fix: retry only failed chunks in large PR reviews

.github/dependabot.yml

@@ -0,0 +1,88 @@
+version: 2
+
+updates:
+  # Python. `uv` rather than `pip`: it resolves through the uv CLI and rewrites
+  # pyproject.toml alongside uv.lock, so the declared pins here — which carry
+  # policy, not just versions — do not drift away from the lock file.
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      python-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      python-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - major
+    commit-message:
+      prefix: chore(deps)
+
+  # GitHub Actions. Every `uses:` here is `@<sha>  # vX.Y.Z` on one line, which
+  # is the format Dependabot rewrites, comment included.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      actions-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - major
+    ignore:
+      # .github/workflows/pr-agent-review.yaml pins this action to a commit on
+      # `main`, not to a release. There is no version to bump to, and the
+      # documented behaviour for an untagged sha is to move it to whatever HEAD
+      # happens to be. Moving the self-review action is a deliberate act.
+      - dependency-name: Codium-ai/pr-agent
+    commit-message:
+      prefix: chore(ci)
+
+  # Base images. The docker file fetcher matches any file whose name contains
+  # "dockerfile", so `/` picks up Dockerfile.github_action_dockerhub and
+  # `/docker` picks up both Dockerfile and Dockerfile.lambda.
+  - package-ecosystem: docker
+    directories:
+      - /
+      - /docker
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    ignore:
+      # Dockerfile.github_action_dockerhub builds FROM this project's own
+      # published image, tracked by a stage tag rather than a version.
+      - dependency-name: pragent/pr-agent
+    commit-message:
+      prefix: chore(docker)
+
+  # Hook revisions in .pre-commit-config.yaml. The `local` repo has no upstream
+  # and is left alone by the ecosystem.
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore(pre-commit)

.github/workflows/build-and-test.yaml

@@ -14,15 +14,21 @@ jobs:
 
     steps:
       - id: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - id: uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+
+      - name: Check uv.lock
+        run: uv lock --check
 
       - id: dockerx
         name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
       - id: build
         name: Build dev docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: ./docker/Dockerfile
@@ -47,15 +53,15 @@ jobs:
             exit 1
           fi
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe  # v5.5.4
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       # Unit tests override CMD, so a broken server launcher never fails CI.
       # Smoke-start github_app (gunicorn + uvicorn) with no secrets; GET / → 200.
       - id: build-smoke
         name: Build github_app docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: ./docker/Dockerfile

.github/workflows/codeql.yml

@@ -31,14 +31,14 @@ jobs:
           - language: python
             build-mode: none
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: github/codeql-action/init@7fd177fa680c9881b53cdab4d346d32574c9f7f4  # v3.35.4
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-extended,security-and-quality
 
-      - uses: github/codeql-action/analyze@7fd177fa680c9881b53cdab4d346d32574c9f7f4  # v3.35.4
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/docs-ci.yaml

@@ -12,16 +12,16 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: 3.x
       - run: echo "cache_id=$(date --utc '+%V')" >> "$GITHUB_ENV"
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           key: mkdocs-material-${{ env.cache_id }}
           path: .cache

.github/workflows/e2e_tests.yaml

@@ -11,14 +11,14 @@ jobs:
     name: PR-Agent E2E GitHub App Test
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
       - id: build
         name: Build dev docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: ./docker/Dockerfile

.github/workflows/pre-commit.yml

@@ -1,17 +1,19 @@
-# disabled. We might run it manually if needed.
+# Runs every pre-commit hook (ruff, actionlint, YAML/TOML checks, ...) on
+# pull requests, so the hooks are enforced in CI rather than manual-only.
 name: pre-commit
 
 on:
   workflow_dispatch:
-#  pull_request:
+  pull_request:
 #  push:
 #    branches: [main]
 
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
       # SEE https://github.com/pre-commit/action
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1

.github/workflows/provider-smoke.yaml

@@ -0,0 +1,32 @@
+name: Provider smoke
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: read
+  issues: read
+
+jobs:
+  github-provider-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Smoke /describe on a real GitHub PR
+        env:
+          GITHUB.USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: PYTHONPATH=. uv run pytest tests/health_test/test_github_smoke.py -q

.github/workflows/publish.yml

@@ -83,11 +83,11 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ needs.prepare.outputs.sha }}
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.12'
 
