fix preserve Dependabot reviewer intent

[Pigbibi]

What changed

• model both review_requested and review_request_removed timeline events
• paginate the complete PR timeline
• re-check current reviewer state immediately before deletion
• preserve the latest human request/removal intent during concurrent updates
• restore a human request only when it is still the latest human action and currently absent
• handle concurrent DELETE races without hiding genuine API failures

Why

This closes the remaining reviewer-state races in Dependabot CODEOWNERS cleanup. A maintainer can request or withdraw review while cleanup is queued without having that intent overwritten.

Validation

• bash syntax check
• jq event-state fixture check
• git diff --check
• no checkout or execution of PR code

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

The concurrent-intent restoration logic treats any actor other than dependabot[bot], app/dependabot, github-actions[bot], and github-actions as a human. If another bot or GitHub App requests or removes this reviewer while cleanup is running, its event becomes human_intent and the workflow will restore or preserve that bot-driven state as if it were a maintainer action. That makes the cleanup outcome depend on unrelated automation and can re-add or suppress reviewers incorrectly in production PRs. (line 74)

Suggestion: Classify actors by bot/app identity instead of a small denylist of login strings. For example, inspect timeline actor metadata such as actor.type and only treat User actors as human intent, or maintain an explicit allowlist of human actor types rather than assuming every non-matching login is a person.

---

Review by Codex PR Review bot • PR