ci: re-register agent review workflow

.github/workflows/agent-pr-review-gate-v2.yml

@@ -0,0 +1,60 @@
+name: Agent PR review gate v2
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review, edited]
+  pull_request_review:
+    types: [submitted, dismissed]
+  pull_request_review_comment:
+    types: [created, edited, deleted]
+  # Greptile updates one PR summary comment when it re-reviews a new head.
+  # GitHub cannot filter issue_comment by author at trigger time; the job below
+  # skips unrelated comment providers before checkout/evaluation.
+  issue_comment:
+    types: [created, edited, deleted]
+
+permissions:
+  checks: read
+  contents: read
+  issues: write
+  pull-requests: read
+
+# Keep this workflow free of cross-event cancellation. Unrelated issue-comment
+# jobs are skipped below before checkout; head events and Greptile review-state
+# events must never cancel one another.
+jobs:
+  agent-pr-review-complete:
+    name: agent-pr-review-complete
+    if: ${{ github.event_name != 'issue_comment' || (github.event.issue.pull_request != null && github.actor == 'greptile-apps[bot]') }}
+    runs-on: ${{ vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
+    steps:
+      # Execute the checker from the exact trusted commit that defines this workflow.
+      # A stacked PR base branch can be author-controlled, so it never supplies
+      # executable gate code to pull_request_target. No PR files are executed.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.workflow_sha }}
+          persist-credentials: false
+      - name: Bootstrap trusted checker
+        if: hashFiles('.github/scripts/agent-pr-review-gate.py') == ''
+        run: >-
+          echo 'agent-pr-review-complete: PASS (checker is introduced by this PR and will enforce from the next PR onward)'
+      - name: Request Greptile review for this head
+        if: github.event_name == 'pull_request_target' && hashFiles('.github/scripts/agent-pr-review-gate.py') != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_EVENT_PATH: ${{ github.event_path }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: python3 .github/scripts/agent-pr-review-gate.py --request-greptile
+      - name: Evaluate current-head review obligations
+        if: hashFiles('.github/scripts/agent-pr-review-gate.py') != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_EVENT_PATH: ${{ github.event_path }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          REVIEW_BOTS: ${{ vars.AGENT_REVIEW_BOTS || 'coderabbitai,greptile-apps' }}
+          AGENT_REVIEW_REPLY_ACTORS: ${{ vars.AGENT_REVIEW_REPLY_ACTORS || github.event.pull_request.user.login }}
+          REQUIRED_REVIEW_COVERAGE_BOTS: ${{ vars.AGENT_REQUIRED_REVIEW_COVERAGE_BOTS || 'greptile-apps' }}
+          REQUIRE_BOT_REVIEW_COVERAGE: ${{ vars.REQUIRE_BOT_REVIEW_COVERAGE || '0' }}
+          REVIEW_ATTENTION_LABEL: "${{ vars.AGENT_REVIEW_ATTENTION_LABEL || 'review: needs-attention' }}"
+        run: python3 .github/scripts/agent-pr-review-gate.py --sync-label

.github/workflows/agent-pr-review-gate.yml

@@ -25,7 +25,7 @@ permissions:
 jobs:
   agent-pr-review-complete:
     name: agent-pr-review-complete
-    if: ${{ github.event_name != 'issue_comment' || (github.event.issue.pull_request != null && startsWith(github.actor, 'greptile-apps')) }}
+    if: ${{ github.event_name != 'issue_comment' || (github.event.issue.pull_request != null && github.actor == 'greptile-apps[bot]') }}
     runs-on: ${{ vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
     steps:
       # Execute the checker from the exact trusted commit that defines this workflow.

tests/test_agent_pr_review_gate.py

@@ -105,7 +105,10 @@ def test_greptile_current_head_coverage_can_be_required_independently(self):
 
     def test_greptile_auto_review_contract_is_wired_to_the_gate(self):
         root = Path(__file__).parents[1]
-        workflow = (root / ".github/workflows/agent-pr-review-gate.yml").read_text(encoding="utf-8")
+        workflow_path = root / ".github/workflows/agent-pr-review-gate-v2.yml"
+        self.assertTrue(workflow_path.exists())
+        self.assertTrue((root / ".github/workflows/agent-pr-review-gate.yml").exists())
+        workflow = workflow_path.read_text(encoding="utf-8")
         self.assertIn("pull_request_review:", workflow)
         self.assertIn("issue_comment:", workflow)
         self.assertNotIn("concurrency:", workflow)