feat(cherry-pick): add @mention to PR owner in AI-resolved conflict comments

[myakove]

What

When cherry-pick conflicts are resolved by AI, add @mention to the PR owner so they get notified:

1. Original PR comment — Added @{pr_author} mention to the existing AI-resolved conflicts comment
2. Cherry-pick PR comment — Post a NEW comment on the cherry-pick PR mentioning @{pr_author} that AI resolved conflicts and needs their review/verification

Why

Previously, when AI resolved cherry-pick conflicts:

• The original PR comment didn't @mention the PR owner — no GitHub notification
• No comment was posted on the cherry-pick PR itself to notify the assignee

The auto-verify and auto-merge are already correctly skipped for AI-resolved cherry-picks, but without @mention the owner might miss that their cherry-pick needs manual review.

Changes

• webhook_server/libs/handlers/runner_handler.py — cherry_pick method

Closes #1124

[myakove-bot]

Report bugs in Issues

Welcome! 🎉

This pull request will be automatically processed with the following features:

🔄 Automatic Actions

• Reviewer Assignment: Reviewers are automatically assigned based on the OWNERS file in the repository root
• Size Labeling: PR size labels (XS, S, M, L, XL, XXL) are automatically applied based on changes
• Issue Creation: Disabled for this repository
• Pre-commit Checks: pre-commit runs automatically if .pre-commit-config.yaml exists
• Branch Labeling: Branch-specific labels are applied to track the target branch
• Auto-verification: Auto-verified users have their PRs automatically marked as verified
• Labels: All label categories are enabled (default configuration)

📋 Available Commands

PR Status Management

• /wip - Mark PR as work in progress (adds WIP: prefix to title)
• /wip cancel - Remove work in progress status
• /hold - Block PR merging (approvers only)
• /hold cancel - Unblock PR merging
• /verified - Mark PR as verified
• /verified cancel - Remove verification status
• /reprocess - Trigger complete PR workflow reprocessing (useful if webhook failed or configuration changed)
• /regenerate-welcome - Regenerate this welcome message
• /security-override - Set security check runs to pass (maintainers only)
• /security-override cancel - Re-run security checks

Review & Approval

• /lgtm - Approve changes (looks good to me)
• /approve - Approve PR (approvers only)
• /automerge - Enable automatic merging when all requirements are met (maintainers and approvers only)
• /assign-reviewers - Assign reviewers based on OWNERS file
• /assign-reviewer @username - Assign specific reviewer
• /check-can-merge - Check if PR meets merge requirements

Testing & Validation

• /retest tox - Run Python test suite with tox
• /retest build-container - Rebuild and test container image
• /retest python-module-install - Test Python package installation
• /retest pre-commit - Run pre-commit hooks and checks
• /retest conventional-title - Validate commit message format
• /retest all - Run all available tests

Container Operations

• /build-and-push-container - Build and push container image (tagged with PR number)
  • Supports additional build arguments: /build-and-push-container --build-arg KEY=value

Cherry-pick Operations

• /cherry-pick <branch> - Schedule cherry-pick to target branch when PR is merged
  • Multiple branches: /cherry-pick branch1 branch2 branch3
• /cherry-pick-retry <branch> - Retry a failed cherry-pick (merged PRs only)

Branch Management

• /rebase - Rebase this PR branch onto its base branch

Label Management

• /<label-name> - Add a label to the PR
• /<label-name> cancel - Remove a label from the PR

✅ Merge Requirements

This PR will be automatically approved when the following conditions are met:

1. Approval: /approve from at least one approver
2. LGTM Count: Minimum 1 /lgtm from reviewers
3. Status Checks: All required status checks must pass
4. No Blockers: No wip, hold, has-conflicts labels and PR must be mergeable (no conflicts)
5. Verified: PR must be marked as verified

📊 Review Process

Approvers and Reviewers

Approvers:

• myakove
• rnetser

Reviewers:

• myakove
• rnetser

Available Labels

• hold
• verified
• wip
• lgtm
• approve
• automerge

AI Features

• Conventional Title: Mode: fix (claude/claude-opus-4-6[1m])
• Cherry-Pick Conflict Resolution: Enabled (claude/claude-opus-4-6[1m])
• Test Oracle: Triggers: approved (claude/claude-opus-4-6[1m]); /test-oracle can be used anytime

Security Checks

• Suspicious Path Detection: Monitors paths: .claude/, .vscode/, .cursor/, .devcontainer/, .pi/, .github/workflows/, .github/actions/
• Committer Identity Check: Verifies last committer matches PR author
• Mandatory: Security checks block merge (use /security-override to bypass — maintainers only)

💡 Tips

• WIP Status: Use /wip when your PR is not ready for review
• Verification: The verified label is removed on new commits unless the push is detected as a clean rebase
• Cherry-picking: Cherry-pick labels are processed when the PR is merged
• Container Builds: Container images are automatically tagged with the PR number
• Permission Levels: Some commands require approver permissions
• Auto-verified Users: Certain users have automatic verification and merge privileges

For more information, please refer to the project documentation or contact the maintainers.

