Repository navigation
self-development: prevent kelos-bot from triggering self-development spawners - #1100
Conversation
…spawners Add `excludeAuthors: [kelos-bot[bot]]` at the top level of webhook-driven self-development TaskSpawners and remove the now-redundant `kelos-bot[bot]` positive author allowlist entries. Top-level ExcludeAuthors is evaluated before filters and takes precedence over filter-level Author matches, so agent-authored comments containing strings like `/kelos api-review` no longer recursively trigger another spawner. Affects: kelos-workers, kelos-planner, kelos-pr-responder, kelos-reviewer, kelos-api-reviewer. kelos-triage is left unchanged so bot-created issues (e.g. from kelos-self-update) continue to be triaged. kelos-squash-commits already restricts to gjkim42 only.
Greptile SummaryThis PR closes the bot-on-bot recursion vector (issue #1098) by adding
Confidence Score: 4/5Safe to merge — the recursion fix is correct and complete; only a minor All changed files are simple YAML config edits that are logically correct. The only finding is a P2 style violation ( No files require special attention.
|
| Filename | Overview |
|---|---|
| self-development/kelos-api-reviewer.yaml | Adds top-level excludeAuthors: kelos-bot[bot] and removes both redundant author: kelos-bot[bot] entries (issue_comment and pull_request_review) from the api-review command filters. |
| self-development/kelos-reviewer.yaml | Adds top-level excludeAuthors: kelos-bot[bot] and removes both redundant author: kelos-bot[bot] entries (issue_comment and pull_request_review) from the review command filters. |
| self-development/kelos-pr-responder.yaml | Adds top-level excludeAuthors: kelos-bot[bot] and removes the redundant issue_comment pick-up filter scoped to kelos-bot[bot]; the pull_request_review filter (which already had no author restriction) is now correctly guarded by the top-level exclusion. |
| self-development/kelos-planner.yaml | Adds top-level excludeAuthors: kelos-bot[bot] and removes the redundant per-filter author: kelos-bot[bot] entry from the plan command filter. |
| self-development/kelos-workers.yaml | Adds top-level excludeAuthors: kelos-bot[bot] and removes the now-redundant per-filter author: kelos-bot[bot] entry for the issue_comment pick-up filter. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
GH[GitHub Webhook Event] --> EA{excludeAuthors check}
EA -- "author == kelos-bot[bot]" --> DROP[🚫 Event dropped — no spawner triggered]
EA -- "author != kelos-bot[bot]" --> FL{Filter evaluation}
FL -- "filter matches e.g. gjkim42 + bodyContains" --> SPAWN[✅ TaskSpawner fires]
FL -- no match --> NOOP[Event ignored]
subgraph Before this PR
OLD_FL{Filter evaluation OLD} -- "author: gjkim42 match" --> OLD_SPAWN1[TaskSpawner fires]
OLD_FL -- "author: kelos-bot[bot] match + bodyContains /kelos cmd" --> OLD_RECURSE[⚠️ Recursive spawn!]
end
Comments Outside Diff (1)
-
self-development/kelos-workers.yaml, line 1 (link)Wrong
/kindlabel forself-development/-only PRCLAUDE.md (and AGENTS.md) states: "PRs that only modify files under
self-development/are internal agent improvements — use/kind cleanupand writeNONEin therelease-noteblock." All five changed files are underself-development/, so this PR should use/kind cleanuprather than/kind bug.Context Used: CLAUDE.md (source)
Prompt To Fix With AI
This is a comment left during a code review. Path: self-development/kelos-workers.yaml Line: 1 Comment: **Wrong `/kind` label for `self-development/`-only PR** CLAUDE.md (and AGENTS.md) states: "PRs that only modify files under `self-development/` are internal agent improvements — use `/kind cleanup` and write `NONE` in the `release-note` block." All five changed files are under `self-development/`, so this PR should use `/kind cleanup` rather than `/kind bug`. **Context Used:** CLAUDE.md ([source](https://app.greptile.com/review/custom-context?memory=c0a0674a-9e65-4e96-88fa-4a29086750fb)) How can I resolve this? If you propose a fix, please make it concise.
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
self-development/kelos-workers.yaml:1
**Wrong `/kind` label for `self-development/`-only PR**
CLAUDE.md (and AGENTS.md) states: "PRs that only modify files under `self-development/` are internal agent improvements — use `/kind cleanup` and write `NONE` in the `release-note` block." All five changed files are under `self-development/`, so this PR should use `/kind cleanup` rather than `/kind bug`.
Reviews (1): Last reviewed commit: "self-development: prevent kelos-bot from..." | Re-trigger Greptile
…y PRs PR #1100 was an agent-generated PR that modified only self-development/ files but used /kind bug. Greptile flagged it P2 against the existing CLAUDE.md/AGENTS.md rule: PRs that only modify files under self-development/ are internal agent improvements — use /kind cleanup and write NONE in the release-note block. The rule lives in the project's AGENTS.md but was not echoed into the agent's own agentsMD (where most other PR conventions are duplicated) nor surfaced in the reviewer's project-conventions checklist. So the worker missed it at PR-creation time, and the kelos-reviewer pass did not catch it before merge. Echo the rule into the shared and worker AgentConfigs, and add an explicit reviewer checklist item with a P2 severity hint so a /review pass on a self-development/-only PR will flag a wrong /kind label. The framing emphasizes "classify by file location, not by problem nature" — the failure mode in PR #1100 was the agent picking the label from the change's semantic intent (recursion-prevention bug fix) rather than from the directory scope.
Distills thirteen recurring conventions from recent PR review feedback and propagates them across AGENTS.md, the shared and worker AgentConfigs, and the reviewer prompts. All changes are backed by specific PR review findings. 1. Never use os.Getenv() for secrets as Go flag defaults — PR #971 P1 (cmd/kelos-webhook-server, cmd/ghproxy leaked GITHUB_TOKEN via --help). 2. Fail fast on invalid configuration — PR #971 multiple P1/P2 (silent degradation when GitHub App credentials or token resolvers failed). 3. Keep API surfaces minimal — PR #902 (maintainer asked repeatedly to defer speculative fields and ship the minimum viable API). 4. API changes must preserve backward compatibility — PR #1058 (BodyContains scalar->array would break in-cluster manifests; resolved by deprecating the old field rather than tightening validation). 5. Docs must match implementation, not aspiration — PRs #1035, #1056, #1082 (docs claimed enforcement that the code never performed). 6. TaskSpawner conventions — PRs #965, #974 (webhook over poll, empty .Branch for issue events, dual issue/PR context, no manual checkout). 7. Don't use Gomega's global Expect() inside Eventually polling blocks — PR #1084 (transient API errors short-circuited the poller). 8. /kind cleanup for self-development/-only PRs — PR #1100 P2 (agent classified by problem nature; rule is to classify by file location). 9. CLI error messages must name the resource — PR #1101 P2 (errors.New ("task failed") loses the name when batched). 10. Test the happy path, not only early-return guards — PR #1096 (both new tests covered only the no-op branches because production code lacked a posting seam; rule now requires adding the seam). 11. Avoid vacuous substring assertions in printer tests — PR #1106 P2 (a "sentry" check passed because the fixture's Name was "sentry-fixer"). 12. Keep CRD enum docstrings consistent with the Enum marker — PR #1081 P2 (commentOn godoc said "empty matches both" but the marker rejected ""). 13. Qualify cross-CRD field references with the owning kind in docs — PR #1077 P2 (Workspace section cited bare podOverrides.env without noting the field lives on Task.spec). Also: kelos-reviewer branch field uses the safe with-index fallback form, kelos-squash-commits gates the issue_comment trigger to PullRequest comments (preventing /kelos squash-commits typed on a plain issue from running git push --force-with-lease against an empty branch fallback), and the README's .Branch description matches runtime behavior.
Distills thirteen recurring conventions from recent PR review feedback and propagates them across AGENTS.md, the shared and worker AgentConfigs, and the reviewer prompts. All changes are backed by specific PR review findings. 1. Never use os.Getenv() for secrets as Go flag defaults — PR #971 P1 (cmd/kelos-webhook-server, cmd/ghproxy leaked GITHUB_TOKEN via --help). 2. Fail fast on invalid configuration — PR #971 multiple P1/P2 (silent degradation when GitHub App credentials or token resolvers failed). 3. Keep API surfaces minimal — PR #902 (maintainer asked repeatedly to defer speculative fields and ship the minimum viable API). 4. API changes must preserve backward compatibility — PR #1058 (BodyContains scalar->array would break in-cluster manifests; resolved by deprecating the old field rather than tightening validation). 5. Docs must match implementation, not aspiration — PRs #1035, #1056, #1082 (docs claimed enforcement that the code never performed). 6. TaskSpawner conventions — PRs #965, #974 (webhook over poll, empty .Branch for issue events, dual issue/PR context, no manual checkout). 7. Don't use Gomega's global Expect() inside Eventually polling blocks — PR #1084 (transient API errors short-circuited the poller). 8. /kind cleanup for self-development/-only PRs — PR #1100 P2 (agent classified by problem nature; rule is to classify by file location). 9. CLI error messages must name the resource — PR #1101 P2 (errors.New ("task failed") loses the name when batched). 10. Test the happy path, not only early-return guards — PR #1096 (both new tests covered only the no-op branches because production code lacked a posting seam; rule now requires adding the seam). 11. Avoid vacuous substring assertions in printer tests — PR #1106 P2 (a "sentry" check passed because the fixture's Name was "sentry-fixer"). 12. Keep CRD enum docstrings consistent with the Enum marker — PR #1081 P2 (commentOn godoc said "empty matches both" but the marker rejected ""). 13. Qualify cross-CRD field references with the owning kind in docs — PR #1077 P2 (Workspace section cited bare podOverrides.env without noting the field lives on Task.spec). Also: kelos-reviewer branch field uses the safe with-index fallback form, kelos-squash-commits gates the issue_comment trigger to PullRequest comments (preventing /kelos squash-commits typed on a plain issue from running git push --force-with-lease against an empty branch fallback), the kelos-squash-commits branch field uses the same with-index fallback form for defensive consistency with the documented convention, and the README's .Branch description matches runtime behavior (PR head branch or pushed branch; empty for issue events). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
Prevents the kelos bot from recursively triggering self-development TaskSpawners.
Several self-development TaskSpawners listed
kelos-bot[bot]as a positiveauthorallowlist entry alongsidegjkim42. Combined withbodyContains: /kelos <command>filters, this allowed agent-authored comments that mention/kelos api-review,/kelos review,/kelos pick-up, or/kelos plan(e.g. recommendations in planner/reviewer outputs) to trigger another spawner — the recursion vector described in the issue.The
GitHubWebhook.ExcludeAuthorsfield already exists in the API and is evaluated before filters, taking precedence over filter-levelAuthormatches. This PR applies it at the top level of the affected spawners and drops the now-redundantauthor: kelos-bot[bot]filter entries:kelos-workerskelos-plannerkelos-pr-responderkelos-reviewerkelos-api-reviewerkelos-triageis intentionally left unchanged — it triages bot-created issues opened bykelos-self-update, which is the desired workflow.kelos-squash-commitsalready restricts togjkim42only.Which issue(s) this PR is related to:
Fixes #1098
Special notes for your reviewer:
This is in tension with #979's finding that
kelos-squash-commitsis the only command handler missingkelos-bot[bot]from its author allowlist. Issue #1098 takes the opposite direction (no bot-on-bot triggers via these command filters), so #979's symmetry argument no longer applies for these filter blocks.make verifyandmake testpass locally.Does this PR introduce a user-facing change?