Skip CI reviews for labeled pull requests

[mariusvniekerk]

The CI poller can now treat labels in the operator-owned [ci].skip_labels list as explicit review bypasses. Matching is case-insensitive, and a matching pull request does not create a review panel. Deferred attempts honor the same gate and are removed, so the same head becomes eligible again after a maintainer removes the label. Pull request branches cannot change this global policy.

With GitHub App authentication, roborev publishes the bypass as a check run with a skipped conclusion. It does not report the bypass as a successful review. Repeated polls reuse the existing skipped check, and GitHub App setups need the Checks read/write permission. GitHub does not permit personal authentication to create check runs, so those setups still suppress the review but cannot publish the skipped result.

[roborev-ci]

roborev: Combined Review (4f8e609)

Verdict: High-severity security issue found; labeled PRs can bypass required reviews, and existing work may continue after labeling.

High

• Required review status can be bypassed via skip labels — internal/daemon/ci_poller.go:573-577; deferred retry path internal/daemon/ci_poller.go:2645-2652
skipLabeledPR marks the required roborev commit-status context as successful without running a review. Anyone with label-management permission could apply the configured skip label, causing branch protection to report a green check and potentially allowing unreviewed code to merge. Keep the required context pending/error, use a separate non-required skipped context, or require authorization from a trusted maintainer or bot.

Medium

• Adding a skip label does not retire existing review work — internal/daemon/ci_poller.go:411-420
  The label check occurs after alreadyReviewedPR, so pending or deferred work may remain active and complete by posting a review despite the PR now being labeled. Cancel or retire existing work before publishing the skipped status.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 4m49s

[roborev-ci]

roborev: Combined Review (8ce7a54)

Verdict: High-severity authorization bypass and a medium-severity label-processing race remain in the CI poller.

High

• internal/daemon/ci_poller.go:419-421 (also retry path around :2641): Skip labels are trusted based on name alone, allowing collaborators who can manage labels but cannot waive security reviews to bypass automated security review. Restrict skip-label handling to trusted maintainers/bots or an operator-controlled waiver mechanism.

Medium

• internal/daemon/ci_poller.go:412-420: alreadyReviewedPR runs before skip-label matching. If a skip label is added while the current-head review is pending or running, the function returns early; no skipped check is published, and the existing review may still complete and post. Evaluate skip labels first and cancel or retire nonterminal current-head panels or retry attempts.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 9m47s

[mariusvniekerk]

These particular findings are irrelevant. Disregard them.