Commit Graph
9 Commits
Author SHA1 Message Date
Aaron PowellandCopilot App 4796642f48 fix(external-plugins): prevent false fast-track approvals
Exclude manually overridden submissions from first-party fast-track until a fresh intake pass clears the override label. Disable individual approval controls while intake is pending.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 14:24:47 +11:00
Aaron PowellandCopilot App c9ca91fdaa chore: merge origin/main into external plugin ownership
Preserve intake readiness checks alongside pending-decision safeguards.
Gate newly merged bulk approval and re-review actions on intake readiness.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 14:09:36 +11:00
Aaron PowellandCopilot App 2b726b5f7c fix(external-plugins): gate reviews on ready intake
Use the same intake readiness predicate across approval, AI review, and re-review paths. Keep pending submissions visible but do not count or queue them for review until validation completes; clarify board visibility in the README.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 13:55:45 +11:00
Aaron PowellandCopilot App 666a521cd5 fix(external-plugins): preserve cards during intake
Include submissions awaiting review or submitter fixes in the review board feed so refreshes preserve their existing state. Keep fast-track and approval gated on a ready intake state, and add regression coverage for card persistence across pending transitions.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 13:01:19 +11:00
Aaron PowellandCopilot App a48dab5961 fix(external-plugins): block approval during intake reruns
Remove stale ready-for-review state before evaluating edited submissions or running quality gates. Require a current ready state before fast-tracking or approving, and cover the pending transition with focused tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 11:58:49 +11:00
Aaron PowellandCopilot App f4088ee185 fix(external-plugins): address review feedback
Revoke synthetic first-party fast-tracks when ownership changes while preserving human decisions, manual buckets, and queued re-reviews. Apply normal review guidance when explicitly opted out of fast-track, and document that first-party routing does not bypass validation or maintainer approval.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 11:37:54 +11:00
Aaron PowellandCopilot App c0fb55cd28 fix(canvas): address review board feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: dc011747-d114-43af-93e9-7f0036f9b4b7
2026-10-13 11:37:12 +11:00
Aaron PowellandCopilot App b653c23244 feat(external-plugins): fast-track first-party reviews and note org ownership
Auto-accept first-party cards on the review board with /approve suggested,
skipping AI review unless the maintainer opts the card back into Unreviewed.
Show ownership and fast-track pills on cards.

Add a "Repository owner" reviewer-signal row to intake comments for
organization-owned repositories; user-owned repositories get no row.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636
2026-10-13 10:51:42 +11:00
Aaron PowellandCopilot App e62be9667a Add external plugin review board canvas for maintainers (#4174)
* feat: add external plugin review board canvas extension

Project-scoped Copilot canvas for maintainers to triage external plugin
submissions: kanban buckets, AI review, guided re-review via sub-session,
refresh, issue/comments view, and quick /approve or /reject.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: harden review board per PR feedback

- Deny framing and hide stack traces from API error responses
- Track review queue ids, restore queue state on send failure, skip queued items
- Require reject reasons; treat posted decisions as pending until the workflow closes the issue
- Invalidate browser issue cache on refresh
- Clarify paid-services guidance

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: keep review decisions UI-only and record external outcomes

- Remove the agent-facing post_decision action to block prompt-injected approvals/rejections
- Record opposite terminal labels as external GitHub decisions instead of reusing the pending command
- State visibly that a reject reason is required

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-09-30 16:18:06 +10:00