feat(attestation): expand PR reviewers with requested status and review state#2895
Merged
Merged
Conversation
…ew state Add Requested and ReviewStatus fields to prinfo.Reviewer to track which reviewers were explicitly requested vs who submitted reviews. For GitHub PRs, merge requested reviewer lists from both event payload and API endpoint, then overlay review states from /reviews API. For GitLab, mark all API-retrieved reviewers as requested. Bump PR info schema to v1.2. Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 9 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="pkg/attestation/crafter/prmetadata.go">
<violation number="1" location="pkg/attestation/crafter/prmetadata.go:266">
P2: `fetchGitHubReviews` only reads the first API page, so reviewer `ReviewStatus` can be incomplete or stale on PRs with more than 30 reviews.</violation>
</file>
<file name="internal/schemavalidators/internal_schemas/prinfo/pr-info-1.2.schema.json">
<violation number="1" location="internal/schemavalidators/internal_schemas/prinfo/pr-info-1.2.schema.json:84">
P2: Make `requested` required in each reviewer object so requested-state is explicit instead of ambiguous when omitted.
(Based on your team's feedback about preferring explicit states over opaque nils/omissions.) [FEEDBACK_USED]</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
…d required in schema 1.2 Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
jiparis
reviewed
Mar 20, 2026
| }) | ||
| } | ||
|
|
||
| for _, r := range fetchGitHubRequestedReviewers(ctx, githubAPIBase, owner, repo, prNumber, token) { |
Member
There was a problem hiding this comment.
Aren't these the ones the ones gathered from event.PullRequest a few lines above? Is there a possibility that they don't match?
Member
Author
There was a problem hiding this comment.
I found yesterday a case where the event didn't have all reviewers, I added an User and the API had it and since we are asking for the actual reviewers I don't it harms to do another API request
Member
|
Thanks @javirln. I've left some comments. |
Member
Author
Checking them Jose, thanks! |
- Use GITHUB_REPOSITORY_OWNER env var directly for owner instead of splitting GITHUB_REPOSITORY; remove now-unused splitOwnerRepo helper - Add comment clarifying why both event payload and API are used as sources for requested reviewers (event is a snapshot, API is current) - Decode requested_reviewers API response directly into []prinfo.Reviewer instead of an equivalent anonymous struct Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
jiparis
approved these changes
Mar 21, 2026
migmartri
approved these changes
Mar 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add Requested and ReviewStatus fields to track which reviewers were explicitly requested versus who actually submitted reviews. For GitHub PRs, merge requested reviewer lists from both event payload and /requested_reviewers API endpoint, then overlay review states from /reviews API. For GitLab, mark API reviewers as requested. Introduces PR info schema v1.2.