[don-petry]

User description

Closes #1713

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• New Features

  • Added an optional shadow mode for development workflows.
  • Shadow mode suppresses pull request and issue output while recording notices for review.
  • Unrecognized shadow-mode values fail closed to prevent unintended posting.
  • QA Lead advisory actions now use the donpetry-bot account.

• Tests

  • Added coverage for shadow-mode suppression, fail-closed behavior, and persona identity resolution.

---

CodeAnt-AI Description

Add fail-closed shadow mode that suppresses PR and issue changes

What Changed

• Reusable workflows can enable shadow mode to prevent reviews, comments, labels, auto-merge actions, and new PRs from being posted.
• Shadow mode also suppresses existing-PR deduplication comments, while recording the suppressed action in the run log and an optional output file.
• Unrecognized shadow-mode values suppress external changes by default; recognized off values preserve current behavior.
• Added coverage for inactive, active, invalid, deduplication, output recording, and repeated shadow-mode runs.

Impact

✅ No PR or issue changes during shadow runs
✅ Invalid shadow settings cannot post externally
✅ Suppressed results remain available for review

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Problem

See the linked issue.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

Tests added/updated: tests/dev-lead/unit/test_fix_issue.bats,tests/dev-lead/unit/test_shadow_suppress.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	a28ad52	Sep 17, 2026 · 19:45	19:45
✅ Incremental review completed	a8b09ba	Sep 16, 2026 · 12:25	12:25
✅ Incremental review completed	dc82081	Sep 13, 2026 · 09:15	09:16
✅ Incremental review completed	fd4a614	Sep 13, 2026 · 04:17	04:17
✅ Incremental review completed	0b4157d	Sep 08, 2026 · 11:37	11:37

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[gemini-code-assist]

Code Review

This pull request introduces shadow-mode total PR-output suppression by adding a new helper script scripts/lib/shadow-suppress.sh and integrating it into the dev-lead lanes. When shadow mode is active, the scripts force a dry-run state (DEV_LEAD_DRY_RUN=true) to prevent any PR or issue output from escaping, routing it to a log file instead. Unit tests have been added to verify the suppression behavior. Feedback suggests using $BATS_TEST_TMPDIR instead of mktemp in the BATS tests to ensure automatic per-test isolation and cleanup.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #1730
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-09-08T04:19:33Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-09-08T04:19:33Z

[don-petry]

No description provided.

[don-petry]

No description provided.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality Gate Passed (0 new issues, 0 security hotspots) — informational status only
- Gemini feedback on $BATS_TEST_TMPDIR — already implemented in PR
Files changed: No changes needed
Skipped (informational): 1 (SonarCloud status report)
```
The PR is ready; no changes required.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-09-08T12:52:06Z.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-09-08T13:06:53Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality Gate passed (informational only, no defects reported)
Files changed: none
Skipped (informational): 1
```
No changes required. The SonarCloud analysis confirms the PR meets quality standards with no new issues, hotspots, or coverage concerns.

[donpetry-bot]

Superseded by automated re-review at fd4a6149169ec0f48c02bb3e4df2ce4167ef37e4 — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 9f491ae198382b94e385fabdf095a799b75f5fb3
Review mode: triage-approved (single reviewer)

Summary

Adds an inert shadow_mode boolean input to dev-lead-reusable.yml plus a fail-closed suppression lib (scripts/lib/shadow-suppress.sh) that forces the existing dry-run "post nothing" path in all three handlers, with the one pre-dry-run posting site (fix-issue dedup comment) gated explicitly. Design is sound and well-tested, but the PR has a merge conflict with main, one unresolved (and legitimate) review thread, and the issue-mandated posting-site enumeration is missing from the PR description.

Linked issue analysis

Closes #1713 ([#1269 split 1/2]). AC#1 (input, default false) ✓. AC#2 (flag-off byte-identical) ✓ — asserted by tests. AC#4 (fail-closed on unrecognized values) ✓ — truth-table tested. AC#5 (inert, nothing dispatched) ✓ — verified nothing sets the input. AC#7 (shellcheck + bats registration) ✓ — CI green. AC#3 is PARTIALLY met: suppression coverage verified (all dispatch-job posting paths route through the three handlers, which apply suppression before their first posting gate; the enable-auto-merge step also runs fix-reviews.sh; ci-relay/resume emit repository_dispatch only, not PR output) — but the issue explicitly required enumerating every posting site in the PR description so reviewers can check completeness rather than trust it, and the description contains no such list; additionally, only a startup banner is written to SHADOW_OUTPUT_FILE, not the suppressed output the AC requires "to a file for later comparison" (consumed by split 2's shadow-compare).

Findings

1. [blocking] Merge conflict — mergeable: CONFLICTING; auto-rebase already failed with a conflict comment. Needs a manual rebase onto main.
2. [blocking] Unresolved review thread (codeant-ai on scripts/lib/shadow-suppress.sh) — valid finding: SHADOW_OUTPUT_FILE receives only the activation banner; the actual suppressed handler output goes only to the run log, so split 2's comparison runner has no file to read. AC#3 says output goes to the run log and a file.
3. [should-fix] Missing enumeration — issue [#1269 split 1/2] shadow_mode input + total PR-output suppression (inert, nothing dispatched) #1713 tasks require listing every PR-posting site in the PR description (AC#3: "a missed site is exactly the leak this ordering exists to prevent"). The lib header describes the ~35-site dry-run-reuse strategy but the reviewer-checkable list is absent from the description.
4. [verified, no action] Suppression ordering is correct in all three handlers (applied before any posting site); the dedup-comment gate in fix-issue is the only pre-dry-run-exit site and is explicitly gated; DEV_LEAD_SHADOW_MODE is a typed boolean input forwarded via env — no injection surface.
5. [note] run_secret_scanning MCP tool unavailable in this environment; gitleaks CI check is green. No secrets, credentials, or new dependencies in the diff.

CI status

All required checks green (shellcheck, bats, unit-tests, CodeQL, actionlint, gitleaks, SonarCloud, agent-shield, all validators). Three dev-lead / agent jobs show CANCELLED (concurrency cancellation, not failures). mergeStateStatus: DIRTY — merge conflict with main is the gating problem, not CI.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

SHADOW_OUTPUT_FILE is set unconditionally in the job env: even when inputs.shadow_mode is false. Because the handlers (scripts/dev-lead-fix-ci.sh:285, scripts/dev-lead-fix-issue.sh:636, scripts/dev-lead-fix-reviews.sh:346) branch on if [ -n "$capture_file" ] rather than if shadow_mode_active, every normal non-shadow run writes /tmp/dev-lead-shadow-output-<run_id>.txt and pipes run_writer_with_fallback ... | tee -a "$capture_file".

Running run_writer_with_fallback on the left side of a pipeline executes it in a subshell, discarding any shell state mutated inside run_writer_with_fallback (such as _ENGINE_EXHAUSTED_REASON across fix-ci retry cycles).

[don-petry]

Adding && ! shadow_mode_active here bypasses the only DEV_LEAD_DRY_RUN guard in scripts/dev-lead-fix-issue.sh.

Nothing after run_writer_with_fallback checks DEV_LEAD_DRY_RUN or shadow_mode_active: when DEV_LEAD_SHADOW_MODE=true, execution proceeds through admission_gate_allows, run_writer_with_fallback (which calls handle_engine_failure and posts comments/labels on the live issue if the engine fails), git push --set-upstream origin "$branch", gh pr create, label edits, and post_completion_claim on the live repository. This also breaks the new test @test "fix-issue: shadow on (normal run) → no PR create, no comment, exits 0" in tests/dev-lead/unit/test_fix_issue.bats:1461.

[don-petry]

Bypassing the dry-run early exit when shadow_mode_active is true causes a shadow run to enter the while [ "$cycle" -le "$MAX_CI_CYCLES" ] loop (line 280), where git commit and git push run unconditionally without checking DEV_LEAD_DRY_RUN or shadow_mode_active, pushing shadow commits directly to the live PR branch. In addition, hold_auto_merge (called just before build_prompt in main) disables auto-merge on the live PR because it is not gated on DEV_LEAD_DRY_RUN or shadow_mode_active.

[don-petry]

Calling shadow_apply_suppression at line 77 sets DEV_LEAD_DRY_RUN="true" before the worktree checkout block (if [ "${DEV_LEAD_DRY_RUN:-false}" = "false" ] && [ -n "${PR_NUMBER:-}" ]; then ... checkout_pr_in_worktree ...), so a shadow run skips checking out the PR branch into a worktree. Then at line 329 (if [ "$DEV_LEAD_DRY_RUN" = "true" ] && ! shadow_mode_active), build_and_run bypasses the dry-run return and invokes run_writer_with_fallback inside the agent checkout (combsmith/.github-private) instead of the target PR worktree (and for INTENT_TYPE=rebase, the prompt instructs the engine itself to git push --force, which is not blocked by DEV_LEAD_DRY_RUN).

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push