Skip to content

fix(ci): reduce ClawSweeper GitHub API pressure#343

Merged
vincentkoc merged 1 commit into
mainfrom
fix/github-rate-limit-guard
Jun 20, 2026
Merged

fix(ci): reduce ClawSweeper GitHub API pressure#343
vincentkoc merged 1 commit into
mainfrom
fix/github-rate-limit-guard

Conversation

@vincentkoc

Copy link
Copy Markdown
Member

Summary

Reduce GitHub API pressure across ClawSweeper intake and review workers:

  • classify spam-comment candidates in-process before dispatching scanner work
  • centralize retry classification and bounded throttle waits across repair GitHub CLI calls
  • retain paginated status discovery while avoiding speculative capacity loss
  • document the one-dispatcher, one-token target setup

Verification

  • CI=true pnpm run check
  • CI=true pnpm run build:all
  • CI=true pnpm run check:limits
  • CI=true pnpm run check:active-surface
  • CI=true pnpm run test:unit
  • CI=true pnpm run test:repair
  • CI=true pnpm run test:coverage:changed
  • CI=true pnpm run format:check
  • local autoreview: clean

The OpenClaw ingress-side token pre-filter is in the companion PR: openclaw/openclaw.

@vincentkoc
vincentkoc requested a review from a team as a code owner June 20, 2026 10:41
@clawsweeper

clawsweeper Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 20, 2026, 6:45 AM ET / 10:45 UTC.

Summary
The PR removes the extra spam-comment intake dispatch workflow hop, runs spam candidate classification inside the github-activity job, centralizes repair gh retry waits on the shared retry helper, and documents rate-limit-safe target dispatcher setup.

Reproducibility: no. high-confidence live reproduction was performed. Source inspection shows current main dispatches created/edited comment activity through a second spam-intake workflow before classification, and repair gh retries currently use short 1-5 second waits.

Review metrics: 1 noteworthy metric.

  • Changed surface: 8 files, +86/-93. The PR spans workflows, retry helpers, docs, and tests, so maintainers should review both code behavior and live Actions rollout.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Let pending pnpm check and notify checks finish on the current head.
  • Monitor or capture one live github-activity spam-candidate path if maintainers want extra dispatch confidence.

Risk before merge

  • [P1] The PR changes live workflow dispatch and retry timing; static tests do not prove repository_dispatch with the activity workflow token or the shorter throttle cap under real GitHub API throttling.
  • [P1] The latest check probe still had pnpm check and notify pending, so current-head validation should finish before merge.

Maintainer options:

  1. Merge after workflow checks pass (recommended)
    Because this PR changes GitHub Actions dispatch behavior, maintainers should wait for current-head CI and notify checks to complete cleanly before merging.
  2. Hold for live dispatch proof
    If maintainers want stronger operational confidence, capture one comment activity run showing ordinary comments are skipped and an accepted spam candidate dispatches exactly once.

Next step before merge

  • [P2] No repair lane is needed; this maintainer-authored automation PR needs normal maintainer merge handling after checks and rollout confidence, not ClawSweeper branch repair.

Security
Cleared: No concrete security or supply-chain regression was found; the workflow keeps existing permissions and adds no new third-party action, dependency, or secret exposure.

Review details

Best possible solution:

Land the narrow automation and retry consolidation after current-head checks pass and maintainers are comfortable with the live dispatch rollout, with follow-up monitoring on the next github-activity spam-candidate path.

Do we have a high-confidence way to reproduce the issue?

No high-confidence live reproduction was performed. Source inspection shows current main dispatches created/edited comment activity through a second spam-intake workflow before classification, and repair gh retries currently use short 1-5 second waits.

Is this the best way to solve the issue?

Yes, mostly. Reusing the existing intake classifier inside github-activity and sharing the retry wait helper is a narrow maintainable fix, but the live workflow/token path should be validated by current-head checks or rollout monitoring.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 471bf8065dd4.

Label changes

Label changes:

  • add P2: This is a normal-priority CI/API-pressure fix affecting automation reliability with bounded blast radius.
  • add merge-risk: 🚨 automation: The diff changes GitHub Actions dispatch flow and retry timing, which green unit tests do not fully prove in live GitHub automation.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate is not applicable because this is a maintainer-authored PR; the PR body lists local command validation instead.

Label justifications:

  • P2: This is a normal-priority CI/API-pressure fix affecting automation reliability with bounded blast radius.
  • merge-risk: 🚨 automation: The diff changes GitHub Actions dispatch flow and retry timing, which green unit tests do not fully prove in live GitHub automation.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate is not applicable because this is a maintainer-authored PR; the PR body lists local command validation instead.
Evidence reviewed

What I checked:

  • Repository policy: AGENTS.md was read fully; it says ClawSweeper should keep changes narrow and automation-safe, and that maintainer-authored items are non-closeable. (AGENTS.md:3, 471bf8065dd4)
  • PR diff scope: The PR changes 8 files with 86 additions and 93 deletions across GitHub workflows, retry helpers, docs, and tests. (d172e6fac05a)
  • Current activity workflow dispatches a separate intake run: Current main dispatches created/edited comment activity to clawsweeper_spam_comment_intake before checkout, which is the extra workflow hop this PR removes. (.github/workflows/github-activity.yml:94, 471bf8065dd4)
  • Existing spam intake supports in-process classification: The existing spam intake code reads GITHUB_EVENT_PATH/GITHUB_EVENT_NAME, classifies the activity, skips non-candidates, and dispatches an exact scanner only for accepted candidates. (src/repair/spam-comment-intake.ts:61, 471bf8065dd4)
  • Current repair gh retry waits are short and local: Current main's repair gh retry wrappers use shouldRetryGh and sleep 1-5 seconds between retryable failures; the PR moves these calls to the shared ghRetryKind/ghRetryWaitMs path. (src/repair/github-cli.ts:121, 471bf8065dd4)
  • Check state: The latest check probe showed CodeQL and Windows launcher passing, with pnpm check and notify still pending at review time. (d172e6fac05a)

Likely related people:

  • Peter Steinberger: Blame on current main points the existing activity workflow dispatch, spam intake, retry helper, and repair gh retry code to the v0.3.0 release baseline commit. (role: introduced current baseline behavior; confidence: high; commits: dc824915bb6c, 30163dfd667b; files: .github/workflows/github-activity.yml, src/github-retry.ts, src/repair/github-cli.ts)
  • Vincent Koc: Recent merged work touched the exact admission/spam-adjacent automation area before this PR, so this author is connected to current-main behavior beyond only proposing this branch. (role: recent area contributor; confidence: high; commits: ac8f2c5e61c2, bff8bf992f29; files: .github/workflows/github-activity.yml, src/repair/spam-comment-intake.ts)
  • brokemac79: Recent history shows activity workflow cancellation work on the same GitHub activity surface. (role: recent adjacent contributor; confidence: medium; commits: f2b07a7265fb; files: .github/workflows/github-activity.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Jun 20, 2026
@vincentkoc
vincentkoc merged commit 1566ad6 into main Jun 20, 2026
10 checks passed
@vincentkoc
vincentkoc deleted the fix/github-rate-limit-guard branch June 20, 2026 16:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. P2 Normal priority bug or improvement with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant