feat: implement issue #1115 — [bug] dismiss-stale-bot-reviews is missing from this repo — a stale bot CHANGES_REQUESTED blocks PRs forever (blocking #1094)

.github/workflows/dismiss-stale-bot-reviews-tests.yml

@@ -0,0 +1,71 @@
+# Quality gate for the dismiss-stale-bot-reviews decision core (#1115).
+#
+# Triggered on any PR that touches:
+#   - scripts/dismiss-stale-bot-reviews.sh            (orchestrator glue)
+#   - scripts/lib/dismiss-stale-bot-reviews.sh        (pure decision core)
+#   - test/workflows/dismiss-stale-bot-reviews/**     (the tests themselves)
+#   - .github/workflows/dismiss-stale-bot-reviews*.yml
+#   - standards/workflows/dismiss-stale-bot-reviews.yml
+#
+# Gate: bats — the decision matrix (dismiss an allow-listed bot's
+#       CHANGES_REQUESTED on a superseded commit; keep it on the current head;
+#       never touch human or non-allow-listed reviews).
+
+name: Dismiss Stale Bot Reviews Tests
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/dismiss-stale-bot-reviews.sh'
+      - 'scripts/lib/dismiss-stale-bot-reviews.sh'
+      - 'test/workflows/dismiss-stale-bot-reviews/**'
+      - '.github/workflows/dismiss-stale-bot-reviews*.yml'
+      - 'standards/workflows/dismiss-stale-bot-reviews.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'scripts/dismiss-stale-bot-reviews.sh'
+      - 'scripts/lib/dismiss-stale-bot-reviews.sh'
+      - 'test/workflows/dismiss-stale-bot-reviews/**'
+      - '.github/workflows/dismiss-stale-bot-reviews*.yml'
+      - 'standards/workflows/dismiss-stale-bot-reviews.yml'
+
+permissions: {}
+
+concurrency:
+  group: dismiss-stale-bot-reviews-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: bats
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Install bats and jq
+        run: |
+          set -euo pipefail
+          max_retries=3
+          for attempt in $(seq 1 "$max_retries"); do
+            if sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends bats jq; then
+              exit 0
+            fi
+            if [ "$attempt" -lt "$max_retries" ]; then
+              backoff=$((2 ** (attempt - 1)))
+              echo "::warning::apt failed (attempt $attempt/$max_retries); retrying in ${backoff}s…" >&2
+              sleep "$backoff"
+            fi
+          done
+          exit 1
+
+      - name: Run bats suite
+        run: bats --print-output-on-failure test/workflows/dismiss-stale-bot-reviews/

.github/workflows/dismiss-stale-bot-reviews.yml

@@ -0,0 +1,100 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# SOURCE OF TRUTH: combsmith/.github/standards/workflows/dismiss-stale-bot-reviews.yml
+# Standard:        combsmith/.github/standards/ci-standards.md
+# Decision core:   combsmith/.github/scripts/lib/dismiss-stale-bot-reviews.sh
+#                  combsmith/.github/scripts/dismiss-stale-bot-reviews.sh
+#
+# AGENTS — READ BEFORE EDITING:
+#   • This file is a SELF-CONTAINED verbatim stub (the initiative-driver class),
+#     NOT a thin caller for a reusable. A bot's CHANGES_REQUESTED review is NOT
+#     cleared by GitHub's dismiss_stale_reviews_on_push (that only dismisses stale
+#     *approvals*), so it persists on a superseded commit and blocks reviewDecision
+#     forever (#617 blocker 3). This workflow dismisses such reviews once a NEWER
+#     commit has been pushed.
+#   • All dismiss/keep decision logic lives in the decision core above, which is
+#     unit-tested by bats in combsmith/.github. This stub fetches that core
+#     from combsmith/.github@v1 at runtime and runs it — the same runtime
+#     tooling-checkout pattern initiative-driver uses for the rate-limit gate.
+#   • You MUST NOT change: the trigger event types (synchronize + submitted), the
+#     fork guard, or the job-level `permissions:` block (pull-requests: write is
+#     required to dismiss a review; removing it breaks the dismissal).
+#   • BOT-ONLY by design: human reviews are never dismissed. To change the bot
+#     allow-list, set the DSBR_BOT_ALLOWLIST repo/org variable (comma-separated
+#     logins) — it REPLACES the default list. Do not fork the decision logic here.
+#   • If you need different behaviour, open a PR against the decision core in
+#     combsmith/.github — the change propagates everywhere on next run.
+# ─────────────────────────────────────────────────────────────────────────────
+#
+# Dismiss stale bot reviews — self-contained org-standard workflow.
+# To adopt: copy this file verbatim to .github/workflows/dismiss-stale-bot-reviews.yml.
+# No secrets required — uses GITHUB_TOKEN only (pull-requests: write).
+name: Dismiss stale bot reviews
+
+on:
+  # A new push advances the head; a bot's CHANGES_REQUESTED now sits on a
+  # superseded commit and must be cleared.
+  pull_request:
+    types: [synchronize]
+  # A bot may also submit a review on an already-superseded commit (race); the
+  # decision core keeps it only when it is on the current head.
+  pull_request_review:
+    types: [submitted]
+
+permissions: {}
+
+concurrency:
+  # One lane per PR so a push burst does not fan out duplicate dismissals; the
+  # latest head wins.
+  group: dismiss-stale-bot-reviews-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dismiss:
+    # Same-repo PRs only: a fork PR's GITHUB_TOKEN is read-only, so the dismissal
+    # mutation would fail. Forked-PR stale reviews are left for human handling.
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write   # dismissPullRequestReview via GITHUB_TOKEN
+      contents: read         # checkout
+    steps:
+      - name: Checkout decision-core tooling from combsmith/.github
+        # The decision core lives in combsmith/.github; a consumer repo does
+        # not carry it, so fetch it read-only at the pinned v1 tag into a scratch
+        # path. combsmith/.github is public, so GITHUB_TOKEN suffices.
+        # continue-on-error: a tooling-checkout outage must never fail the PR — the
+        # run step then finds no script and no-ops (fail-closed: nothing dismissed).
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: combsmith/.github
+          ref: v1
+          path: .dsbr-tooling
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Dismiss stale allow-listed bot reviews on superseded commits
+        env:
+          GH_TOKEN: ${{ github.token }}
+          # Optional wholesale override of the bot allow-list (comma-separated
+          # logins). Unset → the decision core's built-in CodeRabbit/Copilot list.
+          DSBR_BOT_ALLOWLIST: ${{ vars.DSBR_BOT_ALLOWLIST }}
+          # Optional dry-run mode (set to "true" to preview without dismissing).
+          DSBR_DRY_RUN: ${{ vars.DSBR_DRY_RUN }}
+        run: |
+          set -euo pipefail
+          core=".dsbr-tooling/scripts/dismiss-stale-bot-reviews.sh"
+          if [ ! -f "$core" ]; then
+            echo "::warning::decision-core tooling unavailable (checkout failed); skipping — nothing dismissed"
+            exit 0
+          fi
+          args=(
+            --owner "${{ github.repository_owner }}"
+            --name "${{ github.event.repository.name }}"
+            --pr "${{ github.event.pull_request.number }}"
+          )
+          if [ "$DSBR_DRY_RUN" != "true" ]; then
+            args+=(--apply)
+          fi
+          bash "$core" "${args[@]}"

scripts/deploy-standard-workflows.sh

@@ -2,7 +2,7 @@
 # deploy-standard-workflows.sh — Deploy org-standard workflow stubs to all repos.
 #
 # Reads canonical stubs from standards/workflows/ and deploys them into every
-# repo in the petry-projects org by opening a pull request per repo (via the
+# repo in the combsmith org by opening a pull request per repo (via the
 # shared scripts/lib/standards-deploy.sh primitive). Only workflows that have a
 # template in standards/workflows/ AND appear in the DEPLOYABLE_WORKFLOWS list
 # below are eligible — tech-stack-specific workflows (ci.yml, sonarcloud.yml)
@@ -14,7 +14,7 @@
 # succeed. Opening a PR works uniformly on protected and unprotected repos and
 # leaves an auditable, CI-gated record. The PRs are labeled `standards-sync` and
 # left for the normal review/auto-merge pipeline — this script never merges and
-# never uses --admin. See petry-projects/.github#478.
+# never uses --admin. See combsmith/.github#478.
 #
 # Usage:
 #   deploy-standard-workflows.sh [options]
@@ -54,7 +54,7 @@ trap 'rm -f "${_TMPFILES[@]+"${_TMPFILES[@]}"}"' EXIT
 # ---------------------------------------------------------------------------
 # Configuration
 # ---------------------------------------------------------------------------
-ORG="petry-projects"
+ORG="combsmith"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 STANDARDS_DIR="$REPO_ROOT/standards/workflows"
 
@@ -134,6 +134,7 @@ DEPLOYABLE_WORKFLOWS=(
   initiative-driver.yml
   pr-auto-review.yml
   feature-ideation.yml
+  dismiss-stale-bot-reviews.yml
 )
 
 # Deployable workflows whose stub BODY carries a documented per-repo edit the
@@ -379,6 +380,23 @@ is_pin_compliant() {
   fi
 
   local prefix="${expected_uses%@*}" ref_after="${expected_uses##*@}" base
+  # Distinguish a reusable-WORKFLOW call from a third-party ACTION step. A thin
+  # caller stub's first `uses:` targets a reusable workflow — `owner/repo/.github/
+  # workflows/<name>.yml@<ref>` (prefix ends in `.yml`) — and that pin IS the
+  # compliance signal. A SELF-CONTAINED verbatim stub (initiative-driver class,
+  # e.g. dismiss-stale-bot-reviews.yml, #1115) has NO reusable call; its first
+  # `uses:` is an action step like `actions/checkout@<sha>` (prefix does NOT end
+  # in `.yml`). Matching only on that checkout SHA would declare the stub
+  # compliant even after its triggers, permissions, or run step drift from the
+  # template, so later non-checkout template fixes would never propagate (#1116).
+  # Treat such a stub exactly like the no-uses verbatim case above: full-content
+  # compare (CRLF-normalized).
+  if [[ "$prefix" != *.yml ]]; then
+    local template_content normalized_existing
+    template_content=$(tr -d '\r' < "$template")
+    normalized_existing=$(printf '%s' "$existing_content" | tr -d '\r')
+    [[ "$normalized_existing" == "$template_content" ]] && return 0 || return 1
+  fi
   if [[ "$prefix" =~ /([a-z0-9-]+)-reusable\.yml$ ]]; then
     base="${BASH_REMATCH[1]}"
     # Only treat it as ring-managed if the reusable is on the ring model AND the
@@ -432,7 +450,7 @@ reusable_base_of() {
 }
 
 # reusable_host_of <template> -> the org/repo that HOSTS the reusable (and thus
-# carries its release tags), e.g. `petry-projects/.github-private` for dev-lead.
+# carries its release tags), e.g. `combsmith/.github-private` for dev-lead.
 reusable_host_of() {
   local prefix; prefix="$(reusable_uses_of "$1")"; prefix="${prefix%@*}"
   cut -d/ -f1-2 <<< "$prefix"