ci: add bestaxbot-reply — respond to trusted humans (reviews + @bestaxbot) by allxsmith · Pull Request #252 · allxsmith/bestax

allxsmith · 2026-07-07T21:26:18Z

What

A new workflow, bestaxbot-reply.yml, so bestaxbot answers trusted humans — closing the gap where the convergence loop only ever engaged CodeRabbit/Claude/Copilot threads (first-author filter) and ignored human reviewers and @bestaxbot mentions.

It responds as the bestaxbot machine account when a trusted human:

submits a review on a bestaxbot-authored PR (no mention needed — "reviewers just by posting"), or
writes @bestaxbot in a comment or review.

It can answer, refute with reasoning, or push a small in-scope fix (git-CLI, SSH-Verified) — like robobun does for Bun's maintainers.

Security (public repo, external input) — two layers

Job if: pre-gate: sender.type == User + association is OWNER/MEMBER/COLLABORATOR + the trigger condition. A stranger typing @bestaxbot never starts the job → zero Claude usage.
Live permission re-check step: gh api …/collaborators/SENDER/permission must be admin/maintain/write/triage. So a COLLABORATOR with only read access is still rejected. Same pattern as claude-implement + on-slop.

Kill switch: AI_LOOP_ENABLED=false. The triggering text is treated as UNTRUSTED data — it can't grant permissions, change the rules, or touch protected paths (.github/**, jest/commitlint/release configs, pnpm-workspace.yaml, .npmrc, .coderabbit.yaml, turbo.json).

Details

Fixes commit via git CLI (the file-ops MCP is intentionally out — same lesson as ci: steer the implement agent to commit via git CLI, not the file-ops MCP #250); replies use the gh-api thread-reply recipe (ci: log full fix/verify output + give agents the gh-api thread-reply recipe #248); show_full_output on for diagnosis.
bestaxbot never merges/closes/resolves/labels — humans still rule.
Model claude-opus-4-8, 60 turns; fix-agent allowlist + git fetch + gh issue verbs.

Note

New .github workflow → human-merged (the loop refuses .github/**). YAML validated. No behavior change to the existing loop.

Generated by Claude Code

Summary by CodeRabbit

New Features
- Added an automated response workflow for newly created issue comments and pull request review activity (review comments and review submissions).
- Responses now run only when the automation toggle is enabled and when the triggering text is clearly directed at the bot.
- Added multiple safeguards to ensure only authorized collaborators can trigger responses, with limited behavior for forked pull requests (reply-only).

…xbot

…xbot) Closes the gap where bestaxbot ignored human input: the convergence loop only ever engaged CodeRabbit/Claude/Copilot threads (first-author filter), so a human reviewer or an @bestaxbot mention got no response. New workflow bestaxbot-reply.yml responds as the bestaxbot machine account when a TRUSTED human either (a) submits a review on a bestaxbot-authored PR (no mention needed) or (b) writes @bestaxbot in a comment/review. It can answer, refute with reasoning, or push a small in-scope fix — like robobun does for Bun's maintainers. Security (public repo, external input) is two-layered: - Job requires sender.type==User + OWNER/MEMBER/COLLABORATOR association + the trigger condition, so a stranger typing @bestaxbot never starts the job (zero usage). - A live permission re-check step requires admin/maintain/write/triage, so a read-only collaborator can't trigger it either (matches claude-implement / on-slop). Kill switch: AI_LOOP_ENABLED=false. The triggering text is treated as UNTRUSTED data (no perms/rule changes, no protected paths). Fixes commit via the git CLI (SSH-signed Verified), replies use the gh-api thread-reply recipe, and show_full_output is on for diagnosis. bestaxbot never merges/closes/resolves — humans still rule. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NVR5yWevceZEFbTJmpviiM

coderabbitai · 2026-07-07T21:26:55Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d5babeb-2678-4137-8937-a2db9e2f202a

📥 Commits

Reviewing files that changed from the base of the PR and between 02514e2 and 8705915.

📒 Files selected for processing (1)

.github/workflows/bestaxbot-reply.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/bestaxbot-reply.yml

Walkthrough

Adds a new GitHub Actions workflow that triggers on issue comments, PR review comments, and PR reviews. It gates execution with sender and collaborator checks, resolves whether a PR is same-repo, then runs claude-code-action with constrained reply and fix instructions.

