ci(github-action): update action misospace/pr-reviewer-action (v3.0.1 → v3.1.0)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
misospace/pr-reviewer-action	action	minor	v3.0.1 → v3.1.0

---

Release Notes

misospace/pr-reviewer-action (misospace/pr-reviewer-action)

v3.1.0

Compare Source

Features

• tools: raise the native-loop budget and report a real cache hit ratio (#​911) (bf937d0)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route

Recommendation

Approve. This is a Renovate-generated SHA bump of the same upstream action (misospace/pr-reviewer-action) from v3.0.1 (22c7da6c…) to v3.1.0 (aa12ad99…). The release is a minor version containing exactly one feature (tools: raise the native-loop budget and report a real cache hit ratio, PR PR 911). No input is renamed or removed, no flag the workflow sets is affