Walkthrough

The PR updates automation tool configurations and refactors PR review automation workflows. The reviews.pre_merge_checks.title Conventional Commits enforcement is removed from .coderabbit.yaml, auto-approval settings are moved from [pr_reviewer] to [config] in .pr_agent.toml, and the GitHub Actions workflow migrates label operations from gh pr edit to the Issues REST API while adding support for Qodo bot approvals.

Changes

Automation Configuration and Workflow Updates

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• pnpm/pnpm#12457: Both PRs modify .pr_agent.toml to configure auto-approval by moving the same enable_auto_approval and auto_approve_for_no_suggestions settings.
• pnpm/pnpm#12460: The retrieved PR added the exact reviews.pre_merge_checks.title Conventional Commits enforcement that this PR removes, making them direct inverses on the same config field.
• pnpm/pnpm#12462: Both PRs modify .github/workflows/pr-review-automation.yml to migrate PR review approval labeling to the GitHub Issues REST API instead of gh pr edit.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn

• Remove CodeRabbit pre-merge checks configuration that prevented auto-approval under Request
 Changes Workflow.
• Document why pre-merge checks are intentionally left unconfigured and how titles are enforced
 instead.

graph TD
  Dev["Contributor"] --> PR["GitHub PR"] --> CR["CodeRabbit"] --> Review["Review outcome"]
  PR --> Hooks["commit-msg hook"]
  Hooks --> Title["Squash title convention"]
  CR -->|"no pre-merge checks configured"| Review
  subgraph Legend
    direction LR
    _user["Actor"] ~~~ _sys["System"] ~~~ _cfg["Local policy"]
  end

Loading

The following are alternative approaches to this PR:

1. Enforce PR title via GitHub-native checks (Action/Probot)

• ➕ Keeps Conventional Commits enforcement visible in CI
• ➕ Does not depend on CodeRabbit behavior changes
• ➖ Adds CI/runtime maintenance overhead
• ➖ Requires additional permissions and workflow wiring

2. Keep CodeRabbit pre-merge checks but disable/adjust Request Changes Workflow

• ➕ Retains CodeRabbit’s structured pre-merge checks UX
• ➖ Depends on CodeRabbit product behavior/settings that may not be repo-local or predictable
• ➖ May still not restore auto-approval semantics desired by the team

Recommendation: The PR’s approach (removing the pre_merge_checks block and documenting the rationale) is the lowest-maintenance way to restore CodeRabbit auto-approval behavior without introducing new infrastructure. If stricter title enforcement is desired later, prefer a GitHub-native check rather than re-enabling CodeRabbit pre-merge checks that can interfere with approval flow.

Other (1) +7 / -8

.coderabbit.yamlRemove pre_merge_checks config and document why it’s disabled +7/-8

Remove pre_merge_checks config and document why it’s disabled

• Deletes the configured CodeRabbit pre-merge title check that implicitly enabled the broader pre-merge-checks subsystem. Replaces it with comments explaining that enabling any check can prevent auto-approval under Request Changes Workflow, and notes reliance on commit-msg hook plus squash-title convention instead.

.coderabbit.yaml

Description

In .github/workflows/pr-review-automation.yml, the jobs now label PRs via the issues labels REST
endpoint but still request pull-requests: write, expanding the GITHUB_TOKEN scope beyond what
the modified steps require. This increases blast radius if the workflow/job context is ever
compromised, and can be avoided while keeping behavior unchanged.

Code

.github/workflows/pr-review-automation.yml[R64-69]

+    permissions:
+      # Adding a label via the issues REST API is governed by issues: write
+      # even when the target is a PR.
+      issues: write
+      pull-requests: write
+    env:

Evidence

All three jobs add labels by POSTing to the issues-labels REST endpoint, which only requires
issues: write; there are no PR-write operations in the updated steps, so pull-requests: write is
excess scope.

.github/workflows/pr-review-automation.yml[18-39]
.github/workflows/pr-review-automation.yml[59-79]
.github/workflows/pr-review-automation.yml[80-99]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Workflow jobs grant `pull-requests: write` even though the updated implementation only POSTs to the issue-labels endpoint (`/repos/{owner}/{repo}/issues/{number}/labels`), which is governed by `issues: write`. This violates least-privilege and increases the impact of any workflow compromise.

### Issue Context
The PR replaced `gh pr edit --add-label` with `gh api .../issues/.../labels`, but permissions were not tightened accordingly.

### Fix Focus Areas
- .github/workflows/pr-review-automation.yml[18-23]
- .github/workflows/pr-review-automation.yml[64-69]
- .github/workflows/pr-review-automation.yml[85-90]

### Suggested change
For each affected job, remove `pull-requests: write` (or reduce it to `read` if you want to keep it explicit) and keep `issues: write`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

With pre_merge_checks removed, PR/squash titles are no longer validated via CodeRabbit; the
replacement comment describes "title enforcement" via a local commit-msg hook plus a squash-title
convention, but commit-msg only lints locally-created commit messages and cannot enforce squash/PR
titles repo-wide. This can let non-Conventional-Commit squash titles slip through when hooks aren’t
installed or the squash title isn’t manually corrected at merge time.

Code

.coderabbit.yaml[R17-23]

+  # Pre-merge checks are intentionally left unconfigured. Defining any check here
+  # turns on the whole pre-merge-checks subsystem, which replaces the auto-approve
+  # flow under Request Changes Workflow: CodeRabbit then emits a pre-merge-checks
+  # status block instead of approving once review threads are resolved, so PRs sit
+  # at REVIEW_REQUIRED even with all threads cleared and all checks green. We rely
+  # on the commit-msg hook plus the squash-title convention for title enforcement
+  # instead of a CodeRabbit title check.

Evidence

The new .coderabbit.yaml text claims title enforcement via a commit-msg hook; in this repo that
hook runs commitlint on the commit message file during local commits, and AGENTS.md explicitly notes
hooks only run if installed locally—so it’s not repo-wide enforcement of squash/PR titles.

.coderabbit.yaml[17-23]
.husky/commit-msg[1-3]
AGENTS.md[176-186]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The comment added to `.coderabbit.yaml` says the repo relies on the `commit-msg` hook plus a squash-title convention for **title enforcement**, but the `commit-msg` hook only runs locally and does not enforce PR/squash titles repo-wide. This can mislead maintainers into thinking PR title enforcement still exists.
### Issue Context
- The PR intentionally removes CodeRabbit `pre_merge_checks` to restore auto-approve behavior.
- This suggestion is only about making the comment accurate/less misleading (or optionally adding a separate PR-title check that does not interfere with CodeRabbit approvals).
### Fix Focus Areas
- .coderabbit.yaml[17-23]
### Suggested change
- Reword to reflect that Conventional Commits are enforced for *local commit messages* via `commit-msg`, while squash/PR titles are a *manual convention* at merge time (not an automated check).
- (Optional) If you still want automated PR-title validation without CodeRabbit pre-merge checks, add a dedicated CI/PR-title checker (separate from CodeRabbit) and update the comment accordingly.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)