ci: approve with the walletkit bot after the automated review by Dzejkop · Pull Request #545 · worldcoin/walletkit

Dzejkop · 2026-09-16T16:52:25Z

Approves a pull request with wld-walletkit-bot once the automated reviewer has reviewed the current head, so the reviewer is the gate. Its comments block the merge until resolved, which worldcoin/infrastructure#49096 enforces.

.github/workflows/auto-approve.yml replaces risk-gate.yml: waits for the reviewer (Bugbot, or Copilot if enabled), then approves as the bot.
.github/CODEOWNERS: adds @wld-walletkit-bot so its approval satisfies the code owner requirement.

Fails closed: a draft, a fork (no secrets), a base other than main, a pull request authored by the bot itself, or a missing review on the head all get no approval.

Note

High Risk
Changes merge gating and bot approval in CI; mistakes could auto-approve risky PRs or block legitimate merges despite defensive guards and split-token design.

Overview
Adds an auto-approve GitHub Actions workflow that runs on pull_request_target for PR lifecycle events. A pi agent reviews the PR (without the bot token), may record a low-risk verdict via a custom approve_pr tool, posts a Risk agent comment, and a separate step submits wld-walletkit-bot approval only when the verdict approves and guards pass (base main, same-repo head, not draft, internal author, head SHA unchanged, no .github/ file changes, not already approved).

.github/CODEOWNERS adds @wld-walletkit-bot to the default owner list so that bot approval can satisfy code-owner requirements alongside human owners.

^{Reviewed by Cursor Bugbot for commit 1666a1d. Bugbot is set up for automated code reviews on this repo. Configure here.}

A required check that passes mechanical changes the automated reviewer has seen, and otherwise waits for a code owner approval on the current head.

cursor

Stale Bugbot comment from a previous run.

- Read the current head from the API instead of the event payload, which can lag on a review event. - Judge renames on both paths, so moving a source file into a mechanical path does not count as mechanical. - Require the approver to be listed in CODEOWNERS on the base branch. The collaborator-permission endpoint is not available to this token, which made every approval look unauthorised. - Note that a pull request can edit this file, so branch protection also carries the requirements.

Accept the reviewer's completed check run as well as a review object: Bugbot skips some pushes, and waiting for a review that never arrives wedged the gate.

Re-run when the reviewer's check run completes, since a skipped review posts no review event to trigger on.

cursor

Stale Bugbot comment from a previous run.

Re-run when a pull request is retargeted, so a change pointed at main after it was opened is still assessed.

Wait for the automated review instead of failing while it runs, and re-check after the wait. A check that fails mid-review leaves the gate stale until some other event re-runs it, which a skipped review never produces.

cursor

Stale Bugbot comment from a previous run.

The reviewer is the risk gate: wait for it to review the current head, and leave the resolution of its comments to required conversation resolution. Drops the path allow-list, the rename handling and the code-owner approval logic.

Replaces the risk-gate check and the protocol-team bypass: the bot approves once the reviewer has reviewed the current head, and CODEOWNERS makes that approval count. Fails closed otherwise.

The approve step has no checkout, so gh needs GH_REPO to find the repository.

Run on pull_request_target so a pull request cannot rewrite the job that approves it, and drop the review event: the job waits for the reviewer itself.

cursor

Stale Bugbot comment from a previous run.

Only approve branches of this repository, and pass the pull request number through the environment instead of interpolating it into the shell.

Lets the workflow run for its own pull request. Switch back to pull_request_target before merging, otherwise a pull request can rewrite the job that approves it.

The bot approved repeatedly because its own approval fires the review event that re-runs this job; skip when the head is already approved. Approval now also needs a low-risk verdict from an agent (deepseek/deepseek-v4.1-flash over OpenRouter), which fails closed when the diff is too large, the key is missing or the answer is unusable.

cursor

Stale Bugbot comment from a previous run.

pi (deepseek/deepseek-v4.1-flash over OpenRouter) judges the diff and approves through its only tool, approve_pr, which re-checks the guards and calls the API as wld-walletkit-bot. The agent has no shell, read or write tools, so a prompt injection in the diff cannot reach the bot token or run anything.

Drops the pre-fetched context and the disabled toolset: the agent runs with its normal tools and a short system prompt, and the bot token stays in the step that submits the approval.

Makes the workflow run for its own pull request; switch back to pull_request_target before merging.

Text mode into the log, the transcript in the run summary, and one PR comment the agent edits in place on later pushes.

cursor

Stale Bugbot comment from a previous run.

pi needs a user message, not just a system prompt, or it exits without doing anything. Write the extension where typebox resolves, next to the pi install.

No pipe, so the log streams while the agent works; the transcript for the comment comes from the pi session file. The report step needs GH_REPO without a checkout.

wld-walletkit-bot · 2026-09-17T11:54:56Z

Risk agent: No low-risk verdict, so no approval.

I reviewed PR #545 (ci: approve with the walletkit bot after the automated review). It is not low risk, so I'm not recording an approval.

What it changes (2 files, +130/-1):

.github/workflows/auto-approve.yml (new, 129 lines):
- Adds a pull_request workflow that installs a third-party agent (@earendil-works/pi-coding-agent@0.85.1) and runs it against PR content with OPENROUTER_API_KEY and the default GH_TOKEN.
- A later step uses the privileged WALLETKIT_BOT_TOKEN to run gh pr review --approve when the agent writes an approve verdict, gated by a list of guard conditions.
- It also edits/creates PR comments and reads PR metadata/files.
.github/CODEOWNERS: adds @wld-walletkit-bot to the global owners, so the bot's automated approval can satisfy the code-owner requirement.

Why this hits the stop conditions:

CI/workflow configuration — this is entirely .github/ CI and repository-governance config, which is explicitly out of scope for an approval here (the change's own guard logic even refuses to auto-approve PRs touching .github/, which is consistent).
Security/governance surface — it introduces automated approvals using a bot token and grants the bot code-owner status. A misconfiguration or agent misjudgment could approve changes that should require human review. Wiring untrusted PR content into an agent that has a privileged token step in the same job is exactly the kind of change that warrants deliberate human review, not a one-pass automated approval.
Dependency addition — it installs and grants tooling access to a new external package.

Because this is workflow/release/dependency configuration (and a security-relevant governance change), I'm stopping without approving. It needs human review of the token handling, guard conditions, and CODEOWNERS change.

cursor

Stale Bugbot comment from a previous run.

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1666a1d. Configure here.}

cursor · 2026-09-17T12:42:56Z

+              (if (.author_association == "OWNER" or .author_association == "MEMBER" or .author_association == "COLLABORATOR") then empty else "author is an external contributor (\(.author_association // "NONE"))" end),
+              (if $head != "" and .head.sha != $head then "the head moved" else empty end) ] | .[]' /tmp/pr.json > /tmp/problems.txt
+          # A changed file under .github is workflow or config.
+          grep -q '^\.github/' /tmp/files.txt && echo "a changed file is under .github" >> /tmp/problems.txt || true


Config guards miss dependency files

High Severity

The new fail-closed check only greps for paths under .github/, so it does not enforce the same commit’s rule against CI, release, or dependency configuration. A low-risk verdict can still produce a wld-walletkit-bot CODEOWNER approval for changes to Cargo.toml, deny.toml, release-plz.toml, flake.nix, or rust-toolchain.toml. The agent can write /tmp/verdict.json from untrusted PR content, and those path checks are the real merge gate.

Additional Locations (1)

.github/workflows/auto-approve.yml#L110-L111

^{Reviewed by Cursor Bugbot for commit 1666a1d. Configure here.}

ci: add risk gate for automated review and low-risk changes

78e9b12

A required check that passes mechanical changes the automated reviewer has seen, and otherwise waits for a code owner approval on the current head.

Dzejkop requested review from Guardiola31337, Takaros999, danielle-tfh, kilianglas, murph, paolodamico and philsippl as code owners September 16, 2026 16:52

cursor Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread .github/workflows/auto-approve.yml

Comment thread .github/workflows/risk-gate.yml Outdated

Comment thread .github/workflows/risk-gate.yml Outdated

Comment thread .github/workflows/auto-approve.yml Outdated

Comment thread .github/workflows/risk-gate.yml Outdated

Dzejkop added 3 commits September 16, 2026 19:20

codex: address PR review feedback (#545)

fbfe12b

Accept the reviewer's completed check run as well as a review object: Bugbot skips some pushes, and waiting for a review that never arrives wedged the gate.

codex: address PR review feedback (#545)

7373785

Re-run when the reviewer's check run completes, since a skipped review posts no review event to trigger on.

cursor Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread .github/workflows/risk-gate.yml Outdated

Dzejkop added 2 commits September 17, 2026 12:21

codex: address PR review feedback (#545)

4333496

Re-run when a pull request is retargeted, so a change pointed at main after it was opened is still assessed.

codex: address PR review feedback (#545)

