fix(external-plugins): prevent false fast-track approvals

Exclude manually overridden submissions from first-party fast-track until a fresh intake pass clears the override label. Disable individual approval controls while intake is pending.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636

.github/extensions/external-plugin-review-board/lib/state.mjs

@@ -16,6 +16,7 @@ export const COLUMNS = [
 
 const HISTORY_LIMIT = 200;
 export const FIRST_PARTY_LABEL = "first party";
+const MANUAL_INTAKE_OVERRIDE_LABEL = "intake-manually-overridden";
 const PENDING_INTAKE_LABELS = ["awaiting-review", "requires-submitter-fixes"];
 
 export function isReadyForApproval(labels) {
@@ -30,6 +31,7 @@ function applyFirstPartyFastTrack(item) {
         !item.labels?.includes(FIRST_PARTY_LABEL) ||
         !item.labels?.includes("ready-for-review") ||
         item.labels?.some((label) => PENDING_INTAKE_LABELS.includes(label)) ||
+        item.labels?.includes(MANUAL_INTAKE_OVERRIDE_LABEL) ||
         item.fastTrackDismissed ||
         item.decision ||
         item.review ||
@@ -54,6 +56,7 @@ function clearFirstPartyFastTrack(item) {
     if (
         (item.labels?.includes(FIRST_PARTY_LABEL) &&
             item.labels?.includes("ready-for-review") &&
+            !item.labels?.includes(MANUAL_INTAKE_OVERRIDE_LABEL) &&
             !item.labels?.some((label) => PENDING_INTAKE_LABELS.includes(label))) ||
         !item.review?.fastTracked ||
         item.reviewStatus === "queued"

.github/extensions/external-plugin-review-board/public/app.js

@@ -412,7 +412,7 @@ function renderDrawer() {
 
     ui.drawerFooter.hidden = Boolean(item.decision);
     updatePreview();
-    ui.approve.disabled = bulkBusy || Boolean(item.pendingDecision);
+    ui.approve.disabled = bulkBusy || !item.reviewEligible || Boolean(item.pendingDecision);
     ui.reject.disabled ||= bulkBusy || Boolean(item.pendingDecision);
     renderTab(item);
 }
@@ -584,6 +584,7 @@ function resetConfirm() {
         ui.approve.disabled = true;
         ui.reject.disabled = true;
     }
+    if (!item?.reviewEligible) ui.approve.disabled = true;
 }
 
 async function decide(kind) {

.github/workflows/external-plugin-command-router.yml

@@ -549,6 +549,23 @@ jobs:
               return;
             }
 
+            try {
+              await github.rest.issues.getLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: 'intake-manually-overridden'
+              });
+            } catch (error) {
+              if (error.status !== 404) throw error;
+              await github.rest.issues.createLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: 'intake-manually-overridden',
+                color: 'BFD4F2',
+                description: 'Submission was manually moved to review without passing automated intake gates'
+              });
+            }
+
             await github.rest.reactions.createForIssueComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
@@ -564,6 +581,7 @@ jobs:
               desiredLabels: new Set([
                 'external-plugin',
                 'ready-for-review',
+                'intake-manually-overridden',
                 ...(labelNames.has('external-plugin-canvas') ? ['external-plugin-canvas'] : [])
               ])
             });

.github/workflows/setup-labels.yml

@@ -81,6 +81,10 @@ jobs:
                 color: 'D93F0B',
                 description: 'Submission has quality-gate findings that submitter must fix before maintainer review'
               },
+              'intake-manually-overridden': {
+                color: 'BFD4F2',
+                description: 'Submission was manually moved to review without passing automated intake gates'
+              },
               'approved': {
                 color: '1D76DB',
                 description: 'Submission was approved by a maintainer'