[fupacat]

Summary

Implements event-driven PR automation with zero idle token consumption:

1. Deterministic PR Lifecycle Automation (.github/workflows/pr-automation.yml):

   • Auto-Undraft: Automatically marks draft PRs as ready for review unless their title begins with [WIP].
   • Auto-Merge: Enables automatic squash merge on ready PRs (so they merge immediately once all required status checks pass without human polling).

2. On-Demand Copilot Dispatch on Review Feedback (.github/workflows/copilot-review-handler.yml):

   • Triggers when a pull request review is submitted with state changes_requested.
   • Comments @copilot Changes were requested on this pull request by @reviewer... summoning Copilot to address the specific reviewer feedback.

3. On-Demand Copilot Dispatch on CI Failure (.github/workflows/copilot-ci-failure-handler.yml):

   • Triggers on workflow_run completion for CI, CodeQL, or SonarCloud.
   • If conclusion is failure, immediately posts a comment mentioning @copilot with the run failure URL so Copilot inspects logs and pushes a fix.

Cost & Efficiency

• Runs strictly on GitHub Actions events (0 tokens spent while waiting).
• Dispatches AI compute only when actionable failure/review events occur.

[Copilot]

🔵 Needs a closer look

The auto-merge step runs under pull_request_target and can merge unreviewed (including fork-authored) PRs if branch protection does not require approvals, which needs human verification of repo settings.

3 open findings

• Auto-merge can merge unreviewed fork PRs on pull_request_target · New
• PR number should be passed via env instead of inline interpolation · New
• Comment text mismatches the actual review state check · New

What changed in this PR

This PR replaces the single-purpose ready-for-review.yml workflow with an event-driven PR automation suite that consolidates draft management and auto-merge, and adds two workflows that automatically summon Copilot when a review requests changes or when CI/CodeQL/SonarCloud fails. The goal is zero idle token consumption by reacting only to GitHub Actions events. The referenced workflow names (CI, CodeQL Analysis, SonarCloud Analysis) match the existing workflow definitions, so the workflow_run trigger wiring is correct.

Changes:

• Remove ready-for-review.yml and fold its auto-undraft logic into a new pr-automation.yml, which also enables squash auto-merge on open, non-[WIP] PRs.
• Add copilot-review-handler.yml to comment @copilot when a review is submitted with state changes_requested.
• Add copilot-ci-failure-handler.yml to comment @copilot (with the run URL) when CI, CodeQL Analysis, or SonarCloud Analysis fails on a pull request.

File	Description
.github/​workflows/​ready-for-review.yml	Removed; its ready-for-review mutation is migrated into the new consolidated automation workflow.
.github/​workflows/​pr-automation.yml	New workflow combining auto-undraft and squash auto-merge via pull_request_target.
.github/​workflows/​copilot-review-handler.yml	New workflow that pings @copilot on changes_requested reviews.
.github/​workflows/​copilot-ci-failure-handler.yml	New workflow that pings @copilot on failed CI/CodeQL/Sonar runs for PRs.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

These pull_request_target workflows grant write permissions and enable auto-merge of member PRs, so their safety depends on external repository settings (allow-auto-merge, branch protection) and Copilot behavior that cannot be verified here and warrant human review.

0 open findings

3 resolved since last review

• Auto-merge can merge unreviewed fork PRs on pull_request_target
• Comment text mismatches the actual review state check
• PR number should be passed via env instead of inline interpolation

Previously missed (2)

In code that hasn't changed since last review

Repeated Copilot summons on every failed PR run

.github/​workflows/​copilot-ci-failure-handler.yml:32

This job posts a fresh @copilot comment on every failed pull_request run of CI, CodeQL, or SonarCloud, with no de-duplication or stop condition. Because each of the three watched workflows can fail independently, a single PR can receive up to three simultaneous @copilot summons, and every time Copilot pushes a fix that still fails CI, another summon is posted — repeatedly dispatching AI compute on the same PR. This works against the PR's stated goal of dispatching AI compute "only when actionable." Consider adding a guard (e.g., skip if the latest comment already summoned Copilot for the same run, or limit retries per PR/head SHA) before posting. This is optional.

Comment says non-draft, but condition does not check draft

.github/​workflows/​pr-automation.yml:40

The inline comment states the auto-merge step applies only when the PR is "not draft", but the if condition below (lines 43-45) does not check github.event.pull_request.draft. It only gates on state == 'open', the [WIP] title prefix, and author_association. This makes the comment misleading to anyone auditing the condition. Since the preceding step already marks non-WIP drafts as ready, dropping "not draft" from the comment makes it accurately describe what is enforced.

🧠 Review effort: Balanced