@openhands/extensions 0.27.0 → 0.29.0

package/skills/github-pr-reviewer/scripts/worker.py

@@ -27,6 +27,11 @@ from maintainer_handoff import (
 # every current-head check and workflow run, so a red head still blocks.
 CHECK_GATE_MARKER = "<!-- openhands-review-gate:"
 NON_BLOCKING_CHECK_CONCLUSIONS = frozenset({"success", "neutral", "skipped"})
+# GitHub parks a fork head's workflow runs at this conclusion until a maintainer
+# approves them. Such a run is waiting on a person, not failing, so the gate
+# lists it as waiting with this note and its explanation asks for the approval.
+AWAITING_APPROVAL_CONCLUSION = "action_required"
+AWAITING_APPROVAL_NOTE = " (awaiting maintainer approval)"
 # The gate is deterministic; this disclosure is what tells a reader no model ran.
 WORKFLOW_DISCLOSURE = "no AI was used to generate this comment"
 
@@ -98,7 +103,8 @@ class ReviewIntake:
                     flush=True,
                 )
                 continue
-            if result["disposition"] == "created":
+            # A retried conversation runs again, so it uses a slot like a new one.
+            if result["disposition"] in ("created", "retried"):
                 self._started += 1
         if failures:
             raise RuntimeError(
@@ -283,7 +289,7 @@ class PullRequestReviewer(GitHubRepository):
             f"second result.{self_review_note}"
         )
 
-    def _finish_completed_review(self, pr, trigger, label=None):
+    def _finish_completed_review(self, pr, trigger, label=None, submitted_review=None):
         """Complete an exact-head review, including an optional human handoff.
 
         `trigger` is the event the current work is keyed on. It is None for an
@@ -291,7 +297,11 @@ class PullRequestReviewer(GitHubRepository):
         is the whole key, so any submitted review by this account on the current
         head is the completion of that work. That is what lets an unrequested
         review the scan started be reconciled and handed off on a later scan
-        instead of being restarted.
+        instead of being restarted. `submitted_review` is the review a
+        `submitted` delivery reports. It can predate the latest
+        `review_requested` event, so it is found by id rather than by the
+        trigger window; this account's later reviews of the head still count, so
+        a newer verdict supersedes it. A dismissed review completes nothing.
         """
         head_sha = pr["head"]["sha"]
         if trigger is not None:
@@ -299,14 +309,35 @@ class PullRequestReviewer(GitHubRepository):
         else:
             triggered_at = ""
         reviews = self.gh_pages(f"/pulls/{pr['number']}/reviews")
-        completed = [
+        mine = [
             review
             for review in reviews
             if review.get("commit_id") == head_sha
             and ((review.get("user") or {}).get("login") or "").lower()
             == self.github_login.lower()
-            and (review.get("submitted_at") or "") > triggered_at
+            and (review.get("state") or "").upper() != "DISMISSED"
         ]
+        if submitted_review and submitted_review.get("id") is not None:
+            reported = next(
+                (review for review in mine if review.get("id") == submitted_review["id"]),
+                None,
+            )
+            reported_at = (reported or {}).get("submitted_at") or ""
+            completed = (
+                []
+                if reported is None
+                else [
+                    review
+                    for review in mine
+                    if (review.get("submitted_at") or "") >= reported_at
+                ]
+            )
+        else:
+            completed = [
+                review
+                for review in mine
+                if (review.get("submitted_at") or "") > triggered_at
+            ]
         if not completed:
             return False
         approved = None
@@ -482,16 +513,19 @@ class PullRequestReviewer(GitHubRepository):
 
         A completed run whose conclusion is neither blocking nor explicitly
         non-blocking fails closed, so an unknown conclusion cannot silently
-        approve a PR. A run that has not completed means waiting, never
-        approval.
+        approve a PR. A run that has not completed, or one awaiting a
+        maintainer's approval to run, means waiting, never approval.
         """
         blocking, pending = [], []
         for run in reporters:
             name = run.get("name") or "unnamed check"
             status = (run.get("status") or "").lower()
+            conclusion = (run.get("conclusion") or "").lower()
             if status != "completed":
                 pending.append(name)
-            elif (run.get("conclusion") or "").lower() in NON_BLOCKING_CHECK_CONCLUSIONS:
+            elif conclusion == AWAITING_APPROVAL_CONCLUSION:
+                pending.append(f"{name}{AWAITING_APPROVAL_NOTE}")
+            elif conclusion in NON_BLOCKING_CHECK_CONCLUSIONS:
                 continue
             else:
                 blocking.append(name)
@@ -650,10 +684,10 @@ class PullRequestReviewer(GitHubRepository):
         short = sha[:12]
         listed = "\n".join(f"- `{name}`" for name in names)
         if state == "blocked":
-            heading = "### ⚠️ Review paused: current-head checks failed"
+            heading = "### ⚠️ Review paused: current-head checks did not pass"
             lead = (
-                f"The current head `{short}` has failing checks, so no review "
-                "conversation was started:"
+                f"The current head `{short}` has checks that did not pass, so no "
+                "review conversation was started:"
             )
             action = (
                 "Fix the checks above and push. The scheduled scan then starts "
@@ -665,6 +699,25 @@ class PullRequestReviewer(GitHubRepository):
                 "second request while the first is still outstanding. The review "
                 "starts on the updated head."
             )
+        elif any(name.endswith(AWAITING_APPROVAL_NOTE) for name in names):
+            heading = "### ⏳ Review waiting on workflow approval"
+            lead = (
+                f"The current head `{short}` has workflow runs that GitHub holds "
+                "until a maintainer approves them, or checks that have not "
+                "finished, so no review conversation was started:"
+            )
+            action = (
+                "A maintainer needs to approve the workflow runs marked above. "
+                "The scheduled scan retries once every check on the head reports "
+                "a conclusion."
+                if scheduled
+                else "A maintainer needs to approve the workflow runs marked "
+                "above. Once every check on the head reports a conclusion, "
+                f"remove the outstanding `{self.trigger_reviewer}` request and "
+                f"request `{self.trigger_reviewer}` again: GitHub will not "
+                "accept a second request while the first is still outstanding. "
+                "That starts the review."
+            )
         else:
             heading = "### ⏳ Review waiting on checks"
             lead = (
@@ -858,6 +911,11 @@ class PullRequestReviewer(GitHubRepository):
         for candidate in prs:
             try:
                 pr = self.gh("GET", f"/pulls/{candidate['number']}")
+                submitted_review = (
+                    payload.get("review")
+                    if event_mode and payload.get("action") == "submitted"
+                    else None
+                )
                 has_label = label in {
                     item["name"] for item in pr.get("labels", [])
                 }
@@ -894,7 +952,11 @@ class PullRequestReviewer(GitHubRepository):
                     delivery_key = self._unrequested_head(pr)
                     unrequested_candidate = True
                 if trigger is None and delivery_key is None:
-                    continue
+                    # A submitted review is its own completion signal: its
+                    # request can predate the issue-event window, and that
+                    # review must still be reconciled.
+                    if submitted_review is None:
+                        continue
                 # A head this account already reviewed, with no clarifying
                 # comment since, is done: another conversation would publish a
                 # second review of identical code. This must come before the
@@ -918,7 +980,7 @@ class PullRequestReviewer(GitHubRepository):
                         ),
                         flush=True,
                     )
-                    if trigger is not None:
+                    if trigger is not None or submitted_review is not None:
                         # Reconcile the completed review (clearing the label and
                         # running the maintainer handoff) where the review is
                         # this trigger's result. When it predates the trigger -
@@ -927,7 +989,7 @@ class PullRequestReviewer(GitHubRepository):
                         # otherwise the label stays and every later scan re-reads
                         # this head and re-logs with no effect.
                         if not self._finish_completed_review(
-                            pr, trigger, trigger_label
+                            pr, trigger, trigger_label, submitted_review
                         ) and trigger_label:
                             self.gh(
                                 "DELETE",
@@ -936,7 +998,7 @@ class PullRequestReviewer(GitHubRepository):
                             )
                     continue
                 if delivery_key is None and self._finish_completed_review(
-                    pr, trigger, trigger_label
+                    pr, trigger, trigger_label, submitted_review
                 ):
                     continue
                 if event_mode and payload.get("action") == "submitted":

package/skills/github-pr-reviewer/tests/test_main.py

@@ -538,6 +538,29 @@ class TestRepoReviewGuide(unittest.TestCase):
         self.assertIn("Do not add speculative or out-of-scope notes", prompt)
         self.assertIn("forbids the configured bot from approving its own PR", prompt)
 
+    def test_prompt_requires_live_ui_evidence_before_approval(self):
+        prompt = main._build_review_prompt(
+            "owner/repo",
+            self._pr(),
+            "0123456789abcdef",
+            {"id": "1", "created_at": "t"},
+        )
+
+        # The gate sits after the finding-quality rules and before the review is
+        # published, so a missing capture is a blocking finding, not a note.
+        gate = prompt.index("LIVE EVIDENCE GATE")
+        self.assertLess(prompt.index("Ground every finding"), gate)
+        self.assertLess(gate, prompt.index("Publish one review"))
+        self.assertIn("user-visible UI behavior", prompt)
+        self.assertIn("real running application", prompt)
+        self.assertIn("production-facing path", prompt)
+        self.assertIn("CSS-token", prompt)
+        self.assertIn("generated mockups", prompt)
+        self.assertIn("reconstructed", prompt)
+        self.assertIn("never substitute for the required live evidence", prompt)
+        self.assertIn("names exactly which live evidence is missing", prompt)
+        self.assertIn("`🔄 CHANGES REQUESTED`", prompt)
+
     def test_prompt_requires_refreshing_mutable_github_state(self):
         """A resumed conversation must not trust an earlier turn's observations."""
         prompt = main._build_review_prompt(

package/skills/gitlab/README.md

@@ -11,6 +11,8 @@ This skill is activated by the following keywords:
 
 ## Details
 
+Use authenticated GitLab MCP tools first when they are available in the agent's environment. Detect the connection through tool availability rather than a particular server name. Fall back to the documented `GITLAB_TOKEN` and direct API flow when those tools are unavailable or raw API or `curl` access is explicitly needed.
+
 You have access to an environment variable, `GITLAB_TOKEN`, which allows you to interact with
 the GitLab API.
 
@@ -34,4 +36,4 @@ Here are some instructions for pushing, but ONLY do this if the user asks you to
 ```bash
 git remote -v && git branch # to find the current org, repo and branch
 git checkout -b create-widget && git add . && git commit -m "Create widget" && git push -u origin create-widget
-```
+```

package/skills/gitlab/SKILL.md

@@ -5,6 +5,10 @@ triggers:
 - gitlab
 ---
 
+## Connection selection
+
+Use authenticated GitLab MCP tools first when they are available in the agent's environment. Detect this by tool availability, without depending on a particular MCP server name. Use the token and direct API instructions below only when GitLab MCP tools are unavailable or when raw API or `curl` access is explicitly needed.
+
 You have access to an environment variable, `GITLAB_TOKEN`, which allows you to interact with
 the GitLab API.