chore: sync repository quality assets

.github/workflows/copilot-review-refresh.yml

@@ -196,9 +196,8 @@ jobs:
                           test("^mlx90-current-revision:managed-sync:v6:" + $pr
                             + ":[1-9][0-9]*:" + $base + ":" + $head + "$")))
                       or
-                      (($author == "lightning-it-release-automation[bot]"
-                        or ($repository == "lightning-it/.github"
-                          and $author == "lightning-it-shared-assets-sync[bot]"))
+                      (($repository == "lightning-it/.github"
+                        and $author == "lightning-it-shared-assets-sync[bot]")
                         and ($check.external_id |
                           test("^mlx90-current-revision:ancestry-backmerge:v6:"
                             + $pr + ":[1-9][0-9]*:" + $base + ":" + $head + "$")))
@@ -214,9 +213,8 @@ jobs:
                           test("^mlx90-current-revision:copilot:v5:[1-9][0-9]*:"
                             + $base + ":" + $head + "$")))
                       or
-                      (($author == "lightning-it-release-automation[bot]"
-                        or ($repository == "lightning-it/.github"
-                          and $author == "lightning-it-shared-assets-sync[bot]"))
+                      (($repository == "lightning-it/.github"
+                        and $author == "lightning-it-shared-assets-sync[bot]")
                         and ($check.external_id |
                           test("^mlx90-current-revision:ancestry-backmerge:v5:"
                             + "[1-9][0-9]*:" + $base + ":" + $head + "$")))

