feat(examples/gitlab): add fail-open category/severity publication controls

[SeonggwanAhn]

Summary

• Port GitHub Action fail-open category/severity publication controls (Add fail-open, non-destructive finding publication controls to the reusable Action #478 / feat(action): add fail-open category/severity publication controls (#478) #529) to the GitLab CI example (examples/gitlab_ci/post_review.py).
• Add [category · severity] badges on inline and summary findings, plus optional OCR_ROUTE_SEVERITY_BELOW / OCR_ROUTE_CATEGORIES routing that moves matching findings to summary notes without dropping them.
• Split destination accounting into inline / no-line fallback / routed / failed, and document the new CI variables in the GitLab example README and workflow comments.

Test plan

• python3 examples/gitlab_ci/post_review_test.py (78 tests)
• Smoke on a GitLab MR with OCR_ROUTE_SEVERITY_BELOW=medium and OCR_ROUTE_CATEGORIES=style,documentation,test
• Confirm security/high findings still land as inline discussions with suggestion:-0+0
• Confirm routed findings appear in a summary note with Routed to summary… reason and Before/After details

Made with Cursor

[CLAassistant]

All committers have signed the CLA.

[github-actions]

✅ OpenCodeReview: Review complete: 0 finding(s) across 2 selected item(s).

[lizhengfeng101]

Review

Nice port — the fail-open design is solid and tests are thorough (78 cases covers the surface well).

A few things I noticed:

sanitize_metadata gap in route_comment

build_badge runs values through sanitize_metadata (strips control chars), but route_comment just does .strip().lower() on the raw value. So if an LLM spits out "bu\ng" as a category, the badge renders [bug · high] but routing won't match it against CATEGORIES — it stays inline silently.

Fail-open means nothing gets dropped, so it's safe, but it's confusing: the badge says "bug" while routing doesn't recognize it as one. Probably worth running sanitize_metadata in route_comment too:

cat_raw = sanitize_metadata(comment.get("category") if comment else None).strip().lower()
sev_raw = sanitize_metadata(comment.get("severity") if comment else None).strip().lower()

Multiple notes per MR could get noisy

When a review has all three flavors (no-line, routed, failed), you'll post 4 separate notes plus inline comments. On a busy MR that's a lot of bot noise. Might be worth collapsing no-line + routed + failed into one note with section headers. Not a blocker, just something to think about for UX.

Minor

• Removing the unused start_line assignment from the loop — good cleanup, confirmed it was never passed to the discussion payload.
• Two test_badge_prefix methods exist across different test classes. Not a conflict in Python but easy to confuse when grepping test names.

Overall LGTM with the sanitize fix as the one actionable item.

[lizhengfeng101]

LGTM

[SeonggwanAhn]

Addressed the sanitize_metadata feedback in route_comment (87f1727) — PTAL.