ci(ai-review): harden Argus per #4816 self-review

[bokelley]

Summary

Argus reviewed its own bootstrap PR (#4816) and flagged 5 real findings + 2 nits in the workflow. The smoke-test PR squash-merged the unhardened Argus to main (an artifact of how #4816 was branched off this PR). This PR now contains only the hardening delta on top of what landed via #4816.

Argus's findings, all addressed

#	Argus finding	Fix
1 (High)	Prompt-injection via paths-ignore + same-PR multi-file edits	Prompt loaded from \$BASE_SHA via git show, not the PR working tree. Plus a new workflow-mod gate that bails to --comment if the PR touches .github/ai-review/** or .github/workflows/ai-review.yml alongside other files.
2	Bash(gh api:*) wildcard	Narrowed to repos/*/pulls/*, repos/*/contents/*, repos/*/issues/*
3	Verifier matches any bot login	Pinned to aao-release-bot via ARGUS_BOT_LOGIN env var, in both verifier and skip-check
4	Unpinned action tags	All 4 actions pinned to commit SHAs (actions/checkout, create-github-app-token, github-script, claude-code-action) with version comment
5	Force-push + trivial-skip → stale approval	Documented as branch-protection requirement ("Require approval of the most recent reviewable push" on main) in workflow comments
Nit 1	macOS date fallback unreachable	Removed
Nit 2	Static heredoc sentinel	Randomized via openssl rand -hex 8

Self-attestation

This PR hits the new workflow-mod gate it adds — Argus will post a --comment, not --approve. That's by design. Needs human approval.

Branch protection requirement

Verify "Require approval of the most recent reviewable push" is enabled on main (Settings → Branches → main → Edit rule). Without it, the trivial-skip path can leave a stale bot approval after a force-push that touches only trivial paths.

Refs

• docs(release-notes): behaviour → behavior (Argus smoke test) #4816 — smoke test, posted Argus's self-review that drove these fixes
• Argus review on docs(release-notes): behaviour → behavior (Argus smoke test) #4816: docs(release-notes): behaviour → behavior (Argus smoke test) #4816 (review)
• Original Argus port already landed via docs(release-notes): behaviour → behavior (Argus smoke test) #4816 squash

🤖 Generated with Claude Code

[bokelley]

Reviewed during PR triage spin. The implementation is sound for what it claims (App-identity approval, branch filter, CI-green gate, idempotency, opt-out label, fast-fail on missing secrets). But two prerequisites need to land before this actually unblocks the routine bottleneck:

1. CODEOWNERS gate, not just review-count gate

Branch ruleset on main (id 8519441) has require_code_owner_review: true. CODEOWNERS lists only @bokelley for:

• /.agents/
• /.github/ and /.github/workflows/
• /static/schemas/source/
• /.changeset/

Every routine PR touches /.changeset/ (mandatory per CLAUDE.md), and most schema PRs touch /static/schemas/source/. The bot's approving review satisfies "1 approving review", but require_code_owner_review: true will still block merge — only @bokelley can be that owner today.

Three options:

• (a) Narrow CODEOWNERS — remove /.changeset/ from CODEOWNERS. Changesets are mechanical metadata, not security-sensitive; nothing in a .changeset/*.md file changes behavior. This single move would unblock the vast majority of routine PRs without weakening protection on prompts, workflows, or schemas. Cleanest path.

• (b) Add the Triage Bot App as a CODEOWNER on a narrow path (e.g. only /.changeset/). Same effective outcome as (a) but more conservative.

• (c) Disable require_code_owner_review. Don't recommend — loses the security model for .github/workflows/ and /.agents/.

Recommend (a). Schema PRs and workflow PRs would still need your review, which is the right tradeoff.

2. Secret names don't match

Repo has RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY. PR expects TRIAGE_BOT_APP_ID / TRIAGE_BOT_APP_PRIVATE_KEY. Per the per-purpose-keys principle in our auth memory, this should be a separate App rather than reusing Release App. Need to:

• Register an "AAO Triage Bot" GitHub App (or confirm one exists)
• Grant pull_requests:write, contents:read
• Install on this repo
• Add its App ID + private key as TRIAGE_BOT_APP_ID / TRIAGE_BOT_APP_PRIVATE_KEY secrets

3. Minor implementation notes

• pull_request_target + the claude/* / auto/* branch filter is safe — those branches can't come from forks. ✓
• check_suite.completed resolution via payload.check_suite.pull_requests will silently no-op for cross-repo cases; the pull_request_target trigger covers that. ✓
• Idempotency check at the bottom (existing approval at same head_sha) is correct. ✓

Suggest landing CODEOWNERS narrowing first, then the App registration, then this workflow.

[bokelley]

Agreed on all three points. The workflow code stands as-is; the two prerequisites are external to this diff.

On CODEOWNERS (item 1): Option (a) — removing /.changeset/ from CODEOWNERS — is the right call. Changesets are mechanical metadata; there's no security value in requiring a code-owner review on them. That said, .github/CODEOWNERS is in the /.github/** path, which is outside the triage routine's edit scope — this change needs to be a @bokelley-authored commit. Once it lands, the vast majority of routine PRs clear the CODEOWNERS gate without touching any protected surface.

On the App identity (item 2): The per-purpose-keys principle is correct; reusing RELEASE_APP_ID would be the wrong call. The workflow already uses TRIAGE_BOT_APP_ID / TRIAGE_BOT_APP_PRIVATE_KEY — those names are correct, the ops work (App registration + secret injection) is the remaining step.

Sequencing confirmed: CODEOWNERS narrowing → App registration + secrets → merge this workflow. PR will stay as a draft until both prerequisites are in place.

---

Generated by Claude Code

[bokelley]

Blocked on infra setup — the workflow expects TRIAGE_BOT_APP_ID and TRIAGE_BOT_APP_PRIVATE_KEY secrets, but they're not in the repo. Current bot secrets available: RELEASE_APP_ID/RELEASE_APP_PRIVATE_KEY (release bot — wrong identity for PR review) and TRIAGE_DISPATCH_PAT (different mechanism, not a GitHub App).

To land this, we need to:

1. Register a new "AAO Triage Bot" GitHub App (or reuse an existing one) with pull_requests:write + contents:read perms
2. Install on the adcp repo
3. Add the two secrets

Leaving open as a tracking PR until that infra is in place. Admin-merge has been working fine in the meantime.

— Triage 2026-05-13

[aao-release-bot]

⚠️ Argus review could not complete

The automated review encountered an issue (possibly reached max turns, timed out, or failed to post the final gh pr review). A human reviewer should take this PR.

View workflow run

_{This is an automated message from the Argus AI review workflow.}

[aao-release-bot]

Argus is not auto-reviewing this PR because it modifies the review workflow itself (.github/workflows/ai-review.yml). Running with the PR head's modified prompt/workflow is a prompt-injection vector. A human reviewer should review and merge this PR; Argus will resume on subsequent PRs once these changes land on main.

[bokelley]

@EmmaLouise2018 — could you take a pass when you have a window? This is the hardening delta on top of what landed via #4816 (the unhardened Argus is live on main right now). Five real findings + 2 nits that Argus surfaced reviewing its own bootstrap PR. Self-attestation note: the workflow-mod gate this PR adds correctly blocks me from auto-approving — Argus posted --comment not --approve here, which is exactly the behavior we want. PR body has the full table of what each commit addresses. Branch protection note in the description too — worth confirming "Require approval of the most recent reviewable push" is on for main.