[dolfim-ibm]

Stacked on #4639. Review that PR first. After it merges, the base of this PR changes to main.

This PR extends the AI PR Triage workflow with a first review by Bob Shell. The trust model of #4639 stays the same: no PR code is checked out or run, the model job has no write token, and a separate job without an LLM validates and posts the result.

What it does

• prepare-review (read-only token, in the prepare job):
  • Stores the PR versions of changed source files as plain text. Dot-folders are renamed and every file gets a .txt suffix, so a PR's AGENTS.md or .bob/custom_modes.yaml is never loaded as agent configuration.
  • Writes the valid inline-comment anchors (head-side diff lines).
  • After an earlier AI review, writes the diff since the reviewed commit and the earlier bot comments, so the next review covers only new commits. After a force-push, it does a full review.
  • It skips PRs with more than 60 source files or 2000 changed source lines, and commits that it already reviewed.
• review (contents: read): it skips PRs that the triage rated as duplicate. It runs Bob Shell in the read-only docling-pr-review mode with the repository review skill. The model reviews the code but does not claim test results. The answer is valid only if every finding names a changed file, a line, and a known severity.
• publish-review (write token, no LLM): posts one COMMENT review. It never approves and never requests changes. Findings outside the diff lines go into the review body. It sets ai:review-lgtm (no blocker or major finding) or ai:review-changes.

Setup

• Optional variable: BOB_REVIEW_MAX_COST (default 3). A run that reaches the limit stops and posts no review. The check stays green.

Checklist:

• Documentation has been updated, if necessary. (.github/CI_LABELS.md)
• Examples have been added, if necessary.
• Tests have been added, if necessary.

Review evidence:

• uv run pytest tests/test_ai_pr_review.py tests/test_ai_pr_triage.py tests/test_groundtruth_diff.py: 21 passed.
• make validate: passed.
• I ran prepare-review locally against fix(docx): ignore XML comments and processing instructions #4627. It wrote 2 head files, 215 anchors, and incremental_base: null.
• Bob Shell 2.0.5, local run of the review step on the fix(docx): ignore XML comments and processing instructions #4627 data. It ended with status: success in 123 s, with 26 tool calls and a cost of 1.56. It wrote no files. extract accepted the answer.
  • The label was ai:review-changes, with a COMMENT event. All 4 findings were on valid diff lines and became inline comments.
  • The findings were checked against the code. The major finding is correct: bytes.replace in the test helper can do nothing, so the test can pass without injecting a comment. The nit finding is correct: one guard is redundant. The 2 minor findings are reasonable.
• Not run on GitHub: the review POST. The workflow runs only from main, because it uses pull_request_target.

[github-actions]

✅ DCO Check Passed

Thanks @dolfim-ibm, all your commits are properly signed off. 🎉

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[mergify]

Merge Protections

🟢 Merge protection satisfied — ready to merge.

Show 1 satisfied protection

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?(!)?: