ci(github-action): update action misospace/pr-reviewer-action (v2.2.1 → v2.3.0)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
misospace/pr-reviewer-action	action	minor	v2.2.1 → v2.3.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

misospace/pr-reviewer-action (misospace/pr-reviewer-action)

v2.3.0

Compare Source

Features

• carry_forward: let a maintainer dismiss a carried finding (#​534) (#​535) (623ec46)

Bug Fixes

• classifier: stop matching bare route.<ext> in public_route_changes (#​532) (e106089), closes #​531
• tools: preserve standards evidence (#​542) (d2412dc)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation

Approve. This is a routine Renovate-generated dependency bump that pins misospace/pr-reviewer-action from v2.2.1 (SHA 54dfb1aa…) to v2.3.0 (SHA f089f7c4…) in .github/workflows/ai-pr-review.yaml. The bump is by SHA, the version comment is updated to match, the upstream v2.3.0 release exists on GitHub and was published 2026-09-03, and CI is fully green. No application logic is modified.

Change-by-change findings

.github/workflows/ai-pr-review.yaml (line 42)

-        uses: misospace/pr-reviewer-action@54dfb1aac20e1e410ad8f71dc3681b888500a1ec # v2.2.1
+        uses: misospace/pr-reviewer-action@f089f7c41375bef3b0e41c277d65e4d104b5641b # v2.3.0

• Pinning model preserved. The action reference continues to be pinned to a full commit SHA, with the human-readable tag as a trailing comment. This matches the existing convention used throughout the repository's workflows (e.g., actions/checkout@3d3c42e5… # v7.0.1, docker/setup-buildx-action@37fe6310… # v4, github/codeql-action/upload-sarif@cdf488f5… # v4). No drift to a tag-only or @main reference.
• Input shape unchanged. The with: block (github_token, ai_primary_retries, etc.) is untouched, so the new action version inherits the same configuration surface that v2.2.1 was running with.
• Trigger and condition unchanged. if: github.event_name == 'pull_request' and the surrounding pull_request / pull_request_labeled triggers remain identical.

Upstream v2.3.0 contents (what this bump brings)

The compare v2.2.1…v2.3.0 shows 5 commits. The release body and changelog list:

• Feature: carry_forward — let a maintainer dismiss a carried finding (PR PR 534 / PR 535, commit 623ec46). New output tool_calls and a README entry for it. The dismiss flow includes hardening: workspace-path containment, missing-actor drop, symmetric category/file scope check, secret redaction on reason/actor, directive-fence hardening, and a documented _MAX_DISMISS_REASON_CHARS = 280.
• Bug fix: classifier — stop matching bare route.<ext> in public_route_changes (PR PR 532 / PR 531, commit e106089). The routes? alternative was changed to routes, so a Next.js App Router repo whose every API handler is route.ts no longer gets every backend PR routed to the smart model. This is directly relevant to this repo (58 route.ts files under src/app/api/ per the upstream commit message, and a similar note already lives in .github/workflows/ai-pr-review.yaml lines 59–60).
• Bug fix: tools — preserve standards evidence (PR PR 542, commit d2412dc). When the planner clips a large standards file, requirement-bearing lines, nearby context, and headings are preserved instead of just the head.

None of these are behavioral-breaking for a workflow that does not opt into the new outputs or routing. The classifier fix is a positive change for this repo.

Standards Compliance

The repository standards file documents the AI review workflow and label conventions, but does not dictate a specific pinning format for third-party GitHub Actions. The pre-PR state already used SHA-pinned references across all actions (see .github/workflows/ci.yaml, image.yaml, helm-lint.yaml, label-sync.yaml, etc.), and this bump keeps that convention. No conflicts with documented standards.

Unknowns or Needs Verification

• The Renovate PR body carries a banner: "Some dependencies could not be looked up. Check the Dependency Dashboard for more information." That warning refers to other Renovate-managed updates tracked in issues/14, not to this specific action bump. The action bump resolves cleanly (the v2.3.0 release is confirmed via the GitHub Compare and Releases API responses in the corpus), so the warning is not a blocker for this PR.
• The 53 line in the diff (uses: misospace/pr-reviewer-action@… # v2.3.0) lives in a job that already ran successfully on commit 5f94a8ac… (the head SHA of this PR), so the bumped action is at minimum exercised against itself in the same CI run — no rollout risk beyond what v2.2.1 already carried.

CI status (authoritative)

All 15 reported checks reached success on the head commit, including review (three runs), Lint, Typecheck, Build, Tests, Docker Build, Database migrations, Database integration, npm audit, and renovate/stability-days. CI did not gate this PR on any policy that the bump violates.