fix(ci): adicionar gpt-engineer-app[bot] à whitelist do Branch Protection Sentinel

[adm01-debug]

Por que\n\nO Branch Protection Sentinel está falhando em 100% dos pushes do Lovable porque a whitelist de bots oficiais não inclui o nome real do bot (gpt-engineer-app[bot]), só lovable-dev[bot] (nome antigo).\n\nIsso quebra o CI a cada Fast Visual Edit / commit Lovable e provavelmente está causando cascata nos outros 8 workflows (Deploy to Vercel, E2E, CodeQL etc) que também ficam vermelhos em 5-7s a cada push.\n\n## O que\n\n2 linhas em .github/workflows/branch-protection-sentinel.yml:\n- comentário (linha 34): adiciona gpt-engineer-app[bot] na lista documentada\n- case (linha 48): adiciona "gpt-engineer-app[bot]" no pattern de bots aceitos\n\n## Validação esperada após merge\n\nPróximo commit do Lovable → Sentinel passa. Se os outros 8 workflows também ficarem verdes = era cascata, problema resolvido. Se continuarem vermelhos = bug separado, ataco um a um com logs frescos.\n\n## Risco\n\nZero. Whitelist é mais permissiva, mas o bot oficial do Lovable é controlado pelo GitHub App (não é spoofable via push). Nenhuma feature afetada.

---

Summary by cubic

Whitelist gpt-engineer-app[bot] in Branch Protection Sentinel to stop false failures on Lovable pushes and unblock CI workflows. Also restores the final newline in .github/workflows/branch-protection-sentinel.yml.

Adds the bot to the author check and to the documented whitelist in the workflow.

^{Written for commit 81417fa. Summary will update on new commits. Review in cubic}

Summary by CodeRabbit

Notas de Lançamento

• Chores
  • Regras de validação de commits na branch principal atualizadas para reconhecer um autor automatizado adicional (gpt-engineer-app[bot]) como integrador oficial, mantendo as checagens existentes de mesclagem e releases.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
we-dream-big	Error		May 19, 2026 1:43pm

[Copilot]

Pull request overview

Adds gpt-engineer-app[bot] (the actual Lovable bot account name) to the Branch Protection Sentinel whitelist so Lovable-authored pushes to main no longer fail CI.

Changes:

• Documents gpt-engineer-app[bot] in the accepted-bots comment.
• Adds gpt-engineer-app[bot] to the case pattern of accepted bot authors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Walkthrough

O workflow .github/workflows/branch-protection-sentinel.yml é atualizado para reconhecer gpt-engineer-app[bot] como autor oficial permitido. A documentação comentada e o case statement de validação do autor foram ajustados; o fluxo de saída permanece inalterado.

Changes

Ampliação de autores de bot no sentinel de proteção

Layer / File(s)	Resumo
Expansão da lista de bots oficiais reconhecidos .github/workflows/branch-protection-sentinel.yml	Comentário de bots aceitos e expressão case "$AUTHOR" in ...) foram atualizados para incluir gpt-engineer-app[bot], mantendo o comportamento de rejeição para autores não reconhecidos.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutos

Possibly related PRs

• adm01-debug/zapp-web#89: PR similar que atualiza um sentinel de proteção para permitir autores de bot via lista de allowlist no case check.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	O título descreve precisamente a mudança principal: adicionar um bot à whitelist do Branch Protection Sentinel, alinhado com o arquivo alterado e o objetivo da PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/branch-protection-sentinel.yml:
- Line 34: O comentário que lista bots oficiais ("# 3. Bot oficial:
github-actions[bot], dependabot[bot], lovable-dev[bot], gpt-engineer-app[bot]")
está incompleto: adicione "renovate[bot]" a essa lista para ficar consistente
com a entrada "renovate[bot]" presente mais abaixo no arquivo; atualize apenas o
texto do comentário para incluir renovate[bot] mantendo a formatação e a vírgula
como os outros itens.
- Line 48: A entrada "gpt-engineer-app[bot]" na whitelist de branch protection
(a linha contendo
"github-actions[bot]"|"dependabot[bot]"|"lovable-dev[bot]"|"gpt-engineer-app[bot]"|"renovate[bot]")
não deve estar lá; remova "gpt-engineer-app[bot]" da lista em
branch-protection-sentinel.yml, confirme com o time da Lovable qual é o username
oficial do bot para 2025 (se for outra coisa substitua pela identidade correta,
p.ex. "lovable-dev[bot]"), e atualize qualquer documentação que mencione o bot;
depois verifique/ajuste os testes/CI que dependam dessa whitelist para garantir
que a remoção não quebre automações.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 71109cd9-5761-48d2-973f-d87a55fd5f3d

📥 Commits

Reviewing files that changed from the base of the PR and between 4090841 and 8260007.

📒 Files selected for processing (1)

• .github/workflows/branch-protection-sentinel.yml

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Inconsistência: renovate[bot] está no código mas não na documentação.

O comentário lista os bots oficiais, mas renovate[bot] (presente na linha 48) não aparece aqui. Isso pode confundir futuros mantenedores.

📝 Correção sugerida para sincronizar a documentação

-          # 3. Bot oficial: github-actions[bot], dependabot[bot], lovable-dev[bot], gpt-engineer-app[bot]
+          # 3. Bot oficial: github-actions[bot], dependabot[bot], lovable-dev[bot], gpt-engineer-app[bot], renovate[bot]

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	# 3. Bot oficial: github-actions[bot], dependabot[bot], lovable-dev[bot], gpt-engineer-app[bot]
	# 3. Bot oficial: github-actions[bot], dependabot[bot], lovable-dev[bot], gpt-engineer-app[bot], renovate[bot]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/branch-protection-sentinel.yml at line 34, O comentário
que lista bots oficiais ("# 3. Bot oficial: github-actions[bot],
dependabot[bot], lovable-dev[bot], gpt-engineer-app[bot]") está incompleto:
adicione "renovate[bot]" a essa lista para ficar consistente com a entrada
"renovate[bot]" presente mais abaixo no arquivo; atualize apenas o texto do
comentário para incluir renovate[bot] mantendo a formatação e a vírgula como os
outros itens.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verificar existência do bot gpt-engineer-app no GitHub e commits recentes dele no repo

echo "=== Verificando histórico de commits do bot ==="
git log --all --author="gpt-engineer-app\[bot\]" --oneline | head -20

echo ""
echo "=== Verificando settings de branch protection ==="
echo "Checar manualmente em: https://github.com/${{ github.repository }}/settings/branch_rules"
echo "Deve exigir PR reviews antes de merge em main."

Repository: adm01-debug/we-dream-big

Length of output: 705

---

🌐 Web query:

gpt-engineer-app bot GitHub official name lovable-dev renamed

💡 Result:

The commercial web platform formerly known as gptengineer.app has been officially rebranded as Lovable [1][2]. This rebranding was implemented to eliminate confusion between the commercial platform and the original open-source command-line tool, which continues to exist under the name gpt-engineer [1][3]. While the platform has transitioned to the Lovable brand, the underlying service remains the same, and users can access their projects via both the original gptengineer.run domain and the new lovable.app domain [1]. The open-source gpt-engineer project remains an independent entity on GitHub [1][4].

Citations:

• 1: https://lovable.dev/gpt-engineer
• 2: https://lovable.dev/blog/2025-01-13-rebranding-gpt-engineer-to-lovable
• 3: https://www.13labs.au/compare/lovable-vs-gpt-engineer
• 4: https://github.com/gpt-engineer-org/gptengineer.app

---

🌐 Web query:

"gpt-engineer-app" GitHub bot official app

💡 Result:

There is no official "gpt-engineer-app" GitHub bot or application available in the GitHub Marketplace [1]. The term "gptengineer.app" refers to a commercial, managed web application platform for AI-driven web app generation [2][3][4]. While this platform integrates with GitHub—allowing users to sync projects, commit changes automatically to repositories, and deploy web applications—it does not function as a standalone "GitHub bot" or official GitHub App that you install from the Marketplace [5][6][3]. Key distinctions to note: 1. GPT Engineer (Open Source): This is the original open-source CLI project [7][4]. It is a tool for experimenting with code generation and is not a managed service [4]. 2. gptengineer.app (Commercial Service): This is a separate, opinionated, managed service built by a team that supports the open-source project [2][3][4]. It provides a web-based UI for non-technical users to build and deploy apps [2][3]. When you use this service, it can interact with your GitHub account to manage code repositories, but this is a feature of the platform's workflow rather than an installed GitHub bot [5][6]. If you encounter repositories or tools claiming to be an "official" gpt-engineer GitHub bot, they are likely community-created projects or unrelated third-party tools, as the official gptengineer.app service operates primarily through its own web interface [5][3].

Citations:

• 1: https://github.com/marketplace
• 2: https://github.com/16892434/gpt-engineer
• 3: https://github.com/gpt-engineer-org/gptengineer.app
• 4: https://github.com/antonosika/gpt-engineer
• 5: https://github.com/GPT-Engineer-App/front-end-collaborator
• 6: https://www.b12.io/ai-directory/gpt-engineer-app/
• 7: https://github.com/vishnur/gpt-engineer

---

🌐 Web query:

lovable GitHub App bot official name 2025

💡 Result:

The Lovable GitHub App’s official app identity/bot username is lovable-dev[bot]. [1][2] Lovable’s official documentation states that commits made by the Lovable GitHub app identity are authored as “lovable-dev[bot]” on GitHub.com (and GitHub Enterprise Cloud). [1] The GitHub Apps listing for the Lovable integration also corresponds to the “lovable-dev” GitHub App. [2]

Citations:

• 1: https://docs.lovable.dev/integrations/github
• 2: https://github.com/apps/lovable-dev

---

🏁 Script executed:

# Verificar commits recentes de ambos os bots para entender quem está ativo agora
echo "=== Últimos 5 commits por lovable-dev[bot] ===" 
git log --all --author="lovable-dev\[bot\]" --oneline | head -5

echo ""
echo "=== Últimos 5 commits por gpt-engineer-app[bot] ===" 
git log --all --author="gpt-engineer-app\[bot\]" --oneline | head -5

echo ""
echo "=== Verificar se há alguma issue/PR discutindo a mudança ===" 
git log --all --grep="gpt-engineer-app\|lovable-dev" --oneline | head -10

Repository: adm01-debug/we-dream-big

Length of output: 386

---

Remove gpt-engineer-app[bot] da whitelist — bot não é verificado oficialmente.

A web search confirma que gpt-engineer-app[bot] não é um GitHub App oficial listado no GitHub Marketplace. O bot oficial do Lovable é lovable-dev[bot], conforme documentação oficial.

Achado crítico: seu repo mostra commits recentes de gpt-engineer-app[bot], mas zero recentes de lovable-dev[bot]. Isso sugere:

• Mudança de nome não documentada na web, ou
• Bot não verificado sendo usado

Adicionar um bot não verificado a uma whitelist de segurança (branch protection) é risco desnecessário, mesmo com branch protection ativo. Confirme com o time de Lovable qual é o username correto do bot em 2025 antes de fazer o merge. Se a mudança de nome foi oficial, atualize a documentação no Lovable também.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/branch-protection-sentinel.yml at line 48, A entrada
"gpt-engineer-app[bot]" na whitelist de branch protection (a linha contendo
"github-actions[bot]"|"dependabot[bot]"|"lovable-dev[bot]"|"gpt-engineer-app[bot]"|"renovate[bot]")
não deve estar lá; remova "gpt-engineer-app[bot]" da lista em
branch-protection-sentinel.yml, confirme com o time da Lovable qual é o username
oficial do bot para 2025 (se for outra coisa substitua pela identidade correta,
p.ex. "lovable-dev[bot]"), e atualize qualquer documentação que mencione o bot;
depois verifique/ajuste os testes/CI que dependam dessa whitelist para garantir
que a remoção não quebre automações.