.github/workflows/copilot-review.yml

@@ -200,24 +200,12 @@ jobs:
       github.event_name == 'pull_request_target' &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'lightning-it-release-automation[bot]' &&
       (github.event.action == 'edited' ||
-        (((github.event.action == 'opened' ||
+        github.event.action == 'opened' ||
         github.event.action == 'synchronize' ||
         github.event.action == 'reopened' ||
-        github.event.action == 'ready_for_review') &&
-        github.event.pull_request.user.login != 'lightning-it-release-automation[bot]') ||
-        ((github.event.action == 'opened' ||
-          github.event.action == 'synchronize' ||
-          github.event.action == 'reopened' ||
-          github.event.action == 'ready_for_review') &&
-          github.event.pull_request.user.login == 'lightning-it-release-automation[bot]' &&
-          github.event.pull_request.base.ref == 'develop' &&
-          startsWith(github.event.pull_request.head.ref, 'backmerge/') &&
-          endsWith(github.event.pull_request.head.ref, '-main') &&
-          startsWith(
-            github.event.pull_request.title,
-            'chore(governance): record main ancestry before '
-          ))))
+        github.event.action == 'ready_for_review')
     # Serialize every producer for this PR. Different event actions may overlap
     # at workflow level so the one-time Copilot request is never cancelled, but
     # no two verifier jobs may invalidate or publish the neutral check at once.
@@ -241,7 +229,7 @@ jobs:
           EVENT_BASE_REF: ${{ github.event.pull_request.base.ref }}
           EVENT_BODY: ${{ github.event.pull_request.body }}
           EVENT_TITLE: ${{ github.event.pull_request.title }}
-          EVENT_UPDATED_AT: ${{ github.event.pull_request.updated_at }}
+          EVENT_EDITED_AT: ${{ github.event.pull_request.updated_at }}
           GH_TOKEN: ${{ github.token }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
@@ -280,6 +268,34 @@ jobs:
           [[ "${BASE_SHA}" =~ ^[0-9a-f]{40}$ ]]
           [[ "${HEAD_SHA}" =~ ^[0-9a-f]{40}$ ]]
           [[ "${PR_NUMBER}" =~ ^[1-9][0-9]*$ ]]
+          # For an edited webhook, REST updated_at is the event's edit
+          # revision. Bind it to GraphQL lastEditedAt because unrelated
+          # comments and reviews may advance only the live REST updated_at.
+          [[ "${EVENT_EDITED_AT}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
+          owner="${REPOSITORY%%/*}"
+          repository="${REPOSITORY#*/}"
+          read -r -d '' query <<'GRAPHQL' || true
+          query($owner: String!, $repository: String!, $number: Int!) {
+            repository(owner: $owner, name: $repository) {
+              pullRequest(number: $number) {
+                number
+                lastEditedAt
+              }
+            }
+          }
+          GRAPHQL
+          metadata="$(api_read graphql \
+            -f query="${query}" \
+            -F owner="${owner}" \
+            -F repository="${repository}" \
+            -F number="${PR_NUMBER}")"
+          jq -e \
+            --arg edited_at "${EVENT_EDITED_AT}" \
+            --argjson number "${PR_NUMBER}" '
+              ((.errors // []) | length) == 0
+              and .data.repository.pullRequest.number == $number
+              and .data.repository.pullRequest.lastEditedAt == $edited_at
+            ' <<<"${metadata}" >/dev/null
           pr="$(api_read "repos/${REPOSITORY}/pulls/${PR_NUMBER}")"
           jq -e \
             --arg base_ref "${EVENT_BASE_REF}" \
@@ -288,11 +304,9 @@ jobs:
             --arg head_ref "${HEAD_REF}" \
             --arg head_sha "${HEAD_SHA}" \
             --arg repository "${REPOSITORY}" \
-            --arg title "${EVENT_TITLE}" \
-            --arg updated_at "${EVENT_UPDATED_AT}" '
+            --arg title "${EVENT_TITLE}" '
               .state == "open"
               and .draft == false
-              and .updated_at == $updated_at
               and .title == $title
               and (.body // "") == $body
               and .base.ref == $base_ref
@@ -534,9 +548,8 @@ jobs:
               <<<"${live_pr}" >/dev/null; then
             trusted=true
             trusted_kind=repository-quality
-          elif { [ "${PR_AUTHOR}" = "lightning-it-release-automation[bot]" ] \
-              || { [ "${REPOSITORY}" = "lightning-it/.github" ] \
-                && [ "${PR_AUTHOR}" = "lightning-it-shared-assets-sync[bot]" ]; }; } \
+          elif [ "${REPOSITORY}" = "lightning-it/.github" ] \
+            && [ "${PR_AUTHOR}" = "lightning-it-shared-assets-sync[bot]" ] \
             && [ "${PR_HEAD_REPO}" = "${REPOSITORY}" ] \
             && [[ "${PR_HEAD}" == backmerge/*-main ]] \
             && [ "${PR_BASE}" = "develop" ] \
@@ -1197,12 +1210,8 @@ jobs:
             external_kind="managed-sync"
             result_title="Current revision managed distribution exemption passed"
           elif [ "${TRUSTED_KIND}" = ancestry-backmerge ]; then
-            if [ "${author}" = 'lightning-it-release-automation[bot]' ]; then
-              :
-            else
-              test "${REPOSITORY}" = "lightning-it/.github"
-              test "${author}" = 'lightning-it-shared-assets-sync[bot]'
-            fi
+            test "${REPOSITORY}" = "lightning-it/.github"
+            test "${author}" = 'lightning-it-shared-assets-sync[bot]'
             test "${TRUSTED_KIND}" = ancestry-backmerge
             test "${base_ref}" = develop
             [[ "${EVENT_HEAD_REF}" == backmerge/*-main ]]

.github/workflows/current-revision-rerun.yml

@@ -178,9 +178,8 @@ jobs:
               ' <<<"${producer}" >/dev/null
           else
             if [ "${external_kind}" = ancestry-backmerge ]; then
-              test "${author}" = 'lightning-it-release-automation[bot]' \
-                || { test "${REPOSITORY}" = 'lightning-it/.github' \
-                  && test "${author}" = 'lightning-it-shared-assets-sync[bot]'; }
+              test "${REPOSITORY}" = 'lightning-it/.github'
+              test "${author}" = 'lightning-it-shared-assets-sync[bot]'
               test "$(jq -r .review_path <<<"${neutral_summary}")" = \
                 'deterministic evidence-bound ancestry exemption'
             elif [ "${external_kind}" = managed-sync ]; then