tenant.openagents/omega

1# Hotfix Review Monitor
2#
3# Runs daily and checks for merged PRs with the 'hotfix' label that have not
4# received a post-merge review approval within one business day. Posts a summary to
5# Slack if any are found. This is a SOC2 compensating control for the
6# emergency hotfix fast path.
7#
8# Security note: No untrusted input (PR titles, bodies, etc.) is interpolated
9# into shell commands. All PR metadata is read via gh API + jq, not via
10# github.event context expressions.
11#
12# Required secrets:
13#   SLACK_WEBHOOK_PR_REVIEW_BOT - Incoming webhook URL for the #pr-review-ops channel
14
15name: Hotfix Review Monitor
16
17on:
18  schedule:
19    - cron: "30 13 * * 1-5" # 1:30 PM UTC weekdays
20  workflow_dispatch: {}
21
22permissions:
23  contents: read
24
25jobs:
26  check-hotfix-reviews:
27    if: github.repository_owner == 'zed-industries'
28    runs-on: ubuntu-latest
29    permissions:
30      pull-requests: read
31    timeout-minutes: 5
32    env:
33      REPO: ${{ github.repository }}
34    steps:
35      - name: Find unreviewed hotfixes
36        id: check
37        env:
38          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
39        run: |
40          # 80h lookback covers the Friday-to-Monday gap (72h) with buffer.
41          # Overlap on weekdays is harmless — reviewed PRs are filtered out below.
42          SINCE=$(date -u -v-80H +%Y-%m-%dT%H:%M:%SZ 2>/dev/null \
43            || date -u -d '80 hours ago' +%Y-%m-%dT%H:%M:%SZ)
44          SINCE_DATE=$(echo "$SINCE" | cut -dT -f1)
45
46          # Use the Search API to find hotfix PRs merged in the lookback window.
47          # The Pulls API with state=closed paginates through all closed PRs in
48          # the repo, which times out on large repos. The Search API supports
49          # merged:>DATE natively so GitHub does the filtering server-side.
50          gh api --paginate \
51            "search/issues?q=repo:${REPO}+is:pr+is:merged+label:hotfix+merged:>${SINCE_DATE}&per_page=100" \
52            --jq '[.items[] | {number, title, merged_at: .pull_request.merged_at}]' \
53            > /tmp/hotfix_prs.json
54
55          # Check each hotfix PR for a post-merge approving review
56          jq -r '.[].number' /tmp/hotfix_prs.json | while read -r PR_NUMBER; do
57            APPROVALS=$(gh api \
58              "repos/${REPO}/pulls/${PR_NUMBER}/reviews" \
59              --jq "[.[] | select(.state == \"APPROVED\")] | length")
60
61            if [ "$APPROVALS" -eq 0 ]; then
62              jq ".[] | select(.number == ${PR_NUMBER})" /tmp/hotfix_prs.json
63            fi
64          done | jq -s '.' > /tmp/unreviewed.json
65
66          COUNT=$(jq 'length' /tmp/unreviewed.json)
67          echo "count=$COUNT" >> "$GITHUB_OUTPUT"
68
69      - name: Notify Slack
70        if: steps.check.outputs.count != '0'
71        env:
72          SLACK_WEBHOOK_PR_REVIEW_BOT: ${{ secrets.SLACK_WEBHOOK_PR_REVIEW_BOT }}
73          COUNT: ${{ steps.check.outputs.count }}
74        run: |
75          # Build Block Kit payload from JSON — no shell interpolation of PR titles.
76          # Why jq? PR titles are attacker-controllable input. By reading them
77          # through jq -r from the JSON file and passing the result to jq --arg,
78          # the content stays safely JSON-encoded in the final payload. Block Kit
79          # doesn't change this — the same jq pipeline feeds into the blocks
80          # structure instead of plain text.
81          PRS=$(jq -r '.[] | "• <https://github.com/'"${REPO}"'/pull/\(.number)|#\(.number)> — \(.title) (merged \(.merged_at | split("T")[0]))"' /tmp/unreviewed.json)
82
83          jq -n \
84            --arg count "$COUNT" \
85            --arg prs "$PRS" \
86            '{
87              text: ($count + " hotfix PR(s) still need post-merge review"),
88              blocks: [
89                {
90                  type: "section",
91                  text: {
92                    type: "mrkdwn",
93                    text: (":rotating_light: *" + $count + " Hotfix PR(s) Need Post-Merge Review*")
94                  }
95                },
96                {
97                  type: "section",
98                  text: { type: "mrkdwn", text: $prs }
99                },
100                { type: "divider" },
101                {
102                  type: "context",
103                  elements: [{
104                    type: "mrkdwn",
105                    text: "Hotfix PRs require review within one business day of merge."
106                  }]
107                }
108              ]
109            }' | \
110          curl -s -X POST "$SLACK_WEBHOOK_PR_REVIEW_BOT" \
111            -H 'Content-Type: application/json' \
112            -d @-
113defaults:
114  run:
115    shell: bash -euxo pipefail {0}
116