chore: auto-approve issue-free PRs and add product labels in Qodo#12457
Merged
Conversation
Enable Qodo Merge auto-approval when the review finds no suggestions, and add three custom labels (product: pnpm, product: pacquet, product: pnpr) assigned by the describe tool based on which stack the diff touches.
Code Review by Qodo
1. Bot auto-approves PRs
|
PR Summary by QodoEnable Qodo auto-approval for issue-free reviews and add product labels WalkthroughsDescription• Enable Qodo auto-approval when reviews return zero suggestions. • Configure /agentic_describe to apply and publish product-scoped PR labels. • Define three custom product labels to route changes by stack ownership. Diagramgraph TD
PR{{"GitHub PR"}} --> CFG[".pr_agent.toml"] --> QODO["Qodo Merge"] --> DESC["/agentic_describe"] --> LABELS["Product labels"]
QODO --> REVIEW["PR reviewer"] --> PR
High-Level AssessmentThe following are alternative approaches to this PR: 1. Gate auto-approval behind required status checks
2. Restrict auto-approval to a subset of PRs (e.g., docs/chore)
3. Label-only rollout first, then enable auto-approval later
Recommendation: The PR’s approach is reasonable for teams that already trust Qodo’s review signal, but consider pairing auto-approval with branch protection (required status checks) to avoid merges when CI is red or incomplete. If governance is stricter, roll out labeling first and enable auto-approval after observing review quality for a period. File ChangesOther (1)
|
Comment on lines
+57
to
+63
| [pr_reviewer] | ||
| # Auto-approve a PR when the review finds no issues to fix. | ||
| # enable_auto_approval is the required master switch (off by default); | ||
| # auto_approve_for_no_suggestions approves when the review yields zero suggestions. | ||
| # These only take effect from the config file on the default branch. | ||
| enable_auto_approval = true | ||
| auto_approve_for_no_suggestions = true |
There was a problem hiding this comment.
1. Bot auto-approves prs 🐞 Bug ⛨ Security
The config enables Qodo to submit an APPROVE review automatically when /agentic_review produces zero suggestions, and /agentic_review is configured to run automatically on PR open and on pushes for all authors except a small bot ignore list. This introduces a bot-generated approval that can be mistaken for human review and (depending on branch protection settings) may count toward required approvals, weakening the review gate for untrusted PRs.
Agent Prompt
## Issue description
Enabling auto-approval creates a bot-generated GitHub “APPROVE” review when the reviewer has zero suggestions. Because `/agentic_review` runs automatically on PR open and push for almost all authors, this can unintentionally weaken the human-review gate if branch protection counts GitHub App approvals.
## Issue Context
This PR changes repo-wide PR automation behavior once merged into the default branch.
## Fix Focus Areas
- .pr_agent.toml[1-14]
- .pr_agent.toml[16-23]
- .pr_agent.toml[57-63]
## Suggested fix
Choose one of:
1) **Disable auto-approval** by setting `enable_auto_approval = false` (and/or removing `auto_approve_for_no_suggestions`).
2) **Keep auto-approval but harden the merge gate**: ensure branch protection requires approvals from humans/code owners and does **not** accept GitHub App/bot approvals toward the required count.
3) If supported by Qodo/PR-Agent in this repo, **restrict auto-approval scope** (e.g., only allowlisted authors/branches) so untrusted contributors can’t receive bot approvals.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthrough
ChangesPR Agent Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two changes to
.pr_agent.toml(Qodo Merge config):Auto-approval when no issues are found. Under
[pr_reviewer], enableenable_auto_approval+auto_approve_for_no_suggestions, so Qodo approves a PR when the review yields zero suggestions.Product labels. Three custom labels assigned by
/agentic_describebased on which stack the diff touches:product: pnpm— the TypeScript pnpm CLI (anything outsidepacquet/andpnpr/)product: pacquet— the Rust port (pacquet/)product: pnpr— the registry server (pnpr/andpacquet/crates/pnpr-*)More than one can apply to a single PR (e.g. a pnpm↔pacquet parity change).
Notes
Written by an agent (Claude Code, claude-opus-4-8).
Summary by CodeRabbit