——255/255 通过。新增的qwen pr review triage-only skip (#7411)用桩gh执行真实的Resolve PR contextbash，并断言：仅当实时标签查询返回status/on-hold时才跳过自动评审（精确匹配——status/on-hold-extended不会触发跳过）；标签读取失败时失败开放（fail open），照常评审；显式/review评论和review_requested永不跳过，甚至不查询标签。已验证先红后绿：把 workflow 改动 stash 掉后，跳过测试失败。triage skill non-functional routing (#7411)锁定 Stage 1f 的契约措辞：失败关闭兜底（"when in doubt, take the full path"）、仅无人值守运行、排除清单（fix 标题、核心路径、workflows、manifest/lockfile、schema/生成文件、模型可见文本、面向用户的文档/CLI 帮助、坏链、高风险路径）、100 行生产代码上限、只使用已有标签的规则，以及在 Stage 2 之前终止退出。actionlint：干净。改动文件跑 Prettier：干净。前后证据
N/A——CI 自动化改动，无用户可见/TUI 界面。
测试环境
环境（可选）
Vitest workflow/skill 契约测试 + actionlint；不涉及运行时或沙箱。
风险与范围
/review、review_requested和 dispatch 永远执行，也不新增任何合并拦截（符合 issue 的非目标）。/review成本讨论；Proposal: remove automated PR approvals — triage gates only, approval authority returns to maintainers #9182 的 approval 策略提案。stale.yml的交互：该工作流本来就把status/on-hold排除在 stale 机制外——带此标签的 triage-only PR 不会被 stale 机器人自动关闭。另请注意未合并 PR feat(review): wire --resume through /review, review run and the CI retry #9153 也改了同一个 workflow 文件（不同区域：--resume接线），视合并顺序可能需要 rebase。关联 Issue
Fixes #7411