[Fix] Fork PR review-state labels stay stale until the hourly sweep

[zoomote]

​Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

Related GitHub Issue

Closes #2046

Description

A review on a fork PR runs with a read-only GITHUB_TOKEN. The workflow computes the right label but skips the write, so labels stay stale until the hourly sweep or another trusted event.

This PR implements the fix proposed in the issue:

1. The workflow now lists its own name in workflow_run.workflows. A fork pull_request_review run's completion then re-triggers the workflow with a privileged token that writes the computed labels.
2. The resolve job accepts a workflow_run of this workflow only when github.event.workflow_run.event == 'pull_request_review'. This is the loop guard. A run triggered by workflow_run has event workflow_run, so the next level is filtered out and the chain stops after one hop. The guard sits in both jobs' if conditions and in the resolve script, matching the existing issue_comment defense-in-depth pattern.
3. PR resolution reuses the existing head SHA fallback. Fork runs leave workflow_run.pull_requests empty, and the workflow already resolves those by exact head owner, branch, and SHA.
4. The privileged follow-up takes no artifact input and does not check out code. It reads only PR metadata through the API, so no untrusted PR code or artifacts are touched.

Reviewers should check with care: the guard keys on workflow_run.name == 'Label PR review state'. A workflow rename must update the guard expressions, the script check, and the workflow_run.workflows list together.

Test Procedure

New tests in src/services/__tests__/pr-review-state-workflow.test.ts (describe block fork review self-follow-up (#2046)):

• A fork review run writes nothing; the trusted workflow_run follow-up resolves the PR by exact head and writes the label.
• A self workflow_run triggered by a non-review run (schedule, push, workflow_dispatch, pull_request_target) is ignored.
• The loop guard holds: a self workflow_run with event workflow_run is ignored, so the chain stops after one hop.

The test harness now models workflow_run.name and workflow_run.event in the event payload. Existing workflow_run tests default to a listed CI workflow and stay outside the guard.

Checks run: the targeted Vitest suite (204 tests) passes. ESLint with --prune-suppressions --max-warnings=0 and tsc --noEmit pass on the changed files. The full pnpm test at the repository root passes (13/13 turbo tasks).

Reviewers can repeat this with: pnpm --dir src exec vitest run services/__tests__/pr-review-state-workflow.test.ts.

Pre-Submission Checklist

• Issue Linked: This PR is linked to an approved GitHub Issue (see "Related GitHub Issue" above).
• Scope: My changes are focused on the linked issue (one major feature/fix per PR).
• Self-Review: I reviewed my own code with care.
• Writing Style: The PR title and description use Simplified Technical English (ASD-STE100): short sentences, plain words, active voice, one idea per sentence, no contractions.
• Testing: New and/or updated tests have been added to cover my changes (if applicable).
• Visual Snapshot (UI changes only): Not applicable. This PR changes a GitHub Actions workflow and its tests only; no UI changed.
• Documentation Impact: I checked if my changes need documentation updates (see "Documentation Updates" section below).
• Contribution Guidelines: I read and agree to the Contributor Guidelines.

Visual Snapshots

Not applicable. This PR changes CI workflow behavior only; there is no rendered UI state to snapshot.

Videos (interaction / animation only)

Not applicable. No interaction or animation changed.

Documentation Updates

• No documentation updates are required. This is a GitHub Actions workflow change only; no Zoo Code product functionality changed.

Additional Notes

The alternative from the issue (shortening the sweep interval to 15 minutes) is not implemented. It costs 4 times the API calls against a shared rate-limit pool.

Get in Touch

0x7777777_ on Discord

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: Zoo-Code-Org/Zoo-Code/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1cdb3eb4-2b03-4480-a0ac-906971783963

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Review status

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

Current step: Required CI passed. Waiting for automated review of the latest commit.

If automated review does not start, a maintainer must restart it.

Review-state labels are managed by this workflow; do not edit them manually. community-approved is managed the same way — do not add or remove it manually. It signals a fresh community code approval for the current head as an advisory priority only; maintainer review is still required.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!