Skip to content

fix: dbt PR reviewer must not submit a formal APPROVE review (bot auto-approves PRs) #869

@anandgupta42

Description

@anandgupta42

The dbt PR reviewer maps an APPROVE verdict to a GitHub 'APPROVE' review event (verdict.ts VCS_EVENT + post-github.ts createReview). Observed live on AltimateAI/altimate-ingestion #682: the github-actions bot review state is APPROVED.

A bot must NEVER grant a formal approval — with branch protection / required reviews, a bot approval can let a PR merge without human sign-off. Other reviewers (CodeRabbit, Greptile, cubic) post COMMENT or REQUEST_CHANGES, never APPROVE.

Fix: map APPROVE -> COMMENT review event (convey 'approved / no findings' in the comment body). REQUEST_CHANGES still maps through (gate mode blocks; comment mode softens to COMMENT). Add a regression test that no verdict emits a formal APPROVE event.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions