From c1b3094e6b90ec8b9f69a15f367c234714670f87 Mon Sep 17 00:00:00 2001
From: Roomote <roomote@roomote.dev>
Date: Thu, 3 Sep 2026 23:43:00 +0000
Subject: [PATCH 1/4] fix(ci): recognize legacy CodeRabbit reviews

---
 .github/workflows/label-pr-review-state.yml            |  7 +++++--
 .../__tests__/pr-review-state-workflow.test.ts         | 10 +++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/label-pr-review-state.yml b/.github/workflows/label-pr-review-state.yml
index b0bb560d98..c6da7dba28 100644
--- a/.github/workflows/label-pr-review-state.yml
+++ b/.github/workflows/label-pr-review-state.yml
@@ -73,6 +73,7 @@ jobs:
             const guideMarker = '<!-- zoo-code-pr-review-process -->';
             const codeRabbitLabelMarkerPrefix = '<!-- coderabbit-review-label:';
             const codeRabbitLogin = 'coderabbitai[bot]';
+            const codeRabbitLogins = new Set([codeRabbitLogin, 'coderabbitai']);
             const codeRabbitActiveLabel = 'coderabbit-review-active';
             const reviewGateName = 'Zoo Code / PR review gate';
             const reconciliationCheckName = 'Zoo Code / reconcile PR review state';
@@ -601,10 +602,11 @@ jobs:
                 const latest = new Map();
                 for (const r of reviews) {
                   const reviewer = r.user.login.toLowerCase();
+                  const reviewerKey = codeRabbitLogins.has(reviewer) ? codeRabbitLogin : reviewer;
                   if (r.state === 'DISMISSED') {
-                    latest.delete(reviewer);
+                    latest.delete(reviewerKey);
                   } else if (r.state !== 'COMMENTED') {
-                    latest.set(reviewer, r);
+                    latest.set(reviewerKey, r);
                   }
                 }
 
@@ -616,6 +618,7 @@ jobs:
                 for (const review of latest.values()) {
                   if (review.commit_id !== pr.head.sha ||
                       review.user?.type === 'Bot' ||
+                      codeRabbitLogins.has(review.user?.login.toLowerCase()) ||
                       review.user?.login.toLowerCase() === pr.user?.login.toLowerCase()) {
                     continue;
                   }
diff --git a/src/services/__tests__/pr-review-state-workflow.test.ts b/src/services/__tests__/pr-review-state-workflow.test.ts
index 9b93b428c2..b9264dfca5 100644
--- a/src/services/__tests__/pr-review-state-workflow.test.ts
+++ b/src/services/__tests__/pr-review-state-workflow.test.ts
@@ -861,12 +861,16 @@ describe("PR review-state workflow", () => {
 		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["awaiting-maintainer"] }))
 	})
 
-	it("recognizes CodeRabbit regardless of login casing", async () => {
+	it.each([
+		{ login: "CodeRabbitAI[bot]", type: "Bot" },
+		{ login: "coderabbitai", type: "User" },
+	] as const)("recognizes CodeRabbit review login $login", async ({ login, type }) => {
 		const result = await runWorkflow({
+			permissionErrorStatus: 500,
 			reviews: [
 				{
-					login: "CodeRabbitAI[bot]",
-					type: "Bot",
+					login,
+					type,
 					state: "APPROVED",
 					submittedAt: REVIEWED_AT,
 				},

From fbb57ab0953ceefbae1484c9af2f131bef6caa4f Mon Sep 17 00:00:00 2001
From: Roomote <roomote@roomote.dev>
Date: Fri, 4 Sep 2026 01:44:07 +0000
Subject: [PATCH 2/4] fix(ci): reconcile conflicts after main updates

