feat(attestation): expand PR reviewers with requested status and review state

[javirln]

Add Requested and ReviewStatus fields to prinfo.Reviewer to track which reviewers were explicitly requested vs who submitted reviews. For GitHub PRs, merge requested reviewer lists from both event payload and API endpoint, then overlay review states from /reviews API. For GitLab, mark all API-retrieved reviewers as requested. Bump PR info schema to v1.2.

[cubic-dev-ai]

2 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/schemavalidators/internal_schemas/prinfo/pr-info-1.2.schema.json">

<violation number="1" location="internal/schemavalidators/internal_schemas/prinfo/pr-info-1.2.schema.json:84">
P2: Require `reviewers[].requested` in the schema so reviewer request state is explicit (true/false) rather than omitted.

(Based on your team's feedback about preferring explicit states over omission/nil.) [FEEDBACK_USED]</violation>
</file>

<file name="pkg/attestation/crafter/prmetadata.go">

<violation number="1" location="pkg/attestation/crafter/prmetadata.go:266">
P1: `fetchGitHubReviews` only reads the first paginated response from GitHub, so reviewer states can be stale/incomplete on PRs with many review events.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: fetchGitHubReviews only reads the first paginated response from GitHub, so reviewer states can be stale/incomplete on PRs with many review events.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/attestation/crafter/prmetadata.go, line 266:

<comment>`fetchGitHubReviews` only reads the first paginated response from GitHub, so reviewer states can be stale/incomplete on PRs with many review events.</comment>

<file context>
@@ -146,6 +184,142 @@ func extractGitHubPRMetadata(envVars map[string]string) (bool, *PRMetadata, erro
+		return nil
+	}
+
+	apiURL := fmt.Sprintf("%s/repos/%s/%s/pulls/%s/reviews", baseURL, owner, repo, prNumber)
+
+	client := &http.Client{Timeout: 10 * time.Second}
</file context>

[cubic-dev-ai]

P2: Require reviewers[].requested in the schema so reviewer request state is explicit (true/false) rather than omitted.

(Based on your team's feedback about preferring explicit states over omission/nil.)

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/schemavalidators/internal_schemas/prinfo/pr-info-1.2.schema.json, line 84:

<comment>Require `reviewers[].requested` in the schema so reviewer request state is explicit (true/false) rather than omitted.

(Based on your team's feedback about preferring explicit states over omission/nil.) </comment>

<file context>
@@ -0,0 +1,103 @@
+        },
+        "additionalProperties": false,
+        "type": "object",
+        "required": [
+          "login",
+          "type"
</file context>