508f8dd

Wait for the automated review instead of failing while it runs, and re-check after the wait. A check that fails mid-review leaves the gate stale until some other event re-runs it, which a skipped review never produces.

cursor Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread .github/workflows/auto-approve.yml Outdated

Dzejkop added 3 commits September 17, 2026 12:51

codex: simplify the risk gate to the automated review

171ca6f

The reviewer is the risk gate: wait for it to review the current head, and leave the resolution of its comments to required conversation resolution. Drops the path allow-list, the rename handling and the code-owner approval logic.

chore: trim comments

fc577e8

codex: approve with the walletkit bot after the automated review

1386d55

Replaces the risk-gate check and the protocol-team bypass: the bot approves once the reviewer has reviewed the current head, and CODEOWNERS makes that approval count. Fails closed otherwise.

Dzejkop changed the title ~~ci: add risk gate for automated review and low-risk changes~~ ci: approve with the walletkit bot after the automated review Sep 17, 2026

codex: fix CI failure on PR #545

d48ce4b

The approve step has no checkout, so gh needs GH_REPO to find the repository.

wld-walletkit-bot approved these changes Sep 17, 2026

View reviewed changes

wld-walletkit-bot previously approved these changes Sep 17, 2026

View reviewed changes

codex: address PR review feedback (#545)

d3a7758

Run on pull_request_target so a pull request cannot rewrite the job that approves it, and drop the review event: the job waits for the reviewer itself.

Dzejkop dismissed wld-walletkit-bot’s stale review via d3a7758 September 17, 2026 11:07

cursor Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread .github/workflows/auto-approve.yml

wld-walletkit-bot previously approved these changes Sep 17, 2026

View reviewed changes

codex: address PR review feedback (#545)

d28f5d2

Only approve branches of this repository, and pass the pull request number through the environment instead of interpolating it into the shell.

Dzejkop dismissed wld-walletkit-bot’s stale review via d28f5d2 September 17, 2026 11:09

test: run the approver on pull_request

0b2be3a

Lets the workflow run for its own pull request. Switch back to pull_request_target before merging, otherwise a pull request can rewrite the job that approves it.

wld-walletkit-bot approved these changes Sep 17, 2026

View reviewed changes

wld-walletkit-bot previously approved these changes Sep 17, 2026

View reviewed changes

Dzejkop dismissed wld-walletkit-bot’s stale review via e98a1d7 September 17, 2026 11:21

cursor Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread .github/workflows/auto-approve.yml Outdated

Comment thread .github/workflows/auto-approve.yml Outdated

Dzejkop added 5 commits September 17, 2026 13:34

codex: let the agent inspect the pull request itself

0169db0

Drops the pre-fetched context and the disabled toolset: the agent runs with its normal tools and a short system prompt, and the bot token stays in the step that submits the approval.

test: run the approver on pull_request

5b7a3a5

Makes the workflow run for its own pull request; switch back to pull_request_target before merging.

test: actually switch the trigger to pull_request

a8ad2a0

codex: make the agent output visible

27b84a9

Text mode into the log, the transcript in the run summary, and one PR comment the agent edits in place on later pushes.

cursor Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread .github/workflows/auto-approve.yml Outdated

Comment thread .github/workflows/auto-approve.yml Outdated

Comment thread .github/workflows/auto-approve.yml

Dzejkop added 2 commits September 17, 2026 13:50

codex: fix the agent run

af7c27b

pi needs a user message, not just a system prompt, or it exits without doing anything. Write the extension where typebox resolves, next to the pi install.

codex: stream the agent output and fix the report step

4cde4ee

No pipe, so the log streams while the agent works; the transcript for the comment comes from the pi session file. The report step needs GH_REPO without a checkout.

cursor Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread .github/workflows/auto-approve.yml

Dzejkop added 6 commits September 17, 2026 13:58

chore: run the approver from the base branch again

dedf19d

fix: select the pi model with flags and keep the review transcript

b12a3cb

test: run the approver on pull_request

3e1b2a6

chore: run the approver on pull_request_target

3be65f5

test: run the risk gate on pull_request

acd0e3d

chore: run the risk gate on pull_request_target

1666a1d

cursor Bot reviewed Sep 17, 2026

View reviewed changes

Conversation

Dzejkop commented Sep 16, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wld-walletkit-bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Sep 17, 2026

Choose a reason for hiding this comment

Config guards miss dependency files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Dzejkop commented Sep 16, 2026 •

edited by cursor Bot

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

wld-walletkit-bot commented Sep 17, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading