chore: add fleet-wide no-op approve-step remediation scripts - #39
Conversation
Adds two operator-run scripts implementing dev-env#21's remediation plan: no repo in either org requires an approving review, so the `gh pr review --approve` step in dependabot-auto-merge.yml is dead weight everywhere it appears. - drop-noop-approve-step.sh: clones each of the 26 affected repos into a scratch dir, removes the inert approve line, and opens one real PR per repo (normal review hooks apply; nothing is merged automatically). - generate-settings-plan.sh: writes (does not execute) the gh api commands to flip can_approve_pull_request_reviews to false for all 28 candidate repos, preserving each repo's existing default_workflow_permissions. Output is reviewed and run by hand.
Git hooks aren't cloned with a repo, so no local review hook runs in the scratch clones this script creates. Corrects the comment to say so. Closes #36
ReviewTwo new operator scripts for the #21 remediation (fleet-wide audit of drop-noop-approve-step.sh: Clones 26 repos, removes dead generate-settings-plan.sh: Generates gh api commands to flip gitignore: Correctly ignores the generated plan file. No unreachable code paths, missing error handling, or silent failures detected. Scripts have early auth checks, proper logging of results/errors at each step. Suitable for personal operator use. VERDICT: PASS |
1 participant
Summary
Implements the remediation plan from #21's audit as two operator-run scripts, so the fleet-wide fix doesn't require token-burning agent supervision per repo.
scripts/drop-noop-approve-step.sh— clones each of the 26 affected repos, removes the deadgh pr review --approvestep fromdependabot-auto-merge.yml(no repo in either org requires an approving review, so the step never did anything), and opens one real PR per repo. Nothing is merged automatically.scripts/generate-settings-plan.sh— writes (does not execute) thegh apicommands to flipcan_approve_pull_request_reviewstofalsefor all 28 candidate repos, preserving each repo's currentdefault_workflow_permissions. The operator reviews and runs the output by hand.Both scripts are macOS-only (documented), preflight-check
gh auth status, and fail loudly rather than silently on partial failures.Related: #21 (audit), #35 (pre-commit review-loop process issue filed during this PR's development), #36/#37/#38 (non-blocking findings auto-filed by pre-push codebase review — minor comment/clarity fixes, already partially addressed).
Test plan
bash -nandshellcheck -S infoclean on both scripts (done locally)generate-settings-plan.shdry-run produces a correct, reviewable plan (done locally against live repos)drop-noop-approve-step.shagainst the real fleet and confirms PRs open cleanly