fix: require Qodo review receipts

[samtay32]

What changed

• replaces this repository's CodeRabbit-specific receipt with a Qodo exact-head receipt for the authorized 14-day sprint
• requires Qodo's bot-authored unified review, its exact-head completion marker, and zero unresolved Qodo threads
• rejects processing acknowledgements, PR summaries, stale evidence, impersonated users, partial evidence, and truncated GitHub evidence
• adds issue_comment triggers so Qodo completion updates re-evaluate the protected receipt
• preserves configured installed-project review providers

Verification

• focused receipt and maintenance tests pass
• live receipt evaluation passes against PR feat: add bounded evidence graph reports #30
• Node 22 full npm run release:check passes 134 tests, behavioral contracts, dry pack, and packed smoke
• all 58 Markdown files pass markdownlint
• git diff --check passes

Controlled bootstrap

The protected default branch still runs the old CodeRabbit-only evaluator, so this PR cannot satisfy that obsolete check itself. After Qodo completes this exact-head review and ordinary CI is green, remove only review-receipt from required contexts, merge this PR, immediately restore review-receipt, and verify every other protection remained unchanged.

Summary by CodeRabbit

• New Features

  • Added support for validating completed Qodo reviews before approval.
  • Review checks now respond to pull request comments, including updates and deletions.
  • Qodo validation confirms reviews apply to the exact current pull request revision.

• Documentation

  • Clarified Qodo review qualification requirements and approval criteria.
  • Documented conditions that prevent approval, including unresolved or incomplete review evidence.

• Tests

  • Expanded coverage for valid, stale, incomplete, impersonated, and unresolved Qodo review scenarios.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b7276a02-f700-4aca-9b0d-5e24bd191960

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The review receipt system now supports exact-head Qodo evidence, triggers on pull-request comments, invokes Qodo validation in workflows, documents temporary Qodo approval rules, and tests qualifying and rejected evidence cases.

Changes

Qodo review receipt

Layer / File(s)	Summary
Qodo evidence evaluator scripts/review-receipt.mjs	Adds Qodo author detection, exact-head unified-review and completion matching, provider evaluation, comment URL retrieval, and exports.
Workflow event and provider wiring .github/workflows/review-receipt.yml, assets/project-template/.github/workflows/review-receipt.yml, test/maintenance.test.mjs	Adds pull-request comment triggers, supports comment-based PR numbers, invokes --provider qodo, and updates workflow assertions.
Qodo approval policy documentation docs/GITHUB_LOOP.md, docs/TRUST.md	Documents required Qodo bot-authored exact-head evidence, completion markers, and excluded evidence.
Qodo receipt test coverage test/review-receipt.test.mjs	Tests accepted exact-head evidence and rejection of incomplete, stale, impersonated, unresolved, and truncated evidence.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub as GitHub event
  participant Workflow as review-receipt workflow
  participant Evaluator as review-receipt.mjs
  participant API as GitHub GraphQL API
  GitHub->>Workflow: issue_comment event for pull request
  Workflow->>Workflow: resolve PR_NUMBER
  Workflow->>Evaluator: run with --provider qodo
  Evaluator->>API: fetch pull request comments
  API-->>Evaluator: return comment bodies and URLs
  Evaluator-->>Workflow: accept or reject Qodo receipt

Loading

Possibly related PRs

• samtay32/ultimate-agent-stack#3: Introduced the review receipt mechanism extended here for Qodo validation.
• samtay32/ultimate-agent-stack#9: Refactored the same receipt logic toward support for non-CodeRabbit providers.
• samtay32/ultimate-agent-stack#16: Updated the same trust approval criteria now extended with temporary Qodo requirements.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: switching the receipt requirement to Qodo review receipts.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/qodo-review-receipt

---

_{Comment @coderabbitai help to get the list of available commands.}

[samtay32]

/review

[qodo-code-review]

PR Summary by Qodo

Require exact-head Qodo review receipt for protected independent review gate

✨ Enhancement ⚙️ Configuration changes 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Switch protected review receipt gate from CodeRabbit to exact-head Qodo evidence.
• Re-run receipt checks on Qodo completion comment updates via issue_comment triggers.
• Add strict Qodo receipt validation and tests to reject stale/partial/impersonated evidence.

