@ai-sdlc/orchestrator 0.13.0 → 0.15.0

package/dist/cli/commands/init-templates.d.ts

@@ -42,16 +42,56 @@ export declare const AI_SDLC_GATE_WORKFLOW = "name: AI-SDLC PR Ready Gate\n\n# S
  */
 export declare const VERIFY_ATTESTATION_WORKFLOW = "name: AI-SDLC Verify Review Attestation\n\n# Reads the DSSE attestation at .ai-sdlc/attestations/<head-sha>.dsse.json\n# and verifies the signature against any-of-N pubkeys in\n# .ai-sdlc/trusted-reviewers.yaml.\n#\n# AUDIT-ONLY: this workflow logs verification results (success/failure with\n# reason) for forensic purposes but does NOT post a required commit status.\n# The single merge gate is `ai-sdlc/pr-ready` from ai-sdlc-gate.yml.\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n    branches: [main]\n    paths-ignore:\n      - 'docs/**'\n      - '*.md'\n  merge_group:\n    types: [checks_requested]\n\nconcurrency:\n  group: verify-attestation-${{ github.event.pull_request.number || github.event.merge_group.head_sha }}\n  cancel-in-progress: true\n\njobs:\n  verify:\n    name: Verify attestation\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - name: Resolve subject SHA + base SHA from event payload\n        id: resolve\n        run: |\n          if [ \"${{ github.event_name }}\" = \"merge_group\" ]; then\n            echo \"head_sha=${{ github.event.merge_group.head_sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.merge_group.base_sha }}\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"head_sha=${{ github.event.pull_request.head.sha }}\" >> \"$GITHUB_OUTPUT\"\n            echo \"base_sha=${{ github.event.pull_request.base.sha }}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n          ref: ${{ steps.resolve.outputs.head_sha }}\n\n      - name: Log audit result\n        env:\n          HEAD_SHA: ${{ steps.resolve.outputs.head_sha }}\n        run: |\n          if [ -f \".ai-sdlc/attestations/${HEAD_SHA}.dsse.json\" ]; then\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 envelope present at ${HEAD_SHA}\"\n          else\n            echo \"::notice::ai-sdlc attestation AUDIT \u2014 no envelope on ${HEAD_SHA} (audit-only, not blocking)\"\n          fi\n";
 /**
- * `.husky/pre-push` snippet that signs an attestation when one is missing
- * for the current HEAD. Installed when `--with-attestation` is opted in;
- * the actual `sign-attestation.mjs` script ships separately with the
- * orchestrator and is referenced by the canonical command stub here.
+ * `.husky/pre-push` (or `.git/hooks/pre-push` for non-husky repos) snippet
+ * that signs an attestation when one is missing for the current HEAD.
+ * Installed when `--with-attestation` is opted in.
+ *
+ * AISDLC-555: pre-fix, this snippet checked ONLY `./scripts/check-attestation-
+ * sign.sh` — a path that exists in the ai-sdlc monorepo (where the hook is
+ * hand-authored, not wizard-generated) but NEVER in an adopter repo, because
+ * nothing ever copied that script there. The `[ -x ... ]` guard silently
+ * failed forever, so `--with-attestation` produced a hook that looked
+ * complete but never signed anything — the exact bug this task exists to
+ * fix. `check-attestation-sign.sh` now also ships under
+ * `ai-sdlc-plugin/scripts/` (AISDLC-555), so this snippet resolves it from
+ * the PLUGIN INSTALL ONLY: `$CLAUDE_PLUGIN_ROOT` / `$CLAUDE_PLUGIN_DIR` (the
+ * zero-config path when `git push` runs inside a Claude Code session), then a
+ * read-only plugin-cache probe (bare-terminal `git push`, which never inherits
+ * those env vars).
+ *
+ * There is deliberately NO repo-local tier — see item 2 below. An earlier
+ * revision of this docblock described one, which contradicted the code and,
+ * worse, advertised a resolution order that was removed for security.