[qodo-code-review]

PR Summary by Qodo

Mention PR owner when AI resolves cherry-pick conflicts
✨ Enhancement 🕐 10-20 Minutes

Description

• @mention the original PR author when AI resolves cherry-pick conflicts
• Post a separate warning comment on the cherry-pick PR for manual verification
• Improve visibility when auto-verify/auto-merge is intentionally skipped for AI-resolved picks

Diagram

graph TD
  A["Cherry-pick handler"] --> B["AI config"] --> C["GitHub API"] --> D["Original PR comment"]
  A --> B --> C --> E["Cherry-pick PR comment"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Rely on review requests/assignees only

• ➕ Keeps PR timelines/comments cleaner
• ➕ Uses GitHub-native review workflow
• ➖ Review requests can fail for non-collaborators (already handled in code)
• ➖ Assignee-based notifications are easier to miss than explicit @mentions in many team setups

2. Single comment only (original PR) with link to cherry-pick PR

• ➕ Avoids duplicating messaging across PRs
• ➕ Keeps all context in the originating PR
• ➖ Cherry-pick PR participants may not see the warning in the cherry-pick PR itself
• ➖ Less discoverable when reviewing the cherry-pick PR later

Recommendation: Keep the PR’s approach: @mentioning the PR author in the original PR and adding a dedicated warning comment on the cherry-pick PR is the most reliable cross-permission notification mechanism. It complements (rather than replaces) review requests, and it makes the manual-verification requirement visible exactly where the potentially risky merge would occur.

Files changed (1) +16 / -1

Enhancement (1) +16 / -1

runner_handler.pyNotify PR owner on AI-resolved cherry-pick conflicts +16/-1

Notify PR owner on AI-resolved cherry-pick conflicts

• Adds an @mention of the original PR author to the existing AI-resolved-conflicts comment. Also posts a new warning comment on the cherry-pick PR (when available) prompting the author to manually verify before merging.

webhook_server/libs/handlers/runner_handler.py

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 feat: Add @mention to PR owner in AI-resolved cherry-pick comments

✅ Compliance rules (platform): 24 rules

1. Missing tests for @mention comments ✓ Resolved 📎 Requirement gap ☼ Reliability

Description

The new behavior posts @{pr_author} mentions in the original PR comment and adds a new AI-conflict
comment on the cherry-pick PR, but the automated tests were not updated to assert either behavior.
This violates the requirement to add/update tests to prevent regressions in both comment paths.

Code

webhook_server/libs/handlers/runner_handler.py[R1762-1776]

+                    f"@{pr_author} **Manual verification is required** — "
+                    f"please review the changes and test before merging.",
                    logger=self.logger,
                    log_prefix=self.log_prefix,
                )
+
+                if cherry_pick_pr:
+                    await github_api_call(
+                        cherry_pick_pr.create_issue_comment,
+                        f"**⚠️ This cherry-pick had conflicts resolved by AI ({ai_provider}/{ai_model})**\n\n"
+                        f"@{pr_author} — AI automatically resolved merge conflicts for this cherry-pick. "
+                        f"Please review the changes carefully and verify correctness before merging.",
+                        logger=self.logger,
+                        log_prefix=self.log_prefix,
+                    )

Relevance

⭐⭐⭐ High

Team often requires updating/adding tests for new cherry-pick behaviors; similar runner_handler
changes added tests (PRs #1108, #1062).

PR-#1108
PR-#1062
PR-#804

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Rule 181408 requires tests covering both the original PR @{pr_author} mention and the new
cherry-pick PR notification comment when cherry_pick_had_conflicts is true. The changed handler
code implements both comments, but the current tests only assert that an AI comment containing
Cherry-pick conflicts were resolved by AI was posted and do not assert the new @{pr_author}
mention or that cherry_pick_pr.create_issue_comment was called.

Add/update automated tests covering both AI-resolved conflict comments
webhook_server/libs/handlers/runner_handler.py[1753-1780]
webhook_server/tests/test_runner_handler.py[1762-1786]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR adds/changes AI-resolved cherry-pick conflict comments (including `@{pr_author}` mention and a new comment on the cherry-pick PR), but existing tests only check that an AI comment exists and do not validate the required mention and cherry-pick PR notification comment.

## Issue Context
Compliance requires automated tests to assert both:
1) the original PR AI-conflict comment includes `@{pr_author}`
2) a new comment is posted on `cherry_pick_pr` that includes `@{pr_author}` and AI-resolution + manual verification messaging.

## Fix Focus Areas
- webhook_server/libs/handlers/runner_handler.py[1762-1776]
- webhook_server/tests/test_runner_handler.py[1762-1786]
- webhook_server/tests/test_runner_handler.py[1841-1874]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Uncaught comment API failure 🐞 Bug ☼ Reliability

Description

In cherry_pick(), the new GitHub comment posted on the cherry-pick PR is not wrapped in exception
handling; if the API call fails with a non-retryable error, github_api_call() will raise and abort
cherry_pick() after the check-run is already marked success. Since callers await cherry_pick()
without catching exceptions, this can fail the webhook processing even though the cherry-pick PR was
created and labeled.

Code

webhook_server/libs/handlers/runner_handler.py[R1768-1776]

+                if cherry_pick_pr:
+                    await github_api_call(
+                        cherry_pick_pr.create_issue_comment,
+                        f"**⚠️ This cherry-pick had conflicts resolved by AI ({ai_provider}/{ai_model})**\n\n"
+                        f"@{pr_author} — AI automatically resolved merge conflicts for this cherry-pick. "
+                        f"Please review the changes carefully and verify correctness before merging.",
+                        logger=self.logger,
+                        log_prefix=self.log_prefix,
+                    )

Relevance

⭐⭐ Medium

Mixed history: some “don’t crash on API failure” try/except accepted (PR #812), but similar “wrap to
avoid abort” rejected (PR #1002).

PR-#812
PR-#1002
PR-#1060

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new cherry-pick PR comment is executed after the check-run success and is not guarded;
github_api_call() raises for permanent GitHub errors, and the webhook handlers that invoke
cherry_pick() do not wrap the call in try/except, so an exception will propagate out of the
webhook processing path.

webhook_server/libs/handlers/runner_handler.py[1750-1780]
webhook_server/utils/github_retry.py[65-128]
webhook_server/libs/handlers/issue_comment_handler.py[640-668]
webhook_server/libs/handlers/pull_request_handler.py[341-357]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`RunnerHandler.cherry_pick()` posts a new issue comment on the cherry-pick PR when AI resolves conflicts, but does not handle failures from that GitHub API call. Because `github_api_call()` raises on permanent errors (e.g., 403/422), this can unwind the whole cherry-pick workflow after the check-run has already been marked successful.

### Issue Context
- The cherry-pick PR may already be created/assigned/labeled successfully, so comment-posting should be best-effort and not break the overall run.
- `github_api_call()` is explicitly designed to raise after retries for non-retryable errors.

### Fix Focus Areas
- Add a `try/except` around the new `cherry_pick_pr.create_issue_comment` call (and optionally the original-PR comment as well) to log the exception and continue.
- file: `webhook_server/libs/handlers/runner_handler.py`[1753-1780]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Broad except Exception swallow ✓ Resolved 📘 Rule violation ≡ Correctness

Description

cherry_pick() catches a broad Exception when posting the cherry-pick PR comment and then
continues, which can mask unexpected programming errors and violates the requirement to catch
specific exception types. This should be narrowed to the concrete exception types expected from
GitHub/PyGithub/network calls while still logging the failure.

Code

webhook_server/libs/handlers/runner_handler.py[R1784-1788]

+                    except Exception:
+                        self.logger.exception(
+                            f"{self.log_prefix} Failed to post AI-conflict-resolution comment"
+                            f" on cherry-pick PR #{cherry_pick_pr.number}"
+                        )

Relevance

⭐ Low

Team often keeps broad except Exception around non-critical GitHub comment/API calls, logging and
continuing (PR #1005, #1109).

PR-#1005
PR-#1109

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 181390 forbids broad except Exception in non-boundary logic, especially when
errors are swallowed. The new code adds except Exception: around the cherry-pick PR comment
creation and only logs via logger.exception() without re-raising, which matches the failure
criteria.

Rule 181390: Catch specific exception types instead of broad Exception
webhook_server/libs/handlers/runner_handler.py[1784-1788]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
In `RunnerHandler.cherry_pick()`, the new cherry-pick PR comment posting logic uses `except Exception:` and swallows the error. Compliance requires catching specific exception types instead of broad `Exception`.

## Issue Context
This code path is meant to be best-effort (log and continue if the comment cannot be posted), but it should still avoid catching unrelated programming errors (e.g., `TypeError`, `AttributeError`) by narrowing the exception list to expected GitHub/PyGithub/network exceptions thrown by `github_api_call(...)`.

## Fix Focus Areas
- webhook_server/libs/handlers/runner_handler.py[1784-1788]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[myakove]

@qodo-code-review[bot]

The following review comments were reviewed and a decision was made:

webhook_server/libs/handlers/runner_handler.py:1762 (qodo requirement gap) — Missing tests for @mention comments

Addressed: Added 3 tests in commit a516486: test_cherry_pick_ai_resolved_mentions_pr_author (verifies @mention in original PR comment), test_cherry_pick_ai_resolved_posts_comment_on_cherry_pick_pr (verifies comment on cherry-pick PR with @mention), and test_cherry_pick_ai_resolved_comment_failure_does_not_crash (verifies error resilience). All 1658 tests pass.

webhook_server/libs/handlers/runner_handler.py:1768 (qodo bug) — Uncaught comment API failure

Addressed: Wrapped the cherry-pick PR comment in try/except in commit a516486. CancelledError is re-raised, other exceptions are logged via logger.exception() and execution continues. Follows the same pattern used for label failure handling in the same method.

[qodo-code-review]

code-review[bot]

The following review comments were reviewed and a decision was made:

webhook_server/libs/handlers/runner_handler.py:1762 (qodo requirement gap) — Missing tests for @mention comments

Addressed: Added 3 tests in commit a516486: test_cherry_pick_ai_resolved_mentions_pr_author (verifies @mention in original PR comment), test_cherry_pick_ai_resolved_posts_comment_on_cherry_pick_pr (verifies comment on cherry-pick PR with @mention), and test_cherry_pick_ai_resolved_comment_failure_does_not_crash (verifies error resilience). All 1658 tests pass.

webhook_server/libs/handlers/runner_handler.py:1768 (qodo bug) — Uncaught comment API failure

Addressed: Wrapped the cherry-pick PR comment in try/except in commit a516486. CancelledError is re-raised, other exceptions are logged via logger.exception() and execution continues. Follows the same pattern used for label failure handling in the same method.

Thanks — that looks good.

• finding 1 is already marked implemented, and the new tests cover the mention behavior and error path.
• finding 2 is now addressed by the try/except around create_issue_comment, so the failure no longer breaks the cherry-pick flow.

If you want, I can also re-check the remaining diff for any follow-up edge cases.

[qodo-code-review]

Code review by qodo was updated up to the latest commit a516486

[qodo-code-review]

Code review by qodo was updated up to the latest commit d6e9261

[myakove]

@qodo-code-review[bot]

The following review comments were reviewed and a decision was made:

webhook_server/libs/handlers/runner_handler.py:1768 (qodo bug) — Uncaught comment API failure

Addressed: Both comment API calls are now wrapped in try/except GithubException with CancelledError re-raise: the original PR comment (pull_request.create_issue_comment) and the cherry-pick PR comment (cherry_pick_pr.create_issue_comment). Both are best-effort — failures are logged and execution continues.

webhook_server/libs/handlers/runner_handler.py:1784 (qodo rule violation) — Broad except Exception swallow

Addressed: Narrowed except Exception to except GithubException — this is the specific exception type thrown by PyGithub/github_api_call on non-retryable errors (403, 422, etc.). CancelledError is already re-raised before this catch.

[qodo-code-review]

code-review[bot]

The following review comments were reviewed and a decision was made:

webhook_server/libs/handlers/runner_handler.py:1768 (qodo bug) — Uncaught comment API failure

Addressed: Both comment API calls are now wrapped in try/except GithubException with CancelledError re-raise: the original PR comment (pull_request.create_issue_comment) and the cherry-pick PR comment (cherry_pick_pr.create_issue_comment). Both are best-effort — failures are logged and execution continues.

webhook_server/libs/handlers/runner_handler.py:1784 (qodo rule violation) — Broad except Exception swallow

Addressed: Narrowed except Exception to except GithubException — this is the specific exception type thrown by PyGithub/github_api_call on non-retryable errors (403, 422, etc.). CancelledError is already re-raised before this catch.

Yes — the diff addresses both items.

• finding 2: both comment posts are now wrapped in try/except GithubException, with CancelledError re-raised, so comment API failures are best-effort and won’t break cherry_pick().
• finding 3: the broad except Exception was narrowed to except GithubException, which is the right failure boundary for these GitHub API calls.

If you want, I can also help validate whether the remaining active finding is now safe to dismiss.

[qodo-code-review]

Code review by qodo was updated up to the latest commit 9fb7a7b

[qodo-code-review]

Code review by qodo was updated up to the latest commit c80e0eb

[myakove-bot]

New container for ghcr.io/myk-org/github-webhook-server:latest published