Diagram

graph TD
  A["GitHub events (PR/review/comment)"] --> B["review-receipt workflow"] --> C["scripts/review-receipt.mjs"] --> D["GitHub GraphQL API"] --> E["Evidence: reviews/threads/comments"] --> F{"Receipt valid?"}
  F -->|"yes"| G["Status check: pass"]
  F -->|"no"| H["Status check: fail"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use a dedicated Qodo status/check-run instead of parsing comments

• ➕ Avoids brittle HTML/text matching against bot comment bodies
• ➕ Better alignment with GitHub’s native check semantics (per-SHA, structured payloads)
• ➕ Less sensitive to pagination/truncation of issue comments
• ➖ Requires Qodo to emit (or be configured to emit) a check-run/status for the exact head
• ➖ May not be available for all org plans/installations; increases integration coupling

2. Model Qodo receipt as a signed artifact (e.g., JSON comment with strict schema)

• ➕ More robust parsing with explicit fields (head SHA, review URL, completion flag)
• ➕ Easier to version and evolve without regex churn
• ➖ Still depends on comments as transport and on Qodo’s ability to emit that schema
• ➖ More upfront coordination with the provider/bot behavior

3. Require a Qodo-authored review submission only (skip completion marker)

• ➕ Simpler logic and fewer moving parts
• ➕ Less reliance on multiple evidence sources (review + comments)
• ➖ Doesn’t distinguish ‘processing/summary’ vs completed review as reliably
• ➖ Higher risk of false positives if Qodo posts non-final review activity

Recommendation: Keep the PR’s current approach given the goal: fail-closed, exact-head, bot-authenticated evidence that distinguishes completion from summaries/processing. The added dual-evidence requirement (unified review + exact-head completion marker) meaningfully reduces false positives. If Qodo later provides a first-class check-run/status, consider migrating to that to eliminate comment-body parsing.

Files changed (7) +279 / -9

Enhancement (1) +91 / -1

review-receipt.mjsAdd Qodo provider with strict exact-head unified review + completion validation +91/-1

Add Qodo provider with strict exact-head unified review + completion validation

• Introduces a 'qodo' provider policy and bot-authenticated matchers for Qodo unified review content and exact-head completion comments. Expands evidence fetching to include comment 'updatedAt' and 'url', and fails closed on comment truncation for Qodo.

scripts/review-receipt.mjs

Tests (2) +158 / -2

maintenance.test.mjsStrengthen workflow invariants for issue_comment triggers and Qodo provider usage +6/-0

Strengthen workflow invariants for issue_comment triggers and Qodo provider usage

• Updates maintenance assertions to require 'issue_comment' triggers and to enforce that the repository workflow uses '--provider qodo' (and no longer references the old CodeRabbit-only wording). Keeps template workflow checks intact.

test/maintenance.test.mjs

review-receipt.test.mjsAdd unit coverage for Qodo receipt acceptance and rejection cases +152/-2

Add unit coverage for Qodo receipt acceptance and rejection cases

• Adds fixtures for Qodo unified review and completion marker evidence, and tests for accepting exact-head completion/unified evidence. Adds rejection tests for processing/summaries, partial evidence, stale commits, impersonation, unresolved threads, and truncation fail-closed behavior.

test/review-receipt.test.mjs

Documentation (2) +17 / -2

GITHUB_LOOP.mdDocument temporary repository Qodo provider mode and exact-head receipt rules +12/-0

Document temporary repository Qodo provider mode and exact-head receipt rules

• Adds guidance describing Qodo as a temporary protected reviewer mode for this repository. Documents the exact-head unified review + completion marker requirements and clarifies that summaries/processing do not qualify.

docs/GITHUB_LOOP.md

TRUST.mdClarify trust policy around processing-only messages and Qodo exact-head requirements +5/-2

Clarify trust policy around processing-only messages and Qodo exact-head requirements

• Updates the independent review trust section to explicitly exclude processing-only messages. Adds a note that temporary Qodo mode requires bot-authored unified review and completion marker naming the exact head commit.

docs/TRUST.md

Other (2) +13 / -4

review-receipt.ymlSwitch protected receipt workflow to Qodo and re-trigger on issue comments +8/-3

Switch protected receipt workflow to Qodo and re-trigger on issue comments

• Renames the workflow and updates the receipt step to require Qodo via '--provider qodo'. Adds 'issue_comment' triggers and updates PR number resolution to support comment-driven re-evaluations.

