OSAC-3065: fix design review triggering on PRD-only PRs

[eranco74]

Summary

• Remove get_incremental_files which used the GitHub compare API (compare/{before}...{head}) for synchronize events. After a force-push/rebase the two SHAs have different ancestry, causing the compare to return every .md file in the repo — including design.md files from other enhancement directories — which made detect_skills schedule a spurious design review.
• Always use get_changed_files (the PR files endpoint) which reliably returns only the PR's actual diff regardless of rebase history.
• Remove unused EVENT_NAME, EVENT_ACTION, EVENT_BEFORE_SHA env vars from the workflow.

Root cause

Confirmed via workflow logs:

• Bad run (run 29987941334): synchronize event → get_incremental_files returned 46 files across the entire repo → both prd-review and design-review triggered on a PRD-only PR
• Good run (run 30003381899): get_changed_files returned 1 file → only prd-review triggered

Test plan

• Verify PRD-only PRs (e.g., PR OSAC-2644: PRD — BCM Backend Integration for BMaaS #126) no longer receive "AI Design Review" comments
• Verify PRs with both prd.md and design.md still get both reviews
• Verify force-pushed PRs correctly detect only the files in the PR diff

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Pull request reviews now consistently include the full set of changed files, including updates from subsequent pushes.
• Chores / Workflow Updates
  • Streamlined the review workflow configuration to improve reliability by simplifying how review scope parameters are provided.

[openshift-ci-robot]

@eranco74: This pull request references OSAC-3065 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Remove get_incremental_files which used the GitHub compare API (compare/{before}...{head}) for synchronize events. After a force-push/rebase the two SHAs have different ancestry, causing the compare to return every .md file in the repo — including design.md files from other enhancement directories — which made detect_skills schedule a spurious design review.
• Always use get_changed_files (the PR files endpoint) which reliably returns only the PR's actual diff regardless of rebase history.
• Remove unused EVENT_NAME, EVENT_ACTION, EVENT_BEFORE_SHA env vars from the workflow.

Root cause

Confirmed via workflow logs:

• Bad run (run 29987941334): synchronize event → get_incremental_files returned 46 files across the entire repo → both prd-review and design-review triggered on a PRD-only PR
• Good run (run 30003381899): get_changed_files returned 1 file → only prd-review triggered

Test plan

• Verify PRD-only PRs (e.g., PR OSAC-2644: PRD — BCM Backend Integration for BMaaS #126) no longer receive "AI Design Review" comments
• Verify PRs with both prd.md and design.md still get both reviews
• Verify force-pushed PRs correctly detect only the files in the PR diff

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e98000d1-fbde-442c-a892-67ea392e6cbe

📥 Commits

Reviewing files that changed from the base of the PR and between ddd25e6 and 6467790.

📒 Files selected for processing (1)

• .github/scripts/ep_review.py

---

Walkthrough

The EP review script now always retrieves all changed pull-request files instead of using incremental synchronize-event diffs. The workflow passes updated review configuration and pull-request metadata to the script.

Changes

EP review file selection

Layer / File(s)	Summary
Always use full changed files .github/scripts/ep_review.py	Parses filenames directly from the pull-request files endpoint, removes the incremental comparison helper, and always selects files through get_changed_files(pr_number).
Update review workflow inputs .github/workflows/ep-review.yml	Replaces event-based environment variables with EP_REVIEW_SHADOW, PR_NUMBER, and PR_HEAD_SHA.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/enhancement-proposals#103: Modifies the same incremental file-selection logic and workflow environment wiring.

Suggested reviewers: alonakaplan, jhernand

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: preventing design reviews from triggering on PRD-only PRs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets, embedded credentials, or secret-like literals were introduced in the patch; the only change is filename parsing in ep_review.py.
No-Weak-Crypto	✅ Passed	Changed files only adjust EP review file-selection and workflow env vars; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
No-Injection-Vectors	✅ Passed	No unsafe eval/shell, pickle, yaml.load, os.system, or HTML injection patterns in the changed Python/workflow code; subprocess calls use arg lists and fixed jq filters.
Container-Privileges	✅ Passed	No changed container/K8s manifests; the only modified files are a Python script and workflow, and neither sets privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	Only benign status logs appear (PR number, truncated head SHA, generic progress); no passwords, tokens, PII, or internal data are logged.
Ai-Attribution	✅ Passed	HEAD includes Assisted-by: Claude Code; no Co-Authored-By: AI attribution found.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/ep_review.py:
- Line 116: Update get_changed_files, which produces the files value used here,
to request paginated results with --slurp and extract filenames from the
combined JSON document in one pass. Remove the incompatible --jq usage from the
gh api invocation, and ensure the parsed result still returns the changed
filenames for both single-page and multi-page responses.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: abf74fc7-9aa7-4ecc-b39f-5459898c59c5

📥 Commits

Reviewing files that changed from the base of the PR and between 3c0fb4d and ddd25e6.

📒 Files selected for processing (2)

• .github/scripts/ep_review.py
• .github/workflows/ep-review.yml

💤 Files with no reviewable changes (1)

• .github/workflows/ep-review.yml

[tchughesiv]

lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eranco74, tchughesiv

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [eranco74]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment