fix: prevent bot loop on pull_request.edited events by Kavirubc · Pull Request #67 · similigh/simili-bot

Kavirubc · 2026-02-17T04:45:22Z

Summary

Closes a residual loop not covered by #62.

Root cause: The gatekeeper's bot-author check relied on CommentAuthor, which was only populated for issue_comment events (from comment.user.login). For pull_request.edited and other PR events CommentAuthor stayed empty, so this guard always short-circuited:

if ctx.Issue.CommentAuthor != "" {  // never true for PR events
    if isBotAuthor(author, ...) { skip }
}

What this caused: When coderabbitai[bot] (or any bot) edits a PR (e.g. submitting a review), GitHub fires a pull_request.edited event. The gatekeeper could not detect the actor was a bot, so the triage pipeline ran again — posting a duplicate triage report and applying additional labels.

Fix: In enrichIssueFromGitHubEvent, fall back to sender.login when CommentAuthor is not already set. The sender field is present in all GitHub webhook payloads and correctly identifies who triggered the event — giving the gatekeeper full coverage across all event types, not just comments.

How it works

Event type	Before	After
`issue_comment` (bot comment)	Caught ✅	Caught ✅
`pull_request.edited` by bot	Not caught ❌	Caught ✅
`pull_request.opened` by human	Runs normally ✅	Runs normally ✅
`pull_request.synchronize` by human	Runs normally ✅	Runs normally ✅

Test plan

Build passes: go build ./...
All tests pass: go test ./...
After merge: verify triage runs exactly once when a PR is opened and CodeRabbit posts a review
Verify human-opened PRs still trigger triage normally

Summary by CodeRabbit

Bug Fixes
- Fixed event attribution for bot-triggered operations in pull requests, ensuring access control validation is consistently applied across all event types including edited events.

The gatekeeper's bot-author check was only effective for issue_comment events because CommentAuthor was only set from comment.user.login. For pull_request.edited (and other PR) events the field stayed empty, causing the guard `if ctx.Issue.CommentAuthor != ""` to short-circuit and skip the isBotAuthor check entirely. As a result, bot-triggered pull_request.edited events (e.g. coderabbitai updating a PR review) passed through the gatekeeper and re-ran the triage pipeline, posting duplicate triage comments and labels (#62 fix partial). Fix: fall back to sender.login in enrichIssueFromGitHubEvent when CommentAuthor is not already set. sender is present in all GitHub webhook payloads and correctly identifies who triggered the event, giving the gatekeeper full coverage across all event types. Signed-off-by: Kavirubc <hapuarachchikaviru@gmail.com>

coderabbitai · 2026-02-17T04:45:42Z

📝 Walkthrough

Walkthrough

Modified the comment author attribution logic in process.go to include a fallback that populates CommentAuthor from raw.sender.login when the field is empty. This enables proper author detection for bot-triggered events beyond issue_comment events (such as pull_request.edited) during gatekeeper checks.

Changes

Cohort / File(s)	Summary
Comment Author Attribution `cmd/simili/commands/process.go`	Added fallback logic to set CommentAuthor from raw.sender.login when empty, enabling gatekeeper bot checks to correctly identify authors for non-issue_comment events like pull_request.edited.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

fix: prevent infinite bot comment loop #62 — Implements author-based bot detection for gatekeeper checks, which directly depends on this PR's CommentAuthor population fallback to function correctly for events beyond issue_comment.

Suggested labels

bug, fix, reliability, bot, triage

Poem

🐰 A tiny fix, yet oh so grand,
When bots speak up, we now understand!
From sender's login, the truth appears,
No more lost authors, no more fears! ✨

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main fix: preventing bot loops on pull_request.edited events by addressing the CommentAuthor fallback issue.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into `main`

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/bot-loop-pr-events

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gh-simili-bot · 2026-02-17T04:46:31Z

Simili Triage Report

Note

Quality Score: 8.8/10 (Good)
The issue could be improved. See suggestions below.

Classification

Category	Value
Labels

Quality Improvements

No explicit environment details
Reproduction steps are described but not in a dedicated 'Steps to Reproduce' section
Specify the Go version and deployment environment
Formalize reproduction steps into a dedicated section

Similar Threads

Similarity	Thread	Status
83%	#41 fix: PR triage review feedback (synchronize tri...	—
82%	#62 fix: prevent infinite bot comment loop	Open
81%	#28 Similar Issue	—

_{Generated by Simili Bot}

coderabbitai

🧹 Nitpick comments (1)

cmd/simili/commands/process.go (1)
332-336: Consider renaming CommentAuthor to reflect broader usage.

The field CommentAuthor is now semantically overloaded—it holds the comment author for issue_comment events but the event sender for other event types (e.g., pull_request.edited). This could confuse future maintainers who expect the field to relate only to comments.

A cleaner approach would be to introduce a dedicated field like EventSender or EventActor and have the gatekeeper check both fields, or rename CommentAuthor to something more general like TriggeringActor.

This is not a blocker for the current fix, but worth considering in a follow-up refactor.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@cmd/simili/commands/process.go` around lines 332 - 336, The CommentAuthor
field is being used for both comment authors and event senders—introduce a new,
more general field (e.g., EventSender or EventActor or TriggeringActor) on the
same struct, populate it from the raw["sender"] login when present (in addition
to keeping CommentAuthor for comment-specific data), and update any gatekeeper
checks to consult the new EventSender field (or check both CommentAuthor and
EventSender) so consumers clearly distinguish comment authors from generic event
actors; ensure you update usages in process.go where CommentAuthor is set and
where gatekeeper logic reads it to reference the new field appropriately.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@cmd/simili/commands/process.go`:
- Around line 332-336: The CommentAuthor field is being used for both comment
authors and event senders—introduce a new, more general field (e.g., EventSender
or EventActor or TriggeringActor) on the same struct, populate it from the
raw["sender"] login when present (in addition to keeping CommentAuthor for
comment-specific data), and update any gatekeeper checks to consult the new
EventSender field (or check both CommentAuthor and EventSender) so consumers
clearly distinguish comment authors from generic event actors; ensure you update
usages in process.go where CommentAuthor is set and where gatekeeper logic reads
it to reference the new field appropriately.

gh-simili-bot added the bug Something isn't working label Feb 17, 2026

github-project-automation Bot added this to simili-bot-v1-release Feb 17, 2026

github-project-automation Bot moved this to Todo in simili-bot-v1-release Feb 17, 2026

coderabbitai Bot reviewed Feb 17, 2026

View reviewed changes

Kavirubc merged commit 2c6582c into main Feb 17, 2026
6 of 7 checks passed

Kavirubc deleted the fix/bot-loop-pr-events branch February 17, 2026 04:48

github-project-automation Bot moved this from Todo to Done in simili-bot-v1-release Feb 17, 2026

gh-simili-bot mentioned this pull request Feb 18, 2026

fix: prevent bot loop & enable E2E for forks #74

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: prevent bot loop on pull_request.edited events#67

fix: prevent bot loop on pull_request.edited events#67
Kavirubc merged 1 commit intomainfrom
fix/bot-loop-pr-events

Kavirubc commented Feb 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Feb 17, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

❌ Failed checks (1 warning)

Uh oh!

gh-simili-bot commented Feb 17, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Kavirubc commented Feb 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How it works

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

❌ Failed checks (1 warning)

Uh oh!

gh-simili-bot commented Feb 17, 2026

Simili Triage Report

Classification

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Kavirubc commented Feb 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Feb 17, 2026 •

edited

Loading