fix(ci): harden PR target draft conversion and issue-quality Version gates

[Wibias]

Summary

• enforce-pr-target: grant contents: write so draft GraphQL works with GITHUB_TOKEN, soft-fail draft/ready mutations, record autoDraftedByBot only after success, and always fail the required check on a wrong base (seen on [WRONG BRANCH] fix: stabilize cache inputs #626).
• issue-quality: reject unusable Version values (Unknown / Uknown / 모름 / idk / …), require Version + OS on the new bug form, and reject vague title-like Reproduction text (Unexpected interruption continues to occur #624).

Notes

• Workflow permission change is security-sensitive (pull_request_target). Explicit security review required before merge.
• Live pull_request_target behavior for fork PRs only updates after promotion to the repository default branch as well as dev.

Test plan

• node --test .github/scripts/enforce-pr-target.test.cjs
• node --test .github/scripts/issue-quality.test.cjs
• bun test tests/ci-workflows.test.ts
• bun run typecheck
• bun run privacy:scan
• Security review of workflow permissions / pull_request_target surface
• After merge + promotion: wrong-base PR drafts + fails enforce-target; Unknown-Version bug issues are quality-rejected

Summary by CodeRabbit

• Bug Fixes

  • Improved pull request target-branch enforcement so incorrect targets reliably block merging, even when automatic draft conversion cannot be completed.
  • Added clearer status messages when manual action is required to change draft or review status.
  • Strengthened bug report validation by rejecting unknown versions, missing operating systems, and overly vague reproduction steps.

• Quality Improvements

  • Expanded automated checks to cover the updated pull request enforcement and issue-quality rules.

[coderabbitai]

Warning

Review limit reached

@Wibias, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f56c3d82-528d-47c0-a2e1-4a38457e4044

📥 Commits

Reviewing files that changed from the base of the PR and between 76f30bc and 623b2be.

📒 Files selected for processing (5)

• .github/scripts/enforce-pr-target.test.cjs
• .github/scripts/issue-quality.cjs
• .github/scripts/issue-quality.test.cjs
• .github/workflows/enforce-pr-target.yml
• tests/ci-workflows.test.ts

📝 Walkthrough

Walkthrough

The PR hardens PR target enforcement with explicit permissions, best-effort state mutations, accurate comments, and hard failures for invalid targets. It also tightens new bug-report validation for versions, reproductions, and operating systems with expanded tests.

Changes

PR target enforcement

Layer / File(s)	Summary
Enforcement workflow flow .github/workflows/enforce-pr-target.yml	Adds contents: write, makes draft and ready-state conversions best-effort, updates failure messaging, and always fails wrong-target checks.
Workflow behavior validation .github/scripts/enforce-pr-target.test.cjs, tests/ci-workflows.test.ts	Validates permissions, mutation ordering, state flags, conversion-failure warnings, restoration messaging, and setFailed behavior.
Validator workflow integration .github/workflows/issue-quality-tests.yml	Adds enforcement paths to workflow filters and runs the enforcement validator test.

Issue quality validation

Layer / File(s)	Summary
Bug validation rules .github/scripts/issue-quality.cjs	Detects unusable versions and terse reproductions, distinguishes new and legacy forms, and validates Version, reproduction, and operating-system fields for new bug reports.
Bug validation test coverage .github/scripts/issue-quality.test.cjs	Adds cases for unknown versions, vague reproductions, placeholder operating systems, and helper normalization behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• lidge-jun/opencodex#423: Overlaps in Version placeholder detection and issue-quality validation.
• lidge-jun/opencodex#523: Extends related validateIssue invalid-pattern handling.
• lidge-jun/opencodex#600: Also modifies bug reproduction-quality validation and its tests.

Suggested reviewers: lidge-jun, ingwannu

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant GitHubAPI
  participant PRComment
  participant RequiredCheck
  GitHubActions->>GitHubAPI: Attempt draft conversion
  GitHubAPI-->>GitHubActions: Success or failure
  GitHubActions->>PRComment: Upsert wrong-target explanation
  GitHubActions->>RequiredCheck: Mark check failed

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the two main changes: PR target draft conversion hardening and stricter issue-quality Version validation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Wibias]

Security review (maintainer, merge gate)

pull_request_target + contents: write is intentional for convertPullRequestToDraft / markPullRequestReadyForReview with GITHUB_TOKEN (#626). Workflow does not check out PR head (asserted in tests). Mutations are PR metadata only (title/draft/comment). No medium+ findings blocking merge.

[Wibias]

Transition complete

• Landed on dev as squash 14dde562.
• Carried onto dev2-go via fix(ci): carry PR-target/issue-quality harden onto dev2-go (#631) #677 (squash of cherry-pick a25d4236).

Go decision

No Go counterpart — CI workflows (.github/workflows/*), issue-quality scripts, and TS CI tests only. Recorded on the dev merge message and on #677.