tenant.openagents/omega

1# Stale PR Review Reminder
2#
3# Runs daily on weekdays (second run at 8 PM UTC disabled during rollout) and posts a Slack summary of open PRs that
4# have been awaiting review for more than 72 hours. Team-level signal only —
5# no individual shaming.
6#
7# Security note: No untrusted input is interpolated into shell commands.
8# All PR metadata is read via gh API + jq.
9#
10# Required secrets:
11#   SLACK_WEBHOOK_PR_REVIEW_BOT - Incoming webhook URL for the #pr-review-ops channel
12
13name: Stale PR Review Reminder
14
15on:
16  schedule:
17    - cron: "0 14 * * 1-5" # 2 PM UTC weekdays
18    # - cron: "0 20 * * 1-5" # 8 PM UTC weekdays — enable after initial rollout
19  workflow_dispatch: {}
20
21permissions:
22  contents: read
23
24jobs:
25  check-stale-prs:
26    if: github.repository_owner == 'zed-industries'
27    runs-on: ubuntu-latest
28    timeout-minutes: 5
29    permissions:
30      pull-requests: read
31    env:
32      REPO: ${{ github.repository }}
33      # Only surface PRs created on or after this date. Update this if the
34      # review process enforcement date changes.
35      PROCESS_START_DATE: "2026-03-19T00:00:00Z"
36    steps:
37      - name: Find PRs awaiting review longer than 72h
38        id: stale
39        env:
40          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41        run: |
42          CUTOFF=$(date -u -v-72H +%Y-%m-%dT%H:%M:%SZ 2>/dev/null \
43            || date -u -d '72 hours ago' +%Y-%m-%dT%H:%M:%SZ)
44
45          # Get open, non-draft PRs with pending review requests, created before cutoff
46          # but after the review process start date (to exclude pre-existing backlog)
47          gh api --paginate \
48            "repos/${REPO}/pulls?state=open&sort=updated&direction=asc&per_page=100" \
49            --jq "[
50              .[] |
51              select(.draft == false) |
52              select(.created_at > \"$PROCESS_START_DATE\") |
53              select(.created_at < \"$CUTOFF\") |
54              select((.requested_reviewers | length > 0) or (.requested_teams | length > 0))
55            ]" > /tmp/candidates.json
56
57          # Filter to PRs with zero approving reviews
58          jq -r '.[].number' /tmp/candidates.json | while read -r PR_NUMBER; do
59            APPROVALS=$(gh api \
60              "repos/${REPO}/pulls/${PR_NUMBER}/reviews" \
61              --jq "[.[] | select(.state == \"APPROVED\")] | length" 2>/dev/null || echo "0")
62
63            if [ "$APPROVALS" -eq 0 ]; then
64              jq ".[] | select(.number == ${PR_NUMBER}) | {number, title, author: .user.login, created_at}" \
65                /tmp/candidates.json
66            fi
67          done | jq -s '.' > /tmp/awaiting.json
68
69          COUNT=$(jq 'length' /tmp/awaiting.json)
70          echo "count=$COUNT" >> "$GITHUB_OUTPUT"
71
72      - name: Notify Slack
73        if: steps.stale.outputs.count != '0'
74        env:
75          SLACK_WEBHOOK_PR_REVIEW_BOT: ${{ secrets.SLACK_WEBHOOK_PR_REVIEW_BOT }}
76          COUNT: ${{ steps.stale.outputs.count }}
77        run: |
78          # Build Block Kit payload from JSON — no shell interpolation of PR titles.
79          # Why jq? PR titles are attacker-controllable input. By reading them
80          # through jq -r from the JSON file and passing the result to jq --arg,
81          # the content stays safely JSON-encoded in the final payload.
82          PRS=$(jq -r '.[] | "• <https://github.com/'"${REPO}"'/pull/\(.number)|#\(.number)> — \(.title) (by \(.author), opened \(.created_at | split("T")[0]))"' /tmp/awaiting.json)
83
84          jq -n \
85            --arg count "$COUNT" \
86            --arg prs "$PRS" \
87            '{
88              text: ($count + " PR(s) awaiting review for >72 hours"),
89              blocks: [
90                {
91                  type: "section",
92                  text: {
93                    type: "mrkdwn",
94                    text: (":hourglass_flowing_sand: *" + $count + " PR(s) Awaiting Review >72 Hours*")
95                  }
96                },
97                {
98                  type: "section",
99                  text: { type: "mrkdwn", text: $prs }
100                },
101                { type: "divider" },
102                {
103                  type: "context",
104                  elements: [{
105                    type: "mrkdwn",
106                    text: "PRs awaiting review are surfaced daily. Reviewers: pick one up or reassign."
107                  }]
108                }
109              ]
110            }' | \
111          curl -s -X POST "$SLACK_WEBHOOK_PR_REVIEW_BOT" \
112            -H 'Content-Type: application/json' \
113            -d @-
114defaults:
115  run:
116    shell: bash -euxo pipefail {0}
117