Create REQUEST_CHANGES review for create_pull_request threat-warning mode

[Copilot]

When threat detection returns warning, create_pull_request already adds a caution message but did not force a formal review gate. This change aligns threat-warning handling with protected-files behavior by creating a blocking-style review signal that requires human scrutiny.

• Threat-warning review gating

  • Extend create_pull_request to submit a PR review with event: "REQUEST_CHANGES" when detection caution is active.
  • Review body explicitly calls out that changes must be scrutinized before merge, includes detection reason, and links to workflow run logs.

• Policy composition with protected-files flow

  • Reuse the existing protected-files request-review path instead of introducing a parallel mechanism.
  • If both protected-files and threat-warning signals are present, compose a single review body with both sections.

• Behavioral coverage updates

  • Add/adjust create_pull_request unit assertions to verify:
    • warning mode emits a REQUEST_CHANGES review with scrutiny language,
    • non-warning mode does not emit that review.

if (detectionCaution) {
  requestChangesSections.push(`Threat detection produced a warning for this pull request output.

These changes need to be scrutinized before merge and only merged after a careful manual review.

- Detection reason: \`${detectionReason}\`
- Review workflow run logs: ${runUrl}`);
}

[Copilot]

Pull request overview

Adds a formal, blocking-style PR review gate when threat detection returns a warning, aligning threat-warning handling with the existing protected-files “request review” flow and composing both signals into a single review when applicable.

Changes:

• Extend create_pull_request to submit a pulls.createReview with event: "REQUEST_CHANGES" when threat-warning caution is active (and compose with protected-files request-review content).
• Refactor request-changes review body construction to support multiple sections separated by a Markdown divider.
• Update unit tests to mock createReview in additional scenarios and assert threat-warning review behavior.

Show a summary per file

File	Description
actions/setup/js/create_pull_request.cjs	Compose protected-files + threat-warning “request changes” sections and submit a blocking PR review when either signal is present.
actions/setup/js/create_pull_request.test.cjs	Add assertions/mocks to verify threat-warning triggers a REQUEST_CHANGES review and non-warning does not.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

actions/setup/js/create_pull_request.cjs:2080

• This code now creates a REQUEST_CHANGES review for both protected-files and threat-warning cases, but the log message below still says it’s "due to protected files". Update the message to reflect the actual reasons (protected files and/or threat-detection warning) to avoid misleading operational logs.

      if (requestChangesSections.length > 0) {
        const requestChangesBody = requestChangesSections.join("\n\n---\n\n");
        /** @type {{ owner: string, repo: string, pull_number: number, event: "REQUEST_CHANGES" | "COMMENT", body: string, commit_id?: string }} */
        const requestChangesParams = {
          owner: repoParts.owner,
          repo: repoParts.repo,

• Files reviewed: 2/2 changed files
• Comments generated: 3

[pelikhan]

@copilot move templates to actions/setup/md and use rendertemplatefile also use renderFilesList helper

[Copilot]

@copilot move templates to actions/setup/md and use rendertemplatefile also use renderFilesList helper

Implemented in 6709de0 and 743ab75: moved REQUEST_CHANGES review templates to actions/setup/md, switched create_pull_request to renderTemplateFromFile, and wired protected-file rendering through renderFilesList.

[github-actions]

@copilot review all comments
Please address the unresolved review feedback and post an update when it is ready for another look.

Generated by 👨‍🍳 PR Sous Chef · ● 3.2M · ◷