Changes

Bestaxbot Reply Workflow

Layer / File(s)	Summary
Triggers and workflow scope `.github/workflows/bestaxbot-reply.yml`	Defines the workflow description, event triggers, empty permissions, and concurrency grouping.
Sender and permission gating `.github/workflows/bestaxbot-reply.yml`	Adds the job-level trigger conditions and collaborator role verification before downstream steps run.
Context resolution and environment setup `.github/workflows/bestaxbot-reply.yml`	Determines whether fixes are allowed for same-repo PRs, then sets up checkout, pnpm, Node.js, and installs dependencies.
Claude action and prompt constraints `.github/workflows/bestaxbot-reply.yml`	Configures the Claude action and supplies prompt rules for reply-only behavior, limited fixes, and forbidden paths or mentions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

allxsmith/bestax#249: Both changes shape the bot’s review-thread reply behavior and gh api-driven interaction model for bestaxbot.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is informative, but it does not follow the repo template and omits required sections like package scope, issues, type, checklist, and demos.	Rewrite it to match the template: add package scope, related issues, type of change, checklist items, screenshots/demos, and any additional context.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly names the new bestaxbot-reply workflow and its human-response behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/bestaxbot-reply

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-07T21:28:28Z

Preview Deployment

Preview URL: https://c72f9130.bestax.pages.dev

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/bestaxbot-reply.yml:
- Around line 40-53: Add a self-exclusion guard so `bestaxbot` cannot trigger
`bestaxbot-reply.yml` on its own activity. The current `if` on the workflow uses
`github.event.sender.type == 'User'`, but that still allows PAT-backed
`bestaxbot` events to re-enter on `pull_request_review`, `issue_comment`, and
`pull_request_review_comment`. Update the workflow condition to explicitly
exclude events where the sender/login is `bestaxbot`, keeping the existing
`AI_LOOP_ENABLED` and association checks intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 819e074a-bae4-41dc-b13d-67ef14d59828

📥 Commits

Reviewing files that changed from the base of the PR and between 4f95cca and 02514e2.

📒 Files selected for processing (1)

.github/workflows/bestaxbot-reply.yml

…share loop concurrency - Exclude bestaxbot itself as sender (User-type account is not filtered by sender.type=='User'), preventing a self-reply loop (CodeRabbit finding). - Add a Resolve context step computing CAN_FIX (head repo == this repo); reply-only on fork PRs and plain issues where there is no writable branch. - Share the loop's per-branch ai-loop-<head-ref> concurrency group for PR review events so a fix-pushing reply never races claude-pr-loop fix/verify. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NVR5yWevceZEFbTJmpviiM

github-actions · 2026-07-08T00:09:40Z

Preview Deployment

Preview URL: https://13a85ef8.bestax.pages.dev

github-actions · 2026-07-08T12:43:52Z

🎉 This PR is included in version 5.3.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

github-actions · 2026-07-11T12:10:27Z

🎉 This PR is included in version 3.2.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

github-actions · 2026-07-20T23:54:58Z

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

bestax-release-bot · 2026-08-12T03:45:55Z

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

coderabbitai Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread .github/workflows/bestaxbot-reply.yml

allxsmith merged commit 5f73642 into main Jul 8, 2026
10 checks passed

allxsmith mentioned this pull request Jul 8, 2026

ci: bestaxbot replies to a plain reviewer comment on its own PR #254

Merged

7 of 20 tasks

github-actions Bot added the released label Jul 8, 2026

allxsmith mentioned this pull request Jul 9, 2026

ci: allowlist Edit/MultiEdit/Write for the write-capable agents #258

Merged

7 of 20 tasks

This was referenced Jul 9, 2026

ci: enforce protected-path exclusions with --disallowedTools #260

Merged

ci: point loop agents at conformance gates; component proposal issue form #270

Merged

coderabbitai Bot mentioned this pull request Jul 15, 2026

chore(deps): bump the github-actions group across 1 directory with 4 updates #318

Closed

Navigation Menu

Repository navigation

ci: add bestaxbot-reply — respond to trusted humans (reviews + @bestaxbot) - #252

ci: add bestaxbot-reply — respond to trusted humans (reviews + @bestaxbot)#252
allxsmith merged 2 commits into
mainfrom
claude/bestaxbot-reply

allxsmith commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

bestax-release-bot Bot commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

allxsmith commented Jul 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Security (public repo, external input) — two layers

Details

Note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 7, 2026

Preview Deployment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 8, 2026

Preview Deployment

Uh oh!

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

bestax-release-bot Bot commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

allxsmith commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading