debug: pr-review enumeration logging

.github/workflows/daily-pr-review-health.yml

@@ -42,7 +42,7 @@ jobs:
           node-version: '20'
 
       - name: Cache claude-code CLI
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.npm-global
           key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}

.github/workflows/dev-lead-reusable.yml

@@ -85,6 +85,7 @@ jobs:
           GITHUB_EVENT_NAME: ${{ github.event_name }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
         run: bash .dev-lead/scripts/dev-lead-intent.sh
 
@@ -112,6 +113,7 @@ jobs:
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           GH_PAT: ${{ secrets.GH_PAT }}
         run: bash .dev-lead/scripts/dev-lead-preflight.sh
 
@@ -164,6 +166,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-ci.sh
@@ -179,6 +182,7 @@ jobs:
           TRIGGERING_REVIEWER: ${{ env.INTENT_ACTOR }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -193,6 +197,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -207,6 +212,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -221,6 +227,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
@@ -234,6 +241,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-issue.sh
@@ -247,6 +255,7 @@ jobs:
           REVIEW_ENGINE: ${{ env.DEV_LEAD_ENGINE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           COPILOT_GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           PROMPTS_DIR: .dev-lead/prompts/dev-lead
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh

.github/workflows/dev-lead.yml

@@ -260,8 +260,17 @@ jobs:
       # ── enable-auto-merge ─────────────────────────────────────────────────
       # Triggered when a trusted bot approves a PR. Skips engine install and
       # pre-flight — just checks reviewDecision and enables auto-merge if APPROVED.
+      #
+      # Gate on the step output of `intent` (not env.INTENT_TYPE): a step's own
+      # env block is in scope when evaluating its `if:`, so the literal
+      # `INTENT_TYPE: enable-auto-merge` we set below would make env.INTENT_TYPE
+      # always equal 'enable-auto-merge' at gate-evaluation time, defeating the
+      # check. Step outputs are not shadowed. Also require a non-empty PR number
+      # to mirror the guard already present in dev-lead-reusable.yml.
       - name: Enable auto-merge on bot approval
-        if: env.INTENT_TYPE == 'enable-auto-merge'
+        if: >-
+          steps.intent.outputs.intent_type == 'enable-auto-merge'
+          && env.INTENT_PR_NUMBER != ''
         env:
           INTENT_TYPE: enable-auto-merge
           PR_NUMBER: ${{ env.INTENT_PR_NUMBER }}

.github/workflows/issue-triage-runner.yml

@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Install claude CLI
-        uses: anthropics/claude-code-action/setup@20c8abf165d5f85ab3fc970db9498436377dc9d1  # main
+        uses: anthropics/claude-code-action/setup@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251  # main
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/pr-review.yml

@@ -154,8 +154,7 @@ jobs:
         ${{
           inputs.pr_url
           || github.event.client_payload.pr_url
-          || (github.event_name == 'pull_request_review' && github.event.pull_request.html_url)
-          || (github.event_name == 'pull_request' && github.event.pull_request.html_url)
+          || github.event.pull_request.html_url
           || ''
         }}
       # JSON array of PRs associated with a check_suite event. Empty for all
@@ -247,6 +246,7 @@ jobs:
       - name: Enumerate candidate PRs
         run: |
           set -euo pipefail
+
           if [ -n "${PR_URL_OVERRIDE}" ]; then
             # Single-PR mode: workflow_dispatch with pr_url, repository_dispatch
             # (mention), or event-triggered run with a direct PR context
@@ -263,10 +263,15 @@ jobs:
           else
             bash scripts/list-prs.sh > prs.txt
           fi
+
           count=$(grep -c . prs.txt || true)
           echo "::notice::Candidate pool has $count PRs (no-ops will be skipped, MAX_PRS caps actual reviews)"
           echo "--- candidate PRs ---"
-          cat prs.txt || true
+          if [ -s prs.txt ]; then
+            cat prs.txt
+          else
+            echo "(empty file)"
+          fi
 
       - name: Review each PR (cascade)
         run: bash scripts/review-batch.sh

.github/workflows/repair-pr-approvals.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Repair PR approvals
         env:

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Run copilot_chat tests
         run: bash tests/test_copilot_chat.sh

scripts/dev-lead-fix-ci.sh

@@ -8,6 +8,7 @@ set -euo pipefail
 # Optional: MAX_FAIL_ATTEMPTS — consecutive engine failures before exhaustion (default: 2)
 
 source "$(dirname "$0")/engine.sh"
+source "$(dirname "$0")/lib/git-identity.sh"
 
 PR_NUMBER="${PR_NUMBER:-}"
 HEAD_SHA="${HEAD_SHA:-}"
@@ -254,6 +255,9 @@ main() {
     fi
 
     if $has_uncommitted; then
+      # GitHub-hosted runners have no default git identity; configure it
+      # before committing or commit fails with "fatal: empty ident name".
+      setup_git_identity
       git add -A
       git commit -m "fix(ci): auto-fix for $(echo "$CHECKS_JSON" | jq -r '.[0].name // "CI failure"') [skip ci-relay]"
     fi

scripts/dev-lead-fix-issue.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 # Optional: PROMPTS_DIR (defaults to prompts/dev-lead relative to CWD)
 
 source "$(dirname "$0")/engine.sh"
+source "$(dirname "$0")/lib/git-identity.sh"
 
 ISSUE_NUMBER="${ISSUE_NUMBER:-}"
 REPO="${REPO:-${GITHUB_REPOSITORY:-}}"
@@ -17,18 +18,6 @@ check_existing_pr() {
   [ "$existing" -gt 0 ]
 }
 
-setup_git_identity() {
-  local bot="${BOT_USER:-donpetry-bot}"
-  local bot_id
-  bot_id=$(gh api "users/${bot}" --jq '.id' 2>/dev/null || echo "")
-  if [ -n "$bot_id" ]; then
-    git config user.email "${bot_id}+${bot}@users.noreply.github.com"
-  else
-    git config user.email "${bot}@users.noreply.github.com"
-  fi
-  git config user.name "$bot"
-}
-
 main() {
   if [ -z "$ISSUE_NUMBER" ]; then
     echo "::error::ISSUE_NUMBER is required"

scripts/dev-lead-fix-reviews.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 # Optional: PROMPTS_DIR (defaults to prompts/dev-lead relative to CWD)
 
 source "$(dirname "$0")/engine.sh"
+source "$(dirname "$0")/lib/git-identity.sh"
 
 INTENT_TYPE="${INTENT_TYPE:-fix-reviews}"
 PR_NUMBER="${PR_NUMBER:-}"
@@ -29,6 +30,7 @@ fi
 # Checkout the PR branch for modification (Requirement 1)
 if [ "${DEV_LEAD_DRY_RUN:-false}" = "false" ] && [ -n "${PR_NUMBER:-}" ]; then
   gh pr checkout "$PR_NUMBER" --repo "$REPO"
+  setup_git_identity
 fi
 
 build_and_run() {
@@ -428,7 +430,13 @@ commit_and_push() {
     fi
   else
     if $has_uncommitted; then
+      # GitHub-hosted runners have no default git identity; configure it
+      # before committing or commit fails with "fatal: empty ident name".
+      setup_git_identity
       git add -A
+      # Ensure git identity is set — actions/checkout only sets local config for the
+      # repo it checks out (.github-private), not for target repos cloned separately.
+      setup_git_identity
       # Explicit exit on failure: set -e is suspended when commit_and_push is called from
       # an if-statement condition, so git commit failures would be silently swallowed
       # otherwise. Using exit (not return) ensures CI fails visibly instead of posting a
@@ -593,13 +601,13 @@ case "$INTENT_TYPE" in
         post_reviews_terminal "fix-reviews" "applied" "Changes committed and pushed."
       else
         notify_coderabbit_resolve
-        resolve_actor_outdated_threads "fix-reviews"
         if has_tier1_blockers; then
           echo "::warning::Tier-1 blockers still present (failing CI or CHANGES_REQUESTED reviews) — skipping no-changes marker to allow retries"
         else
           post_no_changes "fix-reviews"
         fi
       fi
+      resolve_actor_outdated_threads "fix-reviews"
       try_enable_auto_merge
     fi
     exit "$rc"
@@ -617,13 +625,13 @@ case "$INTENT_TYPE" in
         post_reviews_terminal "fix-bot-comment" "applied" "Changes committed and pushed."
       else
         notify_coderabbit_resolve
-        resolve_actor_outdated_threads "fix-bot-comment"
         if has_tier1_blockers; then
           echo "::warning::Tier-1 blockers still present (failing CI or CHANGES_REQUESTED reviews) — skipping no-changes marker to allow retries"
         else
           post_no_changes "fix-bot-comment"
         fi
       fi
+      resolve_actor_outdated_threads "fix-bot-comment"
       try_enable_auto_merge
     fi
     exit "$rc"
@@ -674,13 +682,13 @@ case "$INTENT_TYPE" in
         post_reviews_terminal "review-changes" "applied" "Changes committed and pushed."
       else
         notify_coderabbit_resolve
-        resolve_actor_outdated_threads "review-changes"
         if has_tier1_blockers; then
           echo "::warning::Tier-1 blockers still present (failing CI or CHANGES_REQUESTED reviews) — skipping no-changes marker to allow retries"
         else
           post_reviews_terminal "review-changes" "no-changes" "No changes were needed for this PR."
         fi
       fi
+      resolve_actor_outdated_threads "review-changes"
       try_enable_auto_merge
     fi
     exit "$rc"