From a747c48904e4ec48ca4bb04dca61c2211ef8cba8 Mon Sep 17 00:00:00 2001 From: GitHub CI Date: Fri, 11 Sep 2026 11:06:09 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20fix=20pr=5Freviewer.repos=20semantics?= =?UTF-8?q?=20=E2=80=94=20empty=20means=20allow-all,=20not=20allow-none?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bundle.yaml comment and README both said "empty until the operator names them," implying an empty repos list blocks review everywhere. The actual gate (pr-reviewer-plugin dispatch.py, documented there since qaEngineer#38) has always treated empty as "whatever the GitHub App installation covers" — GitHub's own install picker is the real gate, repos only narrows it further. Filed as pr-reviewer-plugin#115 assuming it was a plugin bug; it isn't, closed not-planned. The actual drift was qaEngineer#38's "qaEngineer should stay excluded" call, which the live config no longer reflects (repos is globally empty) — confirmed with the operator this is now the intended state: Vera reviewing config/doc changes to her own deploy repo is useful, and her approval is what satisfies qaEngineer's branch-protection gate, since GitHub blocks a human PR author from self-approving. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01M1eVZNokjz3vjPaGqrC3RP --- README.md | 9 +++++++-- protoagent.bundle.yaml | 9 ++++++--- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index b1197a4..ae3b493 100644 --- a/README.md +++ b/README.md @@ -144,8 +144,13 @@ finders with a Gap noted; it never fails the review. ### 4. Config -Set `pr_reviewer.repos` (the managed allowlist — the gate runs *before* any GitHub call, -so an unlisted repo never triggers a lookup on your credentials) and `github.write: true`. +Set `github.write: true`. `pr_reviewer.repos` is optional: **empty means review any repo +the GitHub App installation covers** — installing the App on a repo is already an +explicit, revocable, audited grant, so an empty list isn't "review nothing," it's +"GitHub's installation picker is the only gate" (pr-reviewer-plugin#115). Set `repos` +only when you want to review a *subset* of the installed repos; when set, it's checked +*before* any GitHub call, so an unlisted repo never triggers a lookup on your +credentials. Everything operator-tunable reads **config first, env as fallback**, and resolves **live** — editing `repos` or flipping a kill switch takes effect without a restart. See the diff --git a/protoagent.bundle.yaml b/protoagent.bundle.yaml index 742ed21..0c1f632 100644 --- a/protoagent.bundle.yaml +++ b/protoagent.bundle.yaml @@ -45,9 +45,12 @@ config: default_repo: "" repos: [] # The reviewer machinery (ADR 0078 Phase C). SHADOW by default: every verdict is a - # COMMENT review. repos = the managed allowlist (webhook + sweep scope) — empty - # until the operator names them. webhook_secret is a SECRET (set via Settings; it - # lands in the untracked secrets.yaml overlay). + # COMMENT review. repos = an OPTIONAL narrowing allowlist (webhook + sweep scope) — + # EMPTY means "whatever the GitHub App installation covers", not "review nothing". + # GitHub's own installation repo-picker is the real gate; set `repos` only to + # restrict review to a subset of the installed repos (pr-reviewer-plugin#115). + # webhook_secret is a SECRET (set via Settings; it lands in the untracked + # secrets.yaml overlay). pr_reviewer: repos: [] shadow_mode: true