[Fix] Fork PR review state stays stale after automated review

[zoomote]

​Created by Roomote. View the task or mention @roomote for follow-up asks.

Related GitHub Issue

Follow-up to the review-state behavior observed on #1066, with supporting command-history evidence from #1293.

Description

Fork pull-request review events have a read-only token, so the workflow could recognize a fresh automated change request but leave stale review-state labels until hourly reconciliation. A narrowly filtered coderabbitai[bot] status-comment event now provides prompt base-context reconciliation. Contributor-authored comments are rejected both by the job condition and inside the metadata-only script.

CodeRabbit configuration now prevents non-organization members from directing comment chat, restricts failed pre-merge-check overrides to requested reviewers, and disables automatic review pausing. The pause setting avoids requiring outside contributors to use unavailable review or resume commands. The tradeoff is additional review-capacity use on eligible incremental updates; this repository limits that exposure by opting reviews in only with the workflow-managed coderabbit-review-active label after required CI passes.

Contributor guidance now consistently describes the sequence as required CI, automated review completion for the current head, then fresh human maintainer or CODEOWNER approval. Automated approval is treated only as a review-completion signal and never as a substitute for native human approval or branch protection.

Test Procedure

1. Run pnpm --dir src exec vitest run services/__tests__/pr-review-state-workflow.test.ts.
2. Validate .coderabbit.yaml against https://coderabbit.ai/integrations/schema.v2.json.
3. Run pnpm test, then pnpm lint, then pnpm check-types sequentially.
4. Confirm the focused cases cover fork PRs, trusted and contributor comment events, fresh automated and human review ordering, new-head invalidation, state-specific guidance, and metadata-only permissions.

Pre-Submission Checklist

• Issue Linked: The source PRs that exposed the workflow and messaging risks are linked above.
• Scope: Changes are limited to CodeRabbit configuration, review-state reconciliation, contributor guidance, and focused tests.
• Self-Review: The final diff was reviewed for reviewer-semantic regressions, fork trust, and unnecessary permissions.
• Testing: Focused and full repository checks cover the changed behavior.
• Visual Snapshot (UI changes only): Not applicable; this changes GitHub workflow/configuration and Markdown guidance only.
• Documentation Impact: CONTRIBUTING.md and the managed PR guidance now describe the actual review sequence and access model.
• Contribution Guidelines: Repository guidance was reviewed and followed.

Visual Snapshots

Not applicable. There is no browser-rendered product surface for this workflow/configuration change.

Videos (interaction / animation only)

Not applicable.

Documentation Updates

CONTRIBUTING.md now states that automated review does not replace fresh human maintainer/CODEOWNER approval, outside contributors cannot direct CodeRabbit through comments, and maintainers own exceptional review restarts.

Additional Notes

• Official configuration schema: https://coderabbit.ai/integrations/schema.v2.json
• Configuration reference: https://docs.coderabbit.ai/reference/configuration
• Automatic review controls and the review-capacity tradeoff for auto_pause_after_reviewed_commits: 0: https://docs.coderabbit.ai/configuration/auto-review
• Reviewer-only pre-merge overrides: https://docs.coderabbit.ai/pr-reviews/pre-merge-checks
• On feat(api): abort signal support for anthropic, anthropic-vertex, xai, minimax #1293, a contributor-issued @coderabbitai approve resolved automated comments but did not satisfy native human review: a maintainer subsequently requested changes, and branch protection continued to require human/CODEOWNER approval.

Get in Touch

Mention @roomote on the PR for follow-up investigation or changes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Review process

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

1. Required CI checks pass.
2. The workflow starts CodeRabbit automatically.
3. For eligible human-authored PRs, CodeRabbit reviews and approves the latest commit.
4. A human maintainer reviews and approves after CodeRabbit.

Current step: The required review sequence passed. Remaining merge requirements apply.

[zoomote]

Expanded the draft in commit f88c242c3: restricted non-org CodeRabbit chat and pre-merge overrides, disabled auto-pause, kept privileged reconciliation metadata-only and least-privilege, replaced contributor command prompts with automatic/maintainer-owned actions, clarified automated review versus required human approval, and added focused coverage. The live official CodeRabbit schema, focused tests, full tests, lint, and type checks all pass; the PR title/body now document the capacity tradeoff and PR #1293 evidence without implying branch-protection bypass.