---
 .github/workflows/label-pr-review-state.yml   | 23 +++++-
 .../pr-review-state-workflow.test.ts          | 82 +++++++++++++++++--
 2 files changed, 98 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/label-pr-review-state.yml b/.github/workflows/label-pr-review-state.yml
index c6da7dba28..f302ff0480 100644
--- a/.github/workflows/label-pr-review-state.yml
+++ b/.github/workflows/label-pr-review-state.yml
@@ -3,6 +3,8 @@ name: Label PR review state
 on:
   schedule:
     - cron: "0 * * * *" # hourly fallback
+  push:
+    branches: [main]
   workflow_dispatch:
     inputs:
       pull_request_number:
@@ -79,7 +81,7 @@ jobs:
             const reconciliationCheckName = 'Zoo Code / reconcile PR review state';
 
             // When triggered by a single PR event, only reconcile that PR.
-            // The hourly schedule and workflow_dispatch reconcile all open PRs.
+            // Main-branch pushes, the hourly schedule, and workflow_dispatch reconcile all open PRs.
             let prs;
             let eventPrNumbers = [];
             if (context.payload.pull_request?.number) {
@@ -310,6 +312,7 @@ jobs:
                 conflict: 'Resolve the merge conflicts. The review sequence resumes after the branch is mergeable.',
                 'ci-pending': 'Wait for the required CI checks to finish.',
                 'ci-failed': 'Fix the failing required CI checks and push an update.',
+                'mergeability-pending': 'Wait for GitHub to finish calculating mergeability.',
                 'configuration-error': 'Repository rules must not require this advisory workflow\'s own gate or reconciliation job.',
                 'coderabbit-changes': 'Address CodeRabbit findings and push an update. Review restarts after CI passes.',
                 coderabbit: 'Required CI passed. Wait for CodeRabbit to approve the latest commit.',
@@ -678,6 +681,24 @@ jobs:
                   phase = 'approved';
                 }
 
+                if (desiredLabel === 'awaiting-maintainer') {
+                  const { data: latestPrDetail } = await github.rest.pulls.get({
+                    owner, repo, pull_number: pr.number,
+                  });
+                  if (latestPrDetail.mergeable === false && latestPrDetail.mergeable_state === 'dirty') {
+                    core.info(`PR #${pr.number}: has merge conflicts — labeling has-conflicts`);
+                    await updateReviewGate(pr, 'conflict', false);
+                    await setCodeRabbitReviewActive(pr, false);
+                    await reconcileLabels(pr, 'has-conflicts');
+                    await updateReviewGuide(pr, 'conflict', existingGuide);
+                    continue;
+                  }
+                  if (latestPrDetail.mergeable === null || latestPrDetail.mergeable_state === 'unknown') {
+                    desiredLabel = null;
+                    phase = 'mergeability-pending';
+                  }
+                }
+
                 core.info(
                   `PR #${pr.number}: CI passing, reviews=${latest.size}, ` +
                   `coderabbit=${freshCodeRabbitReview?.state ?? (automatedAuthor ? 'optional' : 'pending')}, ` +
diff --git a/src/services/__tests__/pr-review-state-workflow.test.ts b/src/services/__tests__/pr-review-state-workflow.test.ts
index b9264dfca5..26e65404d6 100644
--- a/src/services/__tests__/pr-review-state-workflow.test.ts
+++ b/src/services/__tests__/pr-review-state-workflow.test.ts
@@ -24,6 +24,7 @@ interface HarnessOptions {
 	conflict?: boolean
 	mergeable?: boolean | null
 	mergeableState?: string
+	mergeabilitySequence?: Array<{ mergeable: boolean | null; mergeableState: string }>
 	fork?: boolean
 	eventName?: string
 	workflowRunAssociated?: boolean
@@ -244,7 +245,15 @@ async function runWorkflow(options: HarnessOptions = {}) {
 		}
 		return [pr]
 	})
-	const getPullRequest = vi.fn(async () => ({ data: pr }))
+	let mergeabilityIndex = 0
+	const getPullRequest = vi.fn(async () => {
+		const mergeability = options.mergeabilitySequence?.[mergeabilityIndex++]
+		return {
+			data: mergeability
+				? { ...pr, mergeable: mergeability.mergeable, mergeable_state: mergeability.mergeableState }
+				: pr,
+		}
+	})
 
