fix Dependabot review request races

[Pigbibi]

What changed

• read the complete paginated PR timeline before identifying the latest review-request actor
• re-check the latest actor after deletion
• restore Pigbibi automatically if a maintainer requested review while cleanup was running

Why

This closes the remaining race between validating a bot-generated review request and deleting it. Human requests are preserved whether they happen before, during, or after the cleanup operation.

Validation

• bash syntax check
• git diff --check
• no PR code checkout or execution

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

latest_review_request_actor() only looks at review_requested timeline events and ignores later review_request_removed events for the same reviewer. During the new post-delete recheck, this can wrongly restore Pigbibi after a maintainer has already removed that review request: if a maintainer requests review while cleanup is running and then removes it before the second check, the latest matching review_requested actor is still the maintainer, so the workflow re-adds the reviewer against the current PR state. (line 35)

Suggestion: When deciding whether to restore, evaluate the latest timeline event for that reviewer across both review_requested and review_request_removed, or re-read the current reviewRequests state after deletion and restore only if the reviewer is currently requested by a non-Dependabot actor.

---

Review by Codex PR Review bot • PR