[giscebot]

TASK-96747

Closes #335

What changed

• treat pull_request.synchronize as a read-only submit_review trigger when a configured bot is still a reviewer
• use the signed payload for outstanding requests and the fully paginated GitHub timeline for completed reviews, with review_request_removed taking precedence when it is the latest transition
• fail closed as reviewer_lookup_failed, and avoid GitHub lookups outside webhookCanaryRepos / enabledRepos
• key synchronize events by PR and head SHA so a newer push queues behind an in-flight review instead of coalescing into stale work
• document why GitHub remains the source of truth instead of adding persistent reviewer state or merge cleanup

Validation

• pytest -q — 683 passed
• pytest -q tests/test_webhook.py -k 'synchronize or rereview' — 10 passed
• git diff --check
• GitHub dashboard and Python 3.11/3.12 checks — passed on 7f1dc6a

Risk / rollout

No database migration or webhook subscription change is required: pull_request is already a required event. When the bot is not present in requested_reviewers, each synchronize delivery performs one paginated issue-timeline lookup; lookup failures do not dispatch review work.

[pilipilisbot]

Approved at 7f1dc6a.

The design fits the request: synchronize is accepted only for a configured bot reviewer, uses GitHub's reviewer state/timeline rather than bridge-owned state, fails closed on lookup errors, and retains the per-PR concurrency guard while distinguishing pushes by head SHA. I checked the canary/enabled-repo guards, event identity and queue path, the timeline transition behavior against an existing reviewed PR, and the documentation/operational implications. No schema or subscription change is needed.

Validation: focused tests/test_webhook.py -k 'synchronize or rereview' (10 passed), git diff --check, and green dashboard/Python 3.11/Python 3.12 CI on this head. The review worktree is clean.

[giscebot]

Post-merge follow-up: verified merge commit 8d11a7c and green dashboard/Python 3.11/Python 3.12 checks. The dedicated clean worktree github-agent-bridge-issue-335 was removed. This confirms repository cleanup only; production rollout still requires the documented migration/operational checks and observation window.

[pilipilisbot]

Post-merge cleanup update for #336 (8d11a7c): a second dedicated worktree, /home/openclaw/projects/gisce-ti/worktrees/github-agent-bridge-pr-336, remained after the earlier cleanup note. It was clean at the merged PR head 7f1dc6a, so I removed it and pruned worktree records. A fresh worktree scan found no remaining worktree matching PR #336, its head branch, or its head SHA; the canonical checkout was left untouched. No code or PR metadata changed.