 	const github = {
 		paginate: vi.fn(async (target: unknown, args: unknown) => {
@@ -323,11 +332,14 @@ async function runWorkflow(options: HarnessOptions = {}) {
 			},
 		},
 	}
-	const pullRequestPayload = {
-		number: 1437,
-		head: { repo: { full_name: headRepository } },
-		base: { repo: { full_name: "Zoo-Code-Org/Zoo-Code" } },
-	}
+	const pullRequestPayload =
+		eventName === "push"
+			? undefined
+			: {
+					number: 1437,
+					head: { repo: { full_name: headRepository } },
+					base: { repo: { full_name: "Zoo-Code-Org/Zoo-Code" } },
+				}
 	const payload =
 		eventName === "schedule"
 			? {}
@@ -829,6 +841,64 @@ describe("PR review-state workflow", () => {
 		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["has-conflicts"] }))
 	})
 
+	it("clears awaiting-maintainer when a main push introduces conflicts", async () => {
+		const result = await runWorkflow({
+			eventName: "push",
+			conflict: true,
+			labels: ["awaiting-maintainer"],
+		})
+
+		expect(workflow.on.push.branches).toContain("main")
+		expect(result.listPullRequests).toHaveBeenCalledWith(expect.objectContaining({ state: "open" }))
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["has-conflicts"] }))
+	})
+
+	it("rechecks mergeability before tagging a PR awaiting maintainer", async () => {
+		const result = await runWorkflow({
+			eventName: "push",
+			labels: ["awaiting-maintainer"],
+			mergeabilitySequence: [
+				{ mergeable: null, mergeableState: "unknown" },
+				{ mergeable: false, mergeableState: "dirty" },
+			],
+			reviews: [
+				{
+					login: "coderabbitai[bot]",
+					type: "Bot",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["has-conflicts"] }))
+	})
+
+	it("does not tag a PR awaiting maintainer while mergeability is unknown", async () => {
+		const result = await runWorkflow({
+			eventName: "push",
+			labels: ["awaiting-maintainer"],
+			mergeabilitySequence: [
+				{ mergeable: null, mergeableState: "unknown" },
+				{ mergeable: null, mergeableState: "unknown" },
+			],
+			reviews: [
+				{
+					login: "coderabbitai[bot]",
+					type: "Bot",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.addLabels).not.toHaveBeenCalledWith(expect.objectContaining({ labels: ["awaiting-maintainer"] }))
+		expect(latestGateStatus(result)?.description).toContain("calculating mergeability")
+	})
+
 	it("routes CodeRabbit change requests back to the author", async () => {
 		const result = await runWorkflow({
 			labels: ["coderabbit-review-active"],

From d90c348746ebcb3f3459827621811c65a6690b9d Mon Sep 17 00:00:00 2001
From: Roomote <roomote@roomote.dev>
Date: Fri, 4 Sep 2026 02:41:12 +0000
Subject: [PATCH 3/4] fix(ci): preserve PR state on label add failure

---
 .github/workflows/label-pr-review-state.yml   | 34 +++++++++++--------
 .../pr-review-state-workflow.test.ts          | 12 +++++++
 2 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/label-pr-review-state.yml b/.github/workflows/label-pr-review-state.yml
index cd93dfc2c1..18de03d6a4 100644
--- a/.github/workflows/label-pr-review-state.yml
+++ b/.github/workflows/label-pr-review-state.yml
@@ -183,6 +183,19 @@ jobs:
               }
               const currentLabels = new Set(pr.labels.map(l => l.name));
               const labelErrors = [];
+              if (desiredLabel && !currentLabels.has(desiredLabel)) {
+                try {
+                  await github.rest.issues.addLabels({
+                    owner, repo, issue_number: pr.number, labels: [desiredLabel],
+                  });
+                  currentLabels.add(desiredLabel);
+                  pr.labels.push({ name: desiredLabel });
+                } catch (err) {
+                  const error = new Error(`Could not add desired label: ${err.message}`);
+                  error.preserveStateLabels = true;
+                  throw error;
+                }
+              }
               for (const label of stateLabels) {
                 if (label !== desiredLabel && currentLabels.has(label)) {
                   try {
@@ -201,17 +214,6 @@ jobs:
                   }
                 }
               }
-              if (desiredLabel && !currentLabels.has(desiredLabel)) {
-                try {
-                  await github.rest.issues.addLabels({
-                    owner, repo, issue_number: pr.number, labels: [desiredLabel],
-                  });
-                  currentLabels.add(desiredLabel);
-                  pr.labels.push({ name: desiredLabel });
-                } catch (err) {
-                  labelErrors.push(err);
-                }
-              }
               if (desiredLabel !== 'awaiting-author' && currentLabels.has('stale-awaiting-author')) {
                 try {
                   await github.rest.issues.removeLabel({
@@ -763,10 +765,12 @@ jobs:
                 } catch (cleanupError) {
                   metadataErrors.push(cleanupError);
                 }
-                try {
-                  await reconcileLabels(pr, null);
-                } catch (cleanupError) {
-                  metadataErrors.push(cleanupError);
+                if (!error.preserveStateLabels) {
+                  try {
+                    await reconcileLabels(pr, null);
+                  } catch (cleanupError) {
+                    metadataErrors.push(cleanupError);
+                  }
                 }
                 const detail = error.status
                   ? `${error.message} (HTTP ${error.status}${error.response?.data?.message ? `: ${error.response.data.message}` : ''})`
diff --git a/src/services/__tests__/pr-review-state-workflow.test.ts b/src/services/__tests__/pr-review-state-workflow.test.ts
index a617c3baa2..daa273309d 100644
--- a/src/services/__tests__/pr-review-state-workflow.test.ts
+++ b/src/services/__tests__/pr-review-state-workflow.test.ts
@@ -923,6 +923,18 @@ describe("PR review-state workflow", () => {
 		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["has-conflicts"] }))
 	})
 
+	it("preserves awaiting-maintainer when adding has-conflicts fails", async () => {
+		const result = await runWorkflow({
+			conflict: true,
+			labels: ["awaiting-maintainer"],
+			addLabelsStatus: 500,
+		})
+
+		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["has-conflicts"] }))
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.setFailed).toHaveBeenCalledWith(expect.stringContaining("Could not add desired label"))
+	})
+
 	it("rechecks mergeability before tagging a PR awaiting maintainer", async () => {
 		const result = await runWorkflow({
 			eventName: "push",

From ddbe19f7fb26a9505abc35e412d62b26db31df3a Mon Sep 17 00:00:00 2001
From: Roomote <roomote@roomote.dev>
Date: Fri, 4 Sep 2026 03:02:17 +0000
Subject: [PATCH 4/4] fix(ci): restore PR label write permission

---
 .github/workflows/label-pr-review-state.yml             | 2 +-
 src/services/__tests__/pr-review-state-workflow.test.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/label-pr-review-state.yml b/.github/workflows/label-pr-review-state.yml
index 18de03d6a4..d2c24ce3c0 100644
--- a/.github/workflows/label-pr-review-state.yml
+++ b/.github/workflows/label-pr-review-state.yml
@@ -29,7 +29,7 @@ permissions:
   # This privileged workflow only reads PR/check metadata and writes issue labels,
   # comments, and commit statuses. All unspecified permissions, including contents,
   # are none; no fork code or configuration is checked out or executed.
-  pull-requests: read
+  pull-requests: write
   issues: write
   checks: read
   statuses: write
diff --git a/src/services/__tests__/pr-review-state-workflow.test.ts b/src/services/__tests__/pr-review-state-workflow.test.ts
index daa273309d..abc77eed2a 100644
--- a/src/services/__tests__/pr-review-state-workflow.test.ts
+++ b/src/services/__tests__/pr-review-state-workflow.test.ts
@@ -425,7 +425,7 @@ describe("PR review-state workflow", () => {
 
 	it("keeps privileged event handling metadata-only and least-privilege", () => {
 		expect(workflow.permissions).toEqual({
-			"pull-requests": "read",
+			"pull-requests": "write",
 			issues: "write",
 			checks: "read",
 			statuses: "write",