+ *
+ * Review round 1 (AISDLC-555) — TWO deliberate changes here, both correcting
+ * the first version of this fix:
+ *
+ * 1. **It is no longer silent when nothing resolves.** The original ended in a
+ *    bare `if [ -n "$HOOK" ]; then bash ...; fi` with no else, so an adopter
+ *    who installed via `npm i -g @ai-sdlc/orchestrator` (the documented
+ *    getting-started path) and never installed the Claude Code plugin got a
+ *    hook that could never fire and never said so — reproducing the exact
+ *    defect this task exists to close, for a whole adopter persona.
+ *    `ai-sdlc-plugin/` is not published to npm and orchestrator's `files` is
+ *    `["dist"]`, so none of the tiers can resolve in that setup.
+ *
+ *    Silence is still correct when there is nothing to sign, so the diagnostic
+ *    fires only when `.ai-sdlc/verdicts/` is non-empty: reviewers ran, an
+ *    envelope is owed, and none will be produced. That is the state an
+ *    operator must never discover months later.
+ *
+ * 2. **The repo-relative tier was removed.** It previously preferred
+ *    `./scripts/check-attestation-sign.sh` from the working tree, which put
+ *    repo-tracked content on the push-time execution path with the operator's
+ *    Ed25519 signing key in scope — a contributor could land that file and
+ *    have it run as the maintainer on their next push. Resolution is now only
+ *    from the plugin install (env vars, then the read-only cache probe).
  *
  * Adopters typically already have a `.husky/pre-push` from their existing
  * tooling; the wizard appends our snippet behind a sentinel so we can
  * extend an existing hook without trampling user content.
  */
-export declare const HUSKY_PREPUSH_SIGN_SNIPPET = "# ai-sdlc:attestation-sign-block\n# Signs the DSSE attestation envelope for the current HEAD when verdict\n# files exist. Skip with AI_SDLC_SKIP_ATTESTATION_SIGN=1.\nif [ -z \"${AI_SDLC_SKIP_ATTESTATION_SIGN:-}\" ] && [ -x \"./scripts/check-attestation-sign.sh\" ]; then\n  ./scripts/check-attestation-sign.sh\nfi\n# end ai-sdlc:attestation-sign-block\n";
+export declare const HUSKY_PREPUSH_SIGN_SNIPPET = "# ai-sdlc:attestation-sign-block\n# Signs the DSSE attestation envelope for the current HEAD when verdict\n# files exist. Skip with AI_SDLC_SKIP_ATTESTATION_SIGN=1.\nif [ -z \"${AI_SDLC_SKIP_ATTESTATION_SIGN:-}\" ]; then\n  AI_SDLC_ATTESTATION_HOOK=\"\"\n  if [ -n \"${CLAUDE_PLUGIN_ROOT:-}\" ] && [ -f \"${CLAUDE_PLUGIN_ROOT}/scripts/check-attestation-sign.sh\" ]; then\n    AI_SDLC_ATTESTATION_HOOK=\"${CLAUDE_PLUGIN_ROOT}/scripts/check-attestation-sign.sh\"\n  elif [ -n \"${CLAUDE_PLUGIN_DIR:-}\" ] && [ -f \"${CLAUDE_PLUGIN_DIR}/scripts/check-attestation-sign.sh\" ]; then\n    AI_SDLC_ATTESTATION_HOOK=\"${CLAUDE_PLUGIN_DIR}/scripts/check-attestation-sign.sh\"\n  else\n    for _ai_sdlc_dir in \"$HOME\"/.claude/plugins/cache/*/ai-sdlc/*/; do\n      if [ -f \"${_ai_sdlc_dir}scripts/check-attestation-sign.sh\" ]; then\n        AI_SDLC_ATTESTATION_HOOK=\"${_ai_sdlc_dir}scripts/check-attestation-sign.sh\"\n        break\n      fi\n    done\n  fi\n  if [ -n \"$AI_SDLC_ATTESTATION_HOOK\" ]; then\n    echo \"[ai-sdlc] attestation signer: $AI_SDLC_ATTESTATION_HOOK\" >&2\n    bash \"$AI_SDLC_ATTESTATION_HOOK\"\n  elif [ -n \"$(ls -A .ai-sdlc/verdicts 2>/dev/null)\" ]; then\n    echo \"[ai-sdlc] ERROR: reviewer verdicts exist under .ai-sdlc/verdicts/ but NO attestation signer\" >&2\n    echo \"[ai-sdlc]   could be found \u2014 this push will carry no attestation.\" >&2\n    echo \"[ai-sdlc]   Searched CLAUDE_PLUGIN_ROOT, CLAUDE_PLUGIN_DIR, and\" >&2\n    echo \"[ai-sdlc]   ~/.claude/plugins/cache/*/ai-sdlc/*/scripts/check-attestation-sign.sh\" >&2\n    echo \"[ai-sdlc]   Install the ai-sdlc Claude Code plugin, or set CLAUDE_PLUGIN_ROOT.\" >&2\n  fi\nfi\n# end ai-sdlc:attestation-sign-block\n";
