Commit Graph
14 Commits
Author SHA1 Message Date
Aaron PowellandCopilot App 4796642f48 fix(external-plugins): prevent false fast-track approvals
Exclude manually overridden submissions from first-party fast-track until a fresh intake pass clears the override label. Disable individual approval controls while intake is pending.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 14:24:47 +11:00
Aaron PowellandCopilot App c9ca91fdaa chore: merge origin/main into external plugin ownership
Preserve intake readiness checks alongside pending-decision safeguards.
Gate newly merged bulk approval and re-review actions on intake readiness.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 14:09:36 +11:00
Aaron PowellandCopilot App 2b726b5f7c fix(external-plugins): gate reviews on ready intake
Use the same intake readiness predicate across approval, AI review, and re-review paths. Keep pending submissions visible but do not count or queue them for review until validation completes; clarify board visibility in the README.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 13:55:45 +11:00
Aaron PowellandCopilot App 666a521cd5 fix(external-plugins): preserve cards during intake
Include submissions awaiting review or submitter fixes in the review board feed so refreshes preserve their existing state. Keep fast-track and approval gated on a ready intake state, and add regression coverage for card persistence across pending transitions.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 13:01:19 +11:00
Aaron PowellandCopilot App a48dab5961 fix(external-plugins): block approval during intake reruns
Remove stale ready-for-review state before evaluating edited submissions or running quality gates. Require a current ready state before fast-tracking or approving, and cover the pending transition with focused tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 11:58:49 +11:00
Aaron PowellandCopilot App 7c0da121fa fix(canvas): exclude pending decisions from review count
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: dc011747-d114-43af-93e9-7f0036f9b4b7
2026-10-13 11:48:38 +11:00
Aaron PowellandCopilot App f4088ee185 fix(external-plugins): address review feedback
Revoke synthetic first-party fast-tracks when ownership changes while preserving human decisions, manual buckets, and queued re-reviews. Apply normal review guidance when explicitly opted out of fast-track, and document that first-party routing does not bypass validation or maintainer approval.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 11:37:54 +11:00
Aaron PowellandCopilot App c0fb55cd28 fix(canvas): address review board feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: dc011747-d114-43af-93e9-7f0036f9b4b7
2026-10-13 11:37:12 +11:00
Aaron PowellandCopilot App 8431cac934 feat(canvas): add bulk review board actions
Add confirmed column actions using staged feedback on both review boards. Avoid duplicate queued reviews and issue commands, report partial failures, and fetch PR checks separately to prevent bulk GraphQL timeouts.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: dc011747-d114-43af-93e9-7f0036f9b4b7
2026-10-13 11:28:55 +11:00
Aaron PowellandCopilot App b653c23244 feat(external-plugins): fast-track first-party reviews and note org ownership
Auto-accept first-party cards on the review board with /approve suggested,
skipping AI review unless the maintainer opts the card back into Unreviewed.
Show ownership and fast-track pills on cards.

Add a "Repository owner" reviewer-signal row to intake comments for
organization-owned repositories; user-owned repositories get no row.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 10:51:42 +11:00
Aaron PowellandCopilot App 01678e9489 fix(canvas): handle board startup requests
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 545df520-6557-4211-a110-53c60f4b9f3a
2026-10-12 13:49:34 +11:00
Aaron PowellandCopilot App 758f4382db fix(canvas): start board state fresh in the session workspace
Drop the legacy extension-folder state import; boards now start empty in session.workspacePath.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 545df520-6557-4211-a110-53c60f4b9f3a
2026-10-12 13:37:10 +11:00
Aaron PowellandCopilot App f4319559ab fix(canvas): persist board state in the session workspace
Keep runtime writes outside extension folders to avoid invalidating their safety fingerprints. Import legacy board state without modifying it and document session isolation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 545df520-6557-4211-a110-53c60f4b9f3a
2026-10-12 12:19:43 +11:00
Aaron PowellandCopilot App e62be9667a Add external plugin review board canvas for maintainers (#4174)
* feat: add external plugin review board canvas extension

Project-scoped Copilot canvas for maintainers to triage external plugin
submissions: kanban buckets, AI review, guided re-review via sub-session,
refresh, issue/comments view, and quick /approve or /reject.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: harden review board per PR feedback

- Deny framing and hide stack traces from API error responses
- Track review queue ids, restore queue state on send failure, skip queued items
- Require reject reasons; treat posted decisions as pending until the workflow closes the issue
- Invalidate browser issue cache on refresh
- Clarify paid-services guidance

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: keep review decisions UI-only and record external outcomes

- Remove the agent-facing post_decision action to block prompt-injected approvals/rejections
- Record opposite terminal labels as external GitHub decisions instead of reusing the pending command
- State visibly that a reject reason is required

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-09-30 16:18:06 +10:00