Skip to content

fix(queue): queue all issue-linked PR regates - #3989

Merged
JSONbored merged 2 commits into
mainfrom
codex/propose-a-fix-for-vulnerability-in-gittensory
Jul 7, 2026
Merged

fix(queue): queue all issue-linked PR regates#3989
JSONbored merged 2 commits into
mainfrom
codex/propose-a-fix-for-vulnerability-in-gittensory

Conversation

@JSONbored

@JSONbored JSONbored commented Jul 7, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The issue-side wake path previously truncated linked-PR fanout with .slice(0, SWEEP_MAX_PRS), leaving PRs beyond the cap un-queued and susceptible to stale public gate/check state after issue label/assignment changes.
  • This produced a correctness/security regression where some linked PRs could continue to show passing gate state until the slower periodic sweep reached them.

No issue: found and fixed as part of a broader review-stack reliability sweep; a self-contained follow-up didn't seem worth its own tracking issue.

Description

  • Removed the slice(0, SWEEP_MAX_PRS) truncation in maybeReReviewOnLinkedIssueChange so every open PR that links the affected issue is enqueued for re-gating instead of dropping the tail (file: src/queue/processors.ts).
  • Preserved asynchronous, staggered enqueue semantics by keeping the per-PR delaySeconds send logic so the webhook does not perform expensive inline reviews (env.JOBS.send usage retained).
  • Updated the regression test in test/unit/queue.test.ts to seed SWEEP_MAX_PRS + 2 linked PRs and assert that all linked PRs are enqueued and that no inline GitHub fetch occurs (fetchCount remains zero).

Follow-up (review feedback)

The initial version of this PR removed the fan-out cap entirely, which the Gittensory review correctly flagged as reintroducing the unbounded-REST-fan-out risk SWEEP_MAX_PRS exists to prevent (a popular/tracking issue linked from hundreds of PRs could enqueue that many staggered ~9-REST-GET re-gates from one webhook). Added ISSUE_WAKE_MAX_PRS (src/settings/agent-sweep.ts): a separate, larger one-shot budget for this handler, since it fires once per issue event rather than recurring every ~2 minutes like the periodic sweep SWEEP_MAX_PRS is sized for. A new regression test proves the cap actually bounds a large fan-out.

Testing

  • npm run typecheck — clean
  • npx vitest run test/unit/queue.test.ts — 672/672 passed

@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@loopover-orb loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 7, 2026
@loopover-orb

loopover-orb Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

Review updated: 2026-07-07 12:45:44 UTC

3 files · 2 blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

  • No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
  • Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Concerns raised — review before merging

  • No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
  • Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.
Signal Result Evidence
Code review ❌ 2 blockers No AI review summary
Linked issue ✅ No-issue rationale PR body explains why no issue is linked.
Related work ✅ No active overlap found No same-issue or scoped active PR overlap found.
Change scope ✅ 20/20 Low review scope from cached public metadata (no linked issue context).
Validation posture ✅ 25/25 PR body includes validation/test evidence.
Contributor workload ✅ 10/10 Author activity: 51 registered-repo PR(s), 43 merged, 570 issue(s).
Contributor context ✅ Confirmed Gittensor contributor JSONbored; Gittensor profile; 51 PR(s), 570 issue(s).
Gate result ❌ Blocking Repo-configured hard blocker found.
Review context
  • Author: JSONbored
  • Role context: owner (maintainer lane)
  • Public audience mode: oss maintainer
  • Lane context: Repository is configured for direct PR review.
  • Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
  • Official Gittensor activity: 51 PR(s), 570 issue(s).
  • PR-specific overlap: none found.
Contributor next steps
  • Treat this as maintainer-lane context rather than normal contributor-lane activity.
  • Link the issue being solved, or explicitly explain why this is a no-issue PR.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
  • Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
  • Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed


💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

  • Re-run Gittensory review

@codecov

codecov Bot commented Jul 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.58%. Comparing base (bb7f8ed) to head (56a94bf).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3989   +/-   ##
=======================================
  Coverage   93.58%   93.58%           
=======================================
  Files         382      382           
  Lines       35532    35533    +1     
  Branches    13028    13028           
=======================================
+ Hits        33251    33252    +1     
  Misses       1618     1618           
  Partials      663      663           
Files with missing lines Coverage Δ
src/queue/processors.ts 94.86% <ø> (ø)
src/settings/agent-sweep.ts 100.00% <100.00%> (ø)
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

JSONbored added 2 commits July 7, 2026 05:33
Removing the SWEEP_MAX_PRS cap entirely reintroduced the unbounded REST-fan-out
risk that constant exists to prevent (a popular/tracking issue linked from
hundreds of PRs would enqueue that many staggered ~9-REST-GET re-gates from one
webhook). Introduces ISSUE_WAKE_MAX_PRS: a separate, larger one-shot budget for
this handler, since it fires once per issue event rather than recurring every
~2 minutes like the periodic sweep SWEEP_MAX_PRS is sized for.
@JSONbored
JSONbored force-pushed the codex/propose-a-fix-for-vulnerability-in-gittensory branch from aec5e56 to 56a94bf Compare July 7, 2026 12:37
@JSONbored
JSONbored merged commit 2b6b3d8 into main Jul 7, 2026
10 checks passed
@JSONbored
JSONbored deleted the codex/propose-a-fix-for-vulnerability-in-gittensory branch July 7, 2026 12:48
JSONbored added a commit that referenced this pull request Jul 7, 2026
…ue findings (#4064)

The "Linked issue" review-panel signal row already recognizes
hasClearNoIssueRationale(pr) and shows a passing "no-issue rationale" state
when a PR body has one, but 3 separate finding-generation sites never checked
it, so they kept emitting missing-linked-issue findings anyway:

- buildPreflightResult's missing_linked_issue (pre-flight/planning path)
- buildPullRequestMaintainerPacket's missing_linked_issue (PR-review path)
- buildFocusManifestGuidance's manifest_linked_issue_required (maintainer
  focus-manifest policy), now accepting a caller-computed hasNoIssueRationale
  since this function has no PR title/body of its own

Discovered live on PR #3989 (JSONbored/gittensory): its body had a valid
"No issue: ..." rationale, the Linked Issue signal correctly showed it, yet
the panel still counted 2 blockers and repeated "No linked issue detected" in
Suggested Action.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. manual-review Gittensor contributor context

Development

Successfully merging this pull request may close these issues.

1 participant