 /**
  * `.ai-sdlc/trusted-reviewers.yaml` stub — empty allowlist with operator
  * instructions. The wizard scaffolds this so adopters have a single file

package/dist/cli/commands/init-templates.js

@@ -207,10 +207,50 @@ jobs:
           fi
 `;
 /**
- * `.husky/pre-push` snippet that signs an attestation when one is missing
- * for the current HEAD. Installed when `--with-attestation` is opted in;
- * the actual `sign-attestation.mjs` script ships separately with the
- * orchestrator and is referenced by the canonical command stub here.
+ * `.husky/pre-push` (or `.git/hooks/pre-push` for non-husky repos) snippet
+ * that signs an attestation when one is missing for the current HEAD.
+ * Installed when `--with-attestation` is opted in.
+ *
+ * AISDLC-555: pre-fix, this snippet checked ONLY `./scripts/check-attestation-
+ * sign.sh` — a path that exists in the ai-sdlc monorepo (where the hook is
+ * hand-authored, not wizard-generated) but NEVER in an adopter repo, because
+ * nothing ever copied that script there. The `[ -x ... ]` guard silently
+ * failed forever, so `--with-attestation` produced a hook that looked
+ * complete but never signed anything — the exact bug this task exists to
+ * fix. `check-attestation-sign.sh` now also ships under
+ * `ai-sdlc-plugin/scripts/` (AISDLC-555), so this snippet resolves it from
+ * the PLUGIN INSTALL ONLY: `$CLAUDE_PLUGIN_ROOT` / `$CLAUDE_PLUGIN_DIR` (the
+ * zero-config path when `git push` runs inside a Claude Code session), then a
+ * read-only plugin-cache probe (bare-terminal `git push`, which never inherits
+ * those env vars).
+ *
+ * There is deliberately NO repo-local tier — see item 2 below. An earlier
+ * revision of this docblock described one, which contradicted the code and,
+ * worse, advertised a resolution order that was removed for security.
+ *
+ * Review round 1 (AISDLC-555) — TWO deliberate changes here, both correcting
+ * the first version of this fix:
+ *
+ * 1. **It is no longer silent when nothing resolves.** The original ended in a
+ *    bare `if [ -n "$HOOK" ]; then bash ...; fi` with no else, so an adopter
+ *    who installed via `npm i -g @ai-sdlc/orchestrator` (the documented
+ *    getting-started path) and never installed the Claude Code plugin got a
+ *    hook that could never fire and never said so — reproducing the exact
+ *    defect this task exists to close, for a whole adopter persona.
+ *    `ai-sdlc-plugin/` is not published to npm and orchestrator's `files` is
+ *    `["dist"]`, so none of the tiers can resolve in that setup.
+ *
+ *    Silence is still correct when there is nothing to sign, so the diagnostic
+ *    fires only when `.ai-sdlc/verdicts/` is non-empty: reviewers ran, an
+ *    envelope is owed, and none will be produced. That is the state an
+ *    operator must never discover months later.
+ *
+ * 2. **The repo-relative tier was removed.** It previously preferred
+ *    `./scripts/check-attestation-sign.sh` from the working tree, which put
+ *    repo-tracked content on the push-time execution path with the operator's
+ *    Ed25519 signing key in scope — a contributor could land that file and
+ *    have it run as the maintainer on their next push. Resolution is now only
+ *    from the plugin install (env vars, then the read-only cache probe).
  *
  * Adopters typically already have a `.husky/pre-push` from their existing
  * tooling; the wizard appends our snippet behind a sentinel so we can
@@ -219,8 +259,30 @@ jobs:
 export const HUSKY_PREPUSH_SIGN_SNIPPET = `# ai-sdlc:attestation-sign-block
 # Signs the DSSE attestation envelope for the current HEAD when verdict
 # files exist. Skip with AI_SDLC_SKIP_ATTESTATION_SIGN=1.
-if [ -z "\${AI_SDLC_SKIP_ATTESTATION_SIGN:-}" ] && [ -x "./scripts/check-attestation-sign.sh" ]; then
-  ./scripts/check-attestation-sign.sh
+if [ -z "\${AI_SDLC_SKIP_ATTESTATION_SIGN:-}" ]; then
+  AI_SDLC_ATTESTATION_HOOK=""
+  if [ -n "\${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "\${CLAUDE_PLUGIN_ROOT}/scripts/check-attestation-sign.sh" ]; then
+    AI_SDLC_ATTESTATION_HOOK="\${CLAUDE_PLUGIN_ROOT}/scripts/check-attestation-sign.sh"
+  elif [ -n "\${CLAUDE_PLUGIN_DIR:-}" ] && [ -f "\${CLAUDE_PLUGIN_DIR}/scripts/check-attestation-sign.sh" ]; then
+    AI_SDLC_ATTESTATION_HOOK="\${CLAUDE_PLUGIN_DIR}/scripts/check-attestation-sign.sh"
+  else
+    for _ai_sdlc_dir in "$HOME"/.claude/plugins/cache/*/ai-sdlc/*/; do
+      if [ -f "\${_ai_sdlc_dir}scripts/check-attestation-sign.sh" ]; then
+        AI_SDLC_ATTESTATION_HOOK="\${_ai_sdlc_dir}scripts/check-attestation-sign.sh"
+        break
+      fi
+    done
+  fi
+  if [ -n "$AI_SDLC_ATTESTATION_HOOK" ]; then
+    echo "[ai-sdlc] attestation signer: $AI_SDLC_ATTESTATION_HOOK" >&2
+    bash "$AI_SDLC_ATTESTATION_HOOK"
+  elif [ -n "$(ls -A .ai-sdlc/verdicts 2>/dev/null)" ]; then
+    echo "[ai-sdlc] ERROR: reviewer verdicts exist under .ai-sdlc/verdicts/ but NO attestation signer" >&2
+    echo "[ai-sdlc]   could be found — this push will carry no attestation." >&2
+    echo "[ai-sdlc]   Searched CLAUDE_PLUGIN_ROOT, CLAUDE_PLUGIN_DIR, and" >&2
+    echo "[ai-sdlc]   ~/.claude/plugins/cache/*/ai-sdlc/*/scripts/check-attestation-sign.sh" >&2
+    echo "[ai-sdlc]   Install the ai-sdlc Claude Code plugin, or set CLAUDE_PLUGIN_ROOT." >&2
+  fi
 fi
 # end ai-sdlc:attestation-sign-block
 `;
@@ -857,6 +919,18 @@ export const ATTESTATION_TEMPLATES = {
         // first PR's envelope lands cleanly without "directory does not exist"
         // errors from the signing script.
         '.ai-sdlc/attestations/.gitkeep': '',
+        // AISDLC-555 (partial AC #7): the pre-push hook's gate condition reads
+        // `.ai-sdlc/verdicts/<task-id>.json` — tightly coupled to attestation,
+        // so it's scaffolded here rather than deferred to a separate
+        // init-orchestration task. Dispatch Board directories + dispatch-
+        // config.yaml (the rest of the widened AC #7 scope) are NOT scaffolded
+        // here, and — confirmed by round-2 review — NO backlog task currently
+        // owns them: nothing under `backlog/tasks/` mentions dispatch-config.yaml.
+        // An earlier revision of this comment cited AISDLC-560; that task covers
+        // attestation enforcement/doctor and says nothing about the Dispatch
+        // Board, so the citation was wrong. Left explicitly unowned rather than
+        // pointed at a task that would not deliver it.
+        '.ai-sdlc/verdicts/.gitkeep': '',
     },
 };
 export const CLASSIFIER_TEMPLATES = {

package/dist/cycle-utils.js

@@ -6,9 +6,22 @@ import { NOTIFICATION_TITLES } from './defaults.js';
 /**
  * Sanitize template content to prevent markdown/HTML injection.
  * Strips HTML tags and limits length.
+ *
+ * A single-pass `<[^>]*>` strip is flagged by CodeQL as
+ * `js/incomplete-multi-character-sanitization` (alert #65) because a
+ * crafted string like `<scr<script>ipt>` leaves `<script>` after one pass.
+ * We iterate the replacement until stable so any re-introduced bad
+ * substring is eliminated on the next pass — making the sanitization
+ * demonstrably idempotent.
  */
 function sanitizeTemplate(text) {
-    return text.replace(/<[^>]*>/g, '').slice(0, 2000);
+    let prev;
+    let current = text;
+    do {
+        prev = current;
+        current = prev.replace(/<[^>]*>/g, '');
+    } while (current !== prev);
+    return current.slice(0, 2000);
 }
 /**
  * Check for pipeline cycles and post notification if detected.

package/dist/execute.js

@@ -12,7 +12,7 @@ import { validateAgentOutput } from './validate-agent-output.js';
 import { createLogger } from './logger.js';
 import { createStructuredConsoleLogger, createStructuredBufferLogger, } from './structured-logger.js';
 import { createRunnerRegistry, resolveRunner } from './runners/runner-registry.js';
-import { execFileAsync, getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, isAutonomousStrategy, recordMetric, evaluatePipelineCompliance, authorizeFilesChanged, interpolateBranchPattern, interpolatePRTitle, issueIdToNumber, formatIssueRef, buildIssueTemplateVars, } from './shared.js';
+import { execFileAsync, getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, isAutonomousStrategy, recordMetric, evaluatePipelineCompliance, authorizeFilesChanged, interpolateBranchPattern, interpolatePRTitle, issueIdToNumber, formatIssueRef, buildIssueTemplateVars, validateBranchName, } from './shared.js';
 import { cleanGitEnv } from './runtime/git-env.js';
 import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, classifyAndSubmitApproval, createPipelineSecurity, } from './security.js';
 import { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, } from './orchestration.js';
@@ -307,7 +307,7 @@ export async function pushBranchWithRebase(workDir, branchName, log) {
             /* nothing to abort */
         }
         throw new Error(`Push rebase failed for branch ${branchName}: ${rebaseErr.message}. ` +
-            `Resolve conflicts manually and re-run the pipeline.`);
+            `Resolve conflicts manually and re-run the pipeline.`, { cause: rebaseErr });
     }
     await execFileAsync('git', ['push', 'origin', branchName], { cwd: workDir, env });
     return false;
@@ -453,6 +453,10 @@ async function executePipelineBody(issueId, issue, config, qualityGate, agentRol
     // 7. Create branch and checkout locally (read pattern from pipeline config)
     const branchVars = buildIssueTemplateVars(issueId, issue.title);
     const branchName = interpolateBranchPattern(config.pipeline?.spec.branching?.pattern, branchVars);
+    // Defense against second-order command injection: reject branch names that
+    // start with '-' (git flag injection) or contain chars outside the safe ref
+    // charset. CodeQL alert #167 (js/second-order-command-line-injection).
+    validateBranchName(branchName);
     await sc.createBranch({ name: branchName });
     // cleanGitEnv() prevents leaked GIT_DIR from corrupting these calls (AISDLC-72).
     // Guard: skip fetch when no 'origin' remote is configured (local-only repos).
@@ -1013,8 +1017,13 @@ async function executePipelineBody(issueId, issue, config, qualityGate, agentRol
         details: { averageCoverage: avgCoverage, frameworks: complianceReports.length },
     });
     // 16b. Extended diagnostics (non-blocking)
+    // Awaited so that every async operation started inside the diagnostics pass
+    // completes before executePipeline returns. Without the await, fire-and-forget
+    // promises (resolveAdapterFromGit, scanPipelineAdapters, loadAuditEntries) stay
+    // pending past the function boundary and can fire into a closed vitest worker
+    // MessagePort, producing ERR_IPC_CHANNEL_CLOSED (AISDLC-542).
     try {
-        runPipelineDiagnostics({
+        await runPipelineDiagnostics({
             config,
             qualityGate,
             agentRole,
@@ -1083,9 +1092,15 @@ async function executePipelineBody(issueId, issue, config, qualityGate, agentRol
 /**
  * Non-blocking diagnostics pass that exercises all previously unwired modules.
  * Runs after the main pipeline succeeds — failures are silently ignored.
+ *
+ * Returns a Promise so the caller can await all async work, preventing dangling
+ * promises from outliving the pipeline call and firing into a closed vitest
+ * worker MessagePort (AISDLC-542: ERR_IPC_CHANNEL_CLOSED teardown race).
  */
-function runPipelineDiagnostics(input) {
+async function runPipelineDiagnostics(input) {
     const { config, qualityGate, agentRole, autonomyPolicy, log } = input;
+    // Collect async operations; await all at the end so no promise escapes the function.
+    const asyncOps = [];
     // Policy evaluators: Rego, CEL, ABAC, gate evaluation, complexity scoring
     const _rego = createPipelineRegoEvaluator();
     const _cel = createPipelineCELEvaluator();
@@ -1110,9 +1125,10 @@ function runPipelineDiagnostics(input) {
     const adapterRegistry = createPipelineAdapterRegistry();
     log.info(`Adapter registry: ${adapterRegistry.list().length} adapters registered`);
     const _bridge = createPipelineWebhookBridge();
-    // resolveAdapterFromGit and scanPipelineAdapters are async — fire and forget
-    void resolveAdapterFromGit('github:ai-sdlc-framework/ai-sdlc').catch(() => { });
-    void scanPipelineAdapters({ basePath: `${input.workDir}/.ai-sdlc/adapters` }).catch(() => { });
+    // Collect async ops instead of fire-and-forget — awaited below via Promise.allSettled
+    // so no pending promise outlives this function (AISDLC-542).
+    asyncOps.push(resolveAdapterFromGit('github:ai-sdlc-framework/ai-sdlc').catch(() => { }));
+    asyncOps.push(scanPipelineAdapters({ basePath: `${input.workDir}/.ai-sdlc/adapters` }).catch(() => { }));
     // Extended compliance: per-framework checks, control catalog, mappings
     const controlIds = getControlCatalog();
     const frameworks = listSupportedFrameworks();
@@ -1167,10 +1183,15 @@ function runPipelineDiagnostics(input) {
             resource: 'pipeline',
             decision: 'allowed',
         });
-        void loadAuditEntries(auditPath).catch(() => { });
+        // Collected into asyncOps — awaited below so the promise doesn't escape (AISDLC-542).
+        asyncOps.push(loadAuditEntries(auditPath).catch(() => { }));
         // Note: rotateAuditLog intentionally omitted — it truncates the file,
         // which would empty it before artifact upload can capture the contents.
     }
+    // Await all async diagnostic operations so no promise outlives this function.
+    // allSettled keeps the best-effort semantic: individual failures are silently swallowed,
+    // but the caller can await the diagnostics without unhandled rejections leaking.
+    await Promise.allSettled(asyncOps);
 }
 // ── Gitignore helper ─────────────────────────────────────────────────
 const RUNTIME_GITIGNORE_PATHS = ['.ai-sdlc/state.db', '.ai-sdlc/state/', '.ai-sdlc/audit.jsonl'];

package/dist/fix-review.js

@@ -67,7 +67,7 @@ export async function fetchReviewFindings(prNumber, injectedFindings, _secretSto
         reviews = JSON.parse(stdout);
     }
     catch (err) {
-        throw new Error(`Failed to parse review data from gh CLI: ${err instanceof Error ? err.message : String(err)}`);
+        throw new Error(`Failed to parse review data from gh CLI: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
     }
     const changesRequestedReviews = reviews.filter((r) => r.state === 'CHANGES_REQUESTED');
     if (changesRequestedReviews.length === 0) {