@@ -99,7 +99,7 @@ jobs:
           python -m pip install --upgrade pip build
           python -m build
 
-      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
           # Re-running the workflow for the same version (e.g. after a
@@ -168,25 +168,25 @@ jobs:
             suffix: gitlab_lambda
             rolling: gitlab_lambda
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ needs.prepare.outputs.sha }}
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.12'
 
       - name: Set version in pyproject.toml
         run: python scripts/set_pyproject_version.py "${{ needs.prepare.outputs.version }}"
 
-      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3.7.0
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a  # v4.3.0
         with:
           # amd64 is the runner's native arch; only arm64 needs emulation.
           platforms: arm64
 
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -208,7 +208,7 @@ jobs:
           echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
 
       - id: push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: ${{ matrix.dockerfile }}
@@ -219,7 +219,7 @@ jobs:
           cache-from: type=gha,scope=${{ matrix.suffix || 'cli' }}
           cache-to: type=gha,mode=max,scope=${{ matrix.suffix || 'cli' }}
 
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a  # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
         with:
           subject-name: index.docker.io/pragent/pr-agent
           subject-digest: ${{ steps.push.outputs.digest }}
@@ -245,16 +245,18 @@ jobs:
       # the push rather than rebasing onto a newer commit that wasn't built.
       # This preserves the invariant that `git checkout vX.Y.Z` resolves to a
       # commit whose tree was published.
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ needs.prepare.outputs.sha }}
           fetch-depth: 0
           token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.12'
 
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+
       - name: Flag missing PyPI publish
         if: needs.publish-pypi.result != 'success'
         env:
@@ -267,28 +269,30 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-      - name: Bump pyproject.toml
-        run: python scripts/set_pyproject_version.py "${{ needs.prepare.outputs.version }}"
+      - name: Bump pyproject.toml and sync uv.lock
+        run: |
+          python scripts/set_pyproject_version.py "${{ needs.prepare.outputs.version }}"
+          uv lock
 
       - name: Commit & push bump (fast-forward only)
         id: commit
         env:
           VERSION: ${{ needs.prepare.outputs.version }}
           PUBLISHED_SHA: ${{ needs.prepare.outputs.sha }}
         run: |
-          if git diff --quiet pyproject.toml; then
-            echo "pyproject.toml already at $VERSION on $PUBLISHED_SHA; nothing to commit."
+          if git diff --quiet pyproject.toml uv.lock; then
+            echo "pyproject.toml and uv.lock already at $VERSION on $PUBLISHED_SHA; nothing to commit."
             echo "bumped=false" >> "$GITHUB_OUTPUT"
             echo "sha=$PUBLISHED_SHA" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          git add pyproject.toml
+          git add pyproject.toml uv.lock
           git commit -m "chore(release): bump version to $VERSION [skip ci]"
           if git push origin "HEAD:refs/heads/main"; then
             echo "bumped=true" >> "$GITHUB_OUTPUT"
             echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
           else
-            echo "::warning::main has moved past the published commit ($PUBLISHED_SHA); skipping the bump push rather than rebasing onto a commit that was not built. Bump pyproject.toml on main manually:  git checkout main && python scripts/set_pyproject_version.py $VERSION && git commit -am 'chore(release): bump version to $VERSION' && git push"
+            echo "::warning::main has moved past the published commit ($PUBLISHED_SHA); skipping the bump push rather than rebasing onto a commit that was not built. Bump pyproject.toml and uv.lock on main manually:  git checkout main && python scripts/set_pyproject_version.py $VERSION && uv lock && git commit -am 'chore(release): bump version to $VERSION' && git push"
             echo "bumped=false" >> "$GITHUB_OUTPUT"
             echo "sha=$PUBLISHED_SHA" >> "$GITHUB_OUTPUT"
           fi

.github/workflows/release-drafter.yml

@@ -20,6 +20,6 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@67e173cadb2fbd3de94f4a861e0c48c913b462ae  # v6.4.0
+      - uses: release-drafter/release-drafter@6a93d829887aa2e0748befe2e808c66c0ec6e4c7  # v6.4.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -14,6 +14,7 @@ dist/
 build/
 .DS_Store
 docs/.cache/
+docs/site/
 .qodo
 poetry.lock
 .log