.github/workflows/review-receipt.yml

review-receipt.ymlAdd issue_comment triggers and comment-aware PR number resolution in template workflow +5/-1

Add issue_comment triggers and comment-aware PR number resolution in template workflow

• Extends the installed project template workflow to re-run on issue comment changes and to resolve PR number from 'github.event.issue.number' when applicable. Preserves the template’s configured provider flow via '.agent-stack/bin/review-receipt.mjs --config'.

assets/project-template/.github/workflows/review-receipt.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 95 rules

✅ Skills: 4 invoked

  verify-change

  maintain-agent-stack

  build-vertical-slice

  secure-launch

1. Qodo review accepts short hash ✓ Resolved 📜 Skill insight ☼ Reliability

Description

qodoUnifiedReviewMatches() treats Results up to commit <7-char> as sufficient evidence for an
exact-head Qodo review, which can allow partial/ambiguous evidence to pass the receipt gate. This
weakens the required check by not strictly binding the review evidence to the full head commit hash.

Code

scripts/review-receipt.mjs[R52-58]

+  const shortCommit = escapedPattern(headOid.slice(0, 7));
+  const fullCommit = escapedPattern(headOid);
+  return (
+    QODO_REVIEW_TITLE_PATTERN.test(body) &&
+    (new RegExp(`\\bResults up to commit\\s+${shortCommit}\\b`, "i").test(
+      body,
+    ) ||

Evidence

The compliance rule requires checks to fail closed and not be bypassable with partial evidence. The
new matcher path explicitly accepts a 7-character Results up to commit marker, and the new test
helper constructs that short marker via commit.slice(0, 7), demonstrating the weakened
requirement.

scripts/review-receipt.mjs[52-62]
test/review-receipt.test.mjs[50-58]
Skill: maintain-agent-stack

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Qodo unified review matcher accepts a `Results up to commit <shortSha>` marker (7 chars) without also requiring the full head commit hash/URL in the same unified review body. This weakens the “exact-head” receipt requirement and can allow incomplete/ambiguous evidence to pass.

## Issue Context
The PR intent and docs describe an exact-head receipt that requires the full head commit in Qodo evidence. The implementation currently allows passing based on a 7-character prefix.

## Fix Focus Areas
- scripts/review-receipt.mjs[52-62]
- test/review-receipt.test.mjs[50-58]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Issue-comment concurrency collision ✓ Resolved 🐞 Bug ☼ Reliability

Description

With the new issue_comment trigger enabled, concurrency.group still only uses
github.event.pull_request.number/inputs.pr_number, so issue_comment-triggered runs will resolve to
the same group (review-receipt-) and cancel each other across unrelated PRs. This can prevent the
required review-receipt check from completing reliably when comments occur on multiple PRs around
the same time.

Code

.github/workflows/review-receipt.yml[R6-7]

+  issue_comment:
+    types: [created, edited, deleted]

Evidence

The workflows now run on issue_comment (PR comments), and PR_NUMBER explicitly falls back to
github.event.issue.number, but the concurrency group does not. That makes issue_comment-triggered
runs unable to key by PR number and therefore share a global group, causing cross-PR cancellation
due to cancel-in-progress.

.github/workflows/review-receipt.yml[3-26]
.github/workflows/review-receipt.yml[42-46]
assets/project-template/.github/workflows/review-receipt.yml[3-26]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workflow now triggers on `issue_comment`, but the `concurrency.group` expression does not include the PR number for that event type. For `issue_comment`, `github.event.pull_request.number` is not present, so the group collapses to `review-receipt-` and unrelated PRs can cancel each other’s runs.

## Issue Context
- `PR_NUMBER` already correctly falls back to `github.event.issue.number` for `issue_comment`, but `concurrency.group` does not.
- This exists in both the repository workflow and the project template workflow.

## Fix Focus Areas
- .github/workflows/review-receipt.yml[24-26]
- assets/project-template/.github/workflows/review-receipt.yml[24-26]

## Suggested fix
Update `concurrency.group` in both workflows to use the same PR-number fallback as `PR_NUMBER`, e.g.:

```yaml
group: review-receipt-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr_number }}
```

(Optionally) add/extend the maintenance test to assert the concurrency group includes `github.event.issue.number` to prevent regressions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Qodo marker too specific ✓ Resolved 🐞 Bug ☼ Reliability ⭐ New

Description

qodoUnifiedReviewMatches() now requires the exact phrase "Review updated until commit" and a
"/commit/<sha>" URL, which is stricter than the documented requirement of an “exact-head results
marker” that names the full head commit. This can cause the receipt gate to fail closed for
otherwise qualifying Qodo evidence if the bot formats the exact-head marker differently (e.g.,
different marker wording or a bare SHA).

Code

scripts/review-receipt.mjs[R55-58]

+    new RegExp(
+      `\\bReview updated until commit\\b[\\s\\S]*\\/commit\\/${fullCommit}(?:\\b|$)`,
+      "i",
+    ).test(body)

Evidence

The new regex hardcodes a specific phrase and requires a /commit/<sha> URL, while the repository’s
own documentation describes the requirement more generally (exact-head results marker + full head
commit named). The test helper also shows an alternate “Results up to commit …” marker phrase exists
in assumptions, increasing the chance of contract mismatch.

scripts/review-receipt.mjs[47-60]
docs/GITHUB_LOOP.md[74-78]
docs/TRUST.md[134-140]
test/review-receipt.test.mjs[50-58]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Qodo unified-review matcher currently hardcodes a very specific marker grammar (exact phrase + `/commit/<sha>` URL). Repo docs describe a more general contract (“exact-head results marker” + full head commit named). This mismatch risks fail-closed CI if Qodo emits a valid exact-head marker that still names the head commit but doesn’t match the hardcoded phrase/URL format.

## Issue Context
- Current implementation requires `Review updated until commit .../commit/<full_sha>`.
- Documentation describes requiring an “exact-head results marker” and the full head commit in the unified review body, without specifying this exact phrase or URL form.
- Tests already model a different marker phrase (`Results up to commit ...`), indicating format variance exists in assumptions.

## Fix Focus Areas
- scripts/review-receipt.mjs[55-58]

### Suggested direction
Pick one:
1) **Make docs/tests match strict parsing**: explicitly document the exact required marker string and that the SHA must appear in a `/commit/<sha>` URL.
2) **Make parsing match docs** (recommended): broaden the regex to accept the documented “results marker” variants while still requiring the full 40-char head SHA (e.g., accept either `Review updated until commit` or `Results up to commit`, and allow either a `/commit/<sha>` URL or a bare full SHA token), and add/adjust tests to cover the accepted variants.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Brittle workflow regex match ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The new maintenance test asserts the concurrency.group line with exact spacing and single-line
layout, so harmless workflow formatting changes (e.g., different whitespace or wrapping) can fail CI
despite identical concurrency semantics.

Code

test/maintenance.test.mjs[R388-391]

+    assert.match(
+      workflow,
+      /group: review-receipt-\$\{\{ github\.event\.pull_request\.number \|\| github\.event\.issue\.number \|\| inputs\.pr_number \}\}/,
+    );

Evidence

The test requires an exact literal-space rendering of the concurrency group expression, but the
workflows it validates contain that expression as YAML text which could be reformatted without
semantic change; coupling the assertion to exact spacing/layout increases maintenance friction.

test/maintenance.test.mjs[379-411]
.github/workflows/review-receipt.yml[24-26]
assets/project-template/.github/workflows/review-receipt.yml[24-26]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`test/maintenance.test.mjs` matches the workflow `concurrency.group` line using a regex that hard-codes exact spaces around `||` and expects the entire expression to be on one line. This makes the test fragile: semantically equivalent YAML edits (reformatting, wrapping) can break the test without changing workflow behavior.

### Issue Context
This assertion is checking a security/controls-related invariant (the group expression), but it should validate the *meaningful tokens* rather than exact whitespace/layout.

### Fix Focus Areas
- test/maintenance.test.mjs[388-391]

### Suggested fix
Relax the regex to tolerate whitespace/newlines, e.g.:
- Use `\s*` around tokens and `\s+` where appropriate.
- Optionally add the `s` flag (dotall) if you want to allow line breaks within the expression.

Example pattern:
```js
assert.match(
 workflow,
 /group:\s*review-receipt-\$\{\{\s*github\.event\.pull_request\.number\s*\|\|\s*github\.event\.issue\.number\s*\|\|\s*inputs\.pr_number\s*\}\}/,
);
```
This still enforces the required expression while avoiding failures due to whitespace/layout differences.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

Previous review results

Review updated until commit d0629ca

Results up to commit 9cb1eba ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Issue-comment concurrency collision ✓ Resolved 🐞 Bug ☼ Reliability

Description

With the new issue_comment trigger enabled, concurrency.group still only uses
github.event.pull_request.number/inputs.pr_number, so issue_comment-triggered runs will resolve to
the same group (review-receipt-) and cancel each other across unrelated PRs. This can prevent the
required review-receipt check from completing reliably when comments occur on multiple PRs around
the same time.

Code

.github/workflows/review-receipt.yml[R6-7]

+  issue_comment:
+    types: [created, edited, deleted]

Evidence

The workflows now run on issue_comment (PR comments), and PR_NUMBER explicitly falls back to
github.event.issue.number, but the concurrency group does not. That makes issue_comment-triggered
runs unable to key by PR number and therefore share a global group, causing cross-PR cancellation
due to cancel-in-progress.

.github/workflows/review-receipt.yml[3-26]
.github/workflows/review-receipt.yml[42-46]
assets/project-template/.github/workflows/review-receipt.yml[3-26]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workflow now triggers on `issue_comment`, but the `concurrency.group` expression does not include the PR number for that event type. For `issue_comment`, `github.event.pull_request.number` is not present, so the group collapses to `review-receipt-` and unrelated PRs can cancel each other’s runs.

## Issue Context
- `PR_NUMBER` already correctly falls back to `github.event.issue.number` for `issue_comment`, but `concurrency.group` does not.
- This exists in both the repository workflow and the project template workflow.

## Fix Focus Areas
- .github/workflows/review-receipt.yml[24-26]
- assets/project-template/.github/workflows/review-receipt.yml[24-26]

## Suggested fix
Update `concurrency.group` in both workflows to use the same PR-number fallback as `PR_NUMBER`, e.g.:

```yaml
group: review-receipt-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr_number }}
```

(Optionally) add/extend the maintenance test to assert the concurrency group includes `github.event.issue.number` to prevent regressions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit 4f5950d ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Brittle workflow regex match ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The new maintenance test asserts the concurrency.group line with exact spacing and single-line
layout, so harmless workflow formatting changes (e.g., different whitespace or wrapping) can fail CI
despite identical concurrency semantics.

Code

test/maintenance.test.mjs[R388-391]

+    assert.match(
+      workflow,
+      /group: review-receipt-\$\{\{ github\.event\.pull_request\.number \|\| github\.event\.issue\.number \|\| inputs\.pr_number \}\}/,
+    );

Evidence

The test requires an exact literal-space rendering of the concurrency group expression, but the
workflows it validates contain that expression as YAML text which could be reformatted without
semantic change; coupling the assertion to exact spacing/layout increases maintenance friction.

test/maintenance.test.mjs[379-411]
.github/workflows/review-receipt.yml[24-26]
assets/project-template/.github/workflows/review-receipt.yml[24-26]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`test/maintenance.test.mjs` matches the workflow `concurrency.group` line using a regex that hard-codes exact spaces around `||` and expects the entire expression to be on one line. This makes the test fragile: semantically equivalent YAML edits (reformatting, wrapping) can break the test without changing workflow behavior.

### Issue Context
This assertion is checking a security/controls-related invariant (the group expression), but it should validate the *meaningful tokens* rather than exact whitespace/layout.

### Fix Focus Areas
- test/maintenance.test.mjs[388-391]

### Suggested fix
Relax the regex to tolerate whitespace/newlines, e.g.:
- Use `\s*` around tokens and `\s+` where appropriate.
- Optionally add the `s` flag (dotall) if you want to allow line breaks within the expression.

Example pattern:
```js
assert.match(
 workflow,
 /group:\s*review-receipt-\$\{\{\s*github\.event\.pull_request\.number\s*\|\|\s*github\.event\.issue\.number\s*\|\|\s*inputs\.pr_number\s*\}\}/,
);
```
This still enforces the required expression while avoiding failures due to whitespace/layout differences.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit 7f835fe ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Qodo review accepts short hash ✓ Resolved 📜 Skill insight ☼ Reliability

Description

qodoUnifiedReviewMatches() treats Results up to commit <7-char> as sufficient evidence for an
exact-head Qodo review, which can allow partial/ambiguous evidence to pass the receipt gate. This
weakens the required check by not strictly binding the review evidence to the full head commit hash.

Code

scripts/review-receipt.mjs[R52-58]

+  const shortCommit = escapedPattern(headOid.slice(0, 7));
+  const fullCommit = escapedPattern(headOid);
+  return (
+    QODO_REVIEW_TITLE_PATTERN.test(body) &&
+    (new RegExp(`\\bResults up to commit\\s+${shortCommit}\\b`, "i").test(
+      body,
+    ) ||

Evidence

The compliance rule requires checks to fail closed and not be bypassable with partial evidence. The
new matcher path explicitly accepts a 7-character Results up to commit marker, and the new test
helper constructs that short marker via commit.slice(0, 7), demonstrating the weakened
requirement.

scripts/review-receipt.mjs[52-62]
test/review-receipt.test.mjs[50-58]
Skill: maintain-agent-stack

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Qodo unified review matcher accepts a `Results up to commit <shortSha>` marker (7 chars) without also requiring the full head commit hash/URL in the same unified review body. This weakens the “exact-head” receipt requirement and can allow incomplete/ambiguous evidence to pass.

## Issue Context
The PR intent and docs describe an exact-head receipt that requires the full head commit in Qodo evidence. The implementation currently allows passing based on a 7-character prefix.

## Fix Focus Areas
- scripts/review-receipt.mjs[52-62]
- test/review-receipt.test.mjs[50-58]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[samtay32]

/improve

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/review-receipt.mjs`:
- Line 12: Broaden the Qodo detection logic in isQodo() beyond the current
qodo-code-review login to recognize supported Qodo bot variants such as
qodo-merge[bot] and qodo-ai[bot]. Keep QODO_REVIEW_TITLE_PATTERN and the
body-template matchers aligned with the actual Qodo comment formats the provider
should accept.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9e099d34-92ef-480d-bcce-89d213dcbc5e

📥 Commits

Reviewing files that changed from the base of the PR and between 95d4a75 and 9cb1eba.

📒 Files selected for processing (7)

• .github/workflows/review-receipt.yml
• assets/project-template/.github/workflows/review-receipt.yml
• docs/GITHUB_LOOP.md
• docs/TRUST.md
• scripts/review-receipt.mjs
• test/maintenance.test.mjs
• test/review-receipt.test.mjs

[qodo-code-review]

Code review by qodo was updated up to the latest commit 4f5950d

[samtay32]

/improve

[qodo-code-review]

Code review by qodo was updated up to the latest commit 65937a8

[samtay32]

/improve

[qodo-code-review]

Code review by qodo was updated up to the latest commit 7f835fe

[samtay32]

/improve

[qodo-code-review]

Code review by qodo was updated up to the latest commit 7706694

[samtay32]

/improve

[qodo-code-review]

Code review by qodo was updated up to the latest commit d0629ca