ci(github-action): update action misospace/pr-reviewer-action (v3.2.0 → v3.3.0)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
misospace/pr-reviewer-action	action	minor	v3.2.0 → v3.3.0

---

Release Notes

misospace/pr-reviewer-action (misospace/pr-reviewer-action)

v3.3.0

Compare Source

Features

• rereview: /ai-review comment command to force a re-review (#​914) (#​952) (9e7519b)

Bug Fixes

• precheck: recognize Addresses and scope past-tense closing keywords (#​953) (#​956) (5a659f7)
• requirement-trace: require strong subject evidence for scope (#​957) (#​958) (bcae3d3)
• test: list the dogfood context-window inputs as overrides (#​951) (f32389b)
• v3: split trace gap from execution gap (#​954) (#​955) (f891b14)

Chores

• ai-review: declare dogfood context windows (#​949) (69788e1)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route · pr-reviewer-action v3.3.0

Recommendation

Approve. This is a Renovate-generated minor version bump of the misospace/pr-reviewer-action GitHub Action in the ai-pr-review workflow from v3.2.0 → v3.3.0. The change is a one-line pin update with a full SHA, mirrors prior Renovate practice in this repo (e.g., commit 9231513 for the v2.3.1 → v2.3.2 bump), and CI is fully green across lint, typecheck, build, tests, smoke, and the workflow's own review and review (re-review) runs.

Change-by-change findings

• .github/workflows/ai-pr-review.yaml (line 43): Updates uses: misospace/pr-reviewer-action@c86f3e94191c9078e92714b10f39deb8d3466268 # v3.2.0 to uses: misospace/pr-reviewer-action@829f395f7154b4d87c229500fd09b30a8ad2224d # v3.3.0. Pinned to a full 40-char commit SHA with a human comment, which is the repo's convention (the actions/checkout@3d3c42e5…# v7.0.1 and actions/create-github-app-token@bcd2ba4921…# v3.2.0 steps in the same file follow the same pattern).
• All other inputs (with: block): Unchanged. The github-token, ai-base-url, ai-api-format, ai-model, primary-model-context-tokens, ai-api-key, ai-response-format, ai-fallback-*, review-routing-mode, escalate-on-risk-flags, ai-smart-*, ci-timeout-sec, tool-allowed-gh-api-repos, claim-falsification, equivalent-paths, requirement-trace, publish-mode, and allow-approve keys are byte-identical to the pre-change file.
• Surrounding workflow structure: on: triggers, concurrency: group, top-level permissions:, the review job's if:/runner/steps ordering, and the Review PR step's if: (github.event_name == 'pull_request') and id: review are unchanged.

Claims-to-falsify disposition

• Claim 1 (1/1): Held. Line 43 of .github/workflows/ai-pr-review.yaml pins misospace/pr-reviewer-action@829f395f7154b4d87c229500fd09b30a8ad2224d # v3.3.0, and a repository-wide grep confirms no other workflow or file references the previous SHA c86f3e94191c9078e92714b10f39deb8d3466268 or pr-reviewer-action@v3.2.0. The other v3.2.0 comments in the tree are on actions/create-github-app-token, a different action.
• Claim 2 (1/1): Held. PR metadata (changedFiles: 1) and the diff show only .github/workflows/ai-pr-review.yaml is modified.
• Claim 3 (2/2): Held. Comparing the diff against the on-disk file confirms every with: key/value other than the uses: line is unchanged.
• Claim 4 (1/1): Held. The if: (github.event_name == 'pull_request') on the Review PR step is intact, no other step under jobs.review was touched, and the top-level permissions: and concurrency: block are untouched.
• Claim 5 (2/2): Held. The PR body declares Automerge: Enabled and Rebasing: Whenever PR is behind base branch, which is the standard Renovate-managed dependency-PR pattern this repo uses elsewhere (e.g., PRs PR 949, PR 1097).

Linked Sources / Upstream verification

GitHub compare v3.2.0...v3.3.0 for misospace/pr-reviewer-action confirms the old SHA c86f3e9 corresponds to the v3.2.0 build commit and the new SHA 829f395 is the v3.3.0 head. The published v3.3.0 release notes match the PR body verbatim and consist of:

• Feature: rereview — /ai-review comment command to force a re-review (PR 914/PR 952, commit 9e7519b).
• Bug fixes: precheck recognises Addresses and scopes past-tense closing keywords (PR 953/PR 956, 5a659f7); requirement-trace requires strong subject evidence for scope (PR 957/PR 958, bcae3d3); v3 splits trace gap from execution gap (PR 954/PR 955, f891b14); dogfood context-window inputs are listed as overrides (PR 951, f32389b).
• Chore: ai-review declares dogfood context windows (PR 949, 69788e1).

None of these surface a behavior change that would break the existing call site. Inputs the workflow currently sets (github-token, ai-base-url, ai-api-format, ai-model, primary-model-context-tokens, ai-api-key, ai-response-format, ai-fallback-*, ai-smart-*, review-routing-mode, escalate-on-risk-flags, ci-timeout-sec, tool-allowed-gh-api-repos, claim-falsification, equivalent-paths, requirement-trace, publish-mode, allow-approve) are still consumed in v3.3.0. The new optional inputs introduced by v3.3.0 (e.g., rereview-command for the /ai-review comment command) are not currently set; leaving them unset is fine — the v3.3.0 release notes and source indicate the feature is opt-in via the new input, with the default (/ai-review) only firing on PR issue_comment events that this workflow does not currently subscribe to (on.pull_request.types: [opened, reopened, synchronize, ready_for_review, labeled] + workflow_dispatch). No issue_comment trigger has been added, so the new feature is dormant in this repo until a follow-up wires it up.

Standards Compliance

• AGENTS.md §"GitHub Actions CI" (Lint/typecheck blocks CI; must pass): Held. CI shows Lint, Typecheck, and Build all success. Workflow lint is also success, which validates the edited YAML syntactically.
• AGENTS.md §"No commit of secrets": Held. The diff edits a uses: reference only; no token, key, or env var was added/changed.
• Repository convention for action pinning (full SHA + # vX.Y.Z comment): Held. Matches the pattern already used for actions/checkout@3d3c42e5…# v7.0.1 and actions/create-github-app-token@bcd2ba4921…# v3.2.0 in the same workflow.

Tool Harness Findings

The harness ran 10 tool calls: read the modified workflow in-place, searched the repo for the old SHA / any pr-reviewer-action reference (only match is the modified line), searched .github/ for v3.2.0|v3.3.0 (only the modified line and unrelated actions/create-github-app-token# v3.2.0 references), and fetched the upstream GitHub compare and release endpoints after the gh_api transport was unavailable. The fetched compare and release data match the PR's claims.

Unknowns or Needs Verification

None. All five claims-to-falsify items, both standard-file requirements, and both evidence-provider checks are positively verified from the corpus and on-disk file content.

Smart review

smart_review_requested: false. This is a one-line Renovate SHA bump with full verification (release notes match, CI green, repo-wide grep clean) — there is no high-risk area requiring a stronger pass.