feat(review): skip ignored auto-review authors

[joaovictor91123]

Summary

• Add review.auto_review.ignore_authors manifest parsing/schema/OpenAPI support and wire it into PR public-surface publishing so configured automation authors receive a quiet skipped check instead of a gate failure.
• Add a small review-eligibility helper plus parser/settings/API/queue tests covering ignored-author matches, malformed/capped config, no-check mode, and surface-off precedence.

Fixes #2060

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires >=99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Additional focused validation:

• npm test -- --run test/unit/review-eligibility.test.ts test/unit/focus-manifest.test.ts test/unit/settings-preview.test.ts test/unit/signals-coverage.test.ts
• npm test -- --run test/unit/queue.test.ts -t "ignored authors|surface_off precedence"
• npm test -- --run test/integration/api.test.ts -t "skipped PR audit"
• npm run ui:openapi
• npm pack --workspace @jsonbored/gittensory-mcp --dry-run --json

If any required check was skipped, explain why:

• npm run test:coverage exceeded the local timeout; focused and targeted coverage tests above passed for the changed paths, while CI will run the full shard/merge coverage gate.
• npm run test:mcp-pack failed locally before packaging under Node v24.16.0 when the script wrote an undefined spawn error stream; the underlying npm pack --workspace @jsonbored/gittensory-mcp --dry-run --json passed and listed the expected eight package files. The repo expects Node 22 in .nvmrc.
• npm run ui:lint was not run; no UI source changes were made, and ui:typecheck/ui:build/ui:openapi:check passed.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

No visible UI changes.

Notes

• This keeps ignored-author handling as a quiet review skip and preserves the existing no-visible-surface early return precedence.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.09%. Comparing base (6177270) to head (0f5fd98).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3508   +/-   ##
=======================================
  Coverage   93.08%   93.09%           
=======================================
  Files         300      301    +1     
  Lines       31416    31442   +26     
  Branches    11468    11478   +10     
=======================================
+ Hits        29244    29270   +26     
  Misses       1517     1517           
  Partials      655      655           

Files with missing lines	Coverage Δ
src/api/routes.ts	94.85% <100.00%> (+<0.01%)	⬆️
src/openapi/schemas.ts	100.00% <ø> (ø)
src/openapi/spec.ts	99.41% <ø> (ø)
src/queue/processors.ts	93.54% <100.00%> (+0.01%)	⬆️
src/review/review-eligibility.ts	100.00% <100.00%> (ø)
src/signals/focus-manifest.ts	98.82% <100.00%> (+<0.01%)	⬆️
src/signals/settings-preview.ts	98.52% <100.00%> (+0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 14:54:52 UTC}

14 files · 1 AI reviewer · no blockers · readiness 62/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The change adds manifest-driven `review.auto_review.ignore_authors` parsing plus a runtime eligibility check that skips public review output for matching authors, and the core queue tests cover the intended no-comment/no-gate-failure path. The main wiring is coherent: malformed config fails open, surface-off keeps precedence, and API/OpenAPI skip-reason enums were extended. I do see one likely integration gap in the settings preview surface: the decision type supports ignored-author patterns, but the visible diff does not show the API preview path resolving and passing the manifest value, so the preview can silently disagree with production unless that wiring exists outside the shown hunks.

Nits — 6 non-blocking

• src/signals/focus-manifest.ts:1897 has two adjacent block comments where the first one still describes enrichment toggles and now sits immediately above `resolveReviewAutoReviewConfig`; split or move the enrichment comment so generated docs/readers do not attach the wrong explanation to the new resolver.
• src/signals/settings-preview.ts:52 adds `ignoredAuthorPatterns` to `decidePublicSurface`, but the diff does not show the API/settings-preview caller resolving `review.auto_review.ignore_authors` and passing it; confirm that endpoint is wired or add the same `resolveReviewAutoReviewConfig(loadRepoFocusManifest(...))` flow there so preview matches production.
• src/review/review-eligibility.ts:1 reuses `matchesManifestPath` for author logins, which intentionally gives path-prefix behavior such as `apps/renovate` matching `apps/renovate/nightly`; that is tested, but it is surprising for a GitHub login field, so add a short comment or rename the helper wrapper to make the inherited semantics explicit.
• test/unit/queue.test.ts:13040 uses a literal installation token in a fetch stub; it is not a real secret, but naming it `test-installation-token` would avoid secret-scanner noise and make the fixture intent clearer.
• Wire the settings/API preview caller to pass `ignoredAuthorPatterns` from `resolveReviewAutoReviewConfig`, or add a focused test proving the preview endpoint returns `ignored_author` for a repo manifest with `review.auto_review.ignore_authors`.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2060
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 114 registered-repo PR(s), 60 merged, 8 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	joaovictor91123; Gittensor profile; 114 PR(s), 8 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: joaovictor91123
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 114 PR(s), 8 issue(s).
• Related work: Titles/paths share 7 meaningful terms. (issue #2046, issue #2051)
• Related work: Titles/paths share 10 meaningful terms. (issue #2060, issue #2061)
• Related work: Titles/paths share 8 meaningful terms. (issue #2060, issue #2066)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.