fix: remove worst-wins escalation logic #31

Merged

rodin merged 4 commits from fix/28-remove-escalation into main 2026-05-02 16:46:06 +00:00

Conversation 12 Commits 4 Files Changed 3

+157 -182

4 Commits

Author	SHA1	Message	Date
Rodin	ceefa4c2e0	ci: use separate SECURITY_REVIEW_TOKEN for security reviewer ... The security-review-bot Gitea user now has its own token. This completes the token separation so each reviewer role posts under its own identity, enabling native Gitea multi-reviewer blocking.	2026-05-02 07:25:43 -07:00
Rodin	b1f5dd4b5f	fix: skip update-in-place when shared token detected ... When hasSharedToken() detects two roles sharing the same Gitea user, the bot now skips ALL update logic (PATCH, supersede) and always POSTs a fresh review. This prevents clobbering a sibling's review body or state when misconfigured. Tests now assert return values (true/false) rather than just verifying no panic. Added additional test case for three-roles-same-user scenario. Addresses review feedback: update logic and review state must not interact with sibling reviews under the same user.	2026-05-02 07:21:46 -07:00
Rodin	fd179b891b	fix: detect shared-token misconfiguration and warn ... When two review-bot roles share the same Gitea user token (misconfiguration), log a WARNING identifying which sibling is sharing. The bot continues normally with its own honest verdict — no escalation, no deadlock. Operators see the warning in CI logs and can fix the token setup. Addresses Aaron's review feedback on #28: graceful degradation when someone doesn't follow the separate-token deployment instructions.	2026-05-02 07:11:57 -07:00
Rodin	b78d9972ac	fix: remove worst-wins escalation logic (#28)	2026-05-02 07:04:33 -07:00