fix Dependabot review request races

[Pigbibi]

What changed

• read the complete paginated PR timeline before identifying the latest review-request actor
• re-check the latest actor after deletion
• restore Pigbibi automatically if a maintainer requested review while cleanup was running

Why

This closes the remaining race between validating a bot-generated review request and deleting it. Human requests are preserved whether they happen before, during, or after the cleanup operation.

Validation

• bash syntax check
• git diff --check
• no PR code checkout or execution

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Reliability in .github/workflows/dependabot_review_request_cleanup.yml

The new restore branch unconditionally POSTs a review request whenever the latest timeline actor is no longer Dependabot. This is still race-prone: if a maintainer re-requests Pigbibi after the DELETE completes but before latest_review_request_actor is re-read, the reviewer is already present again and this POST becomes a duplicate request. GitHub's requested_reviewers endpoint rejects already-requested reviewers, and with set -euo pipefail that turns a harmless concurrent human action into a failing workflow run. (line 68)

Suggestion: Before the restore POST, re-read the live reviewRequests list and only POST when Pigbibi is currently absent, or treat the duplicate-reviewer API response as non-fatal so concurrent human restores do not fail the job.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db1c4f1213

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Respect a later removal of the review request

If a maintainer removes the bot's request, requests Pigbibi, and then retracts that request while this job is running, latest_review_request_actor still returns the maintainer because it ignores the subsequent review_request_removed timeline event. This POST then recreates a review request the maintainer explicitly removed; check the current request state or account for the later removal event before restoring.

Useful? React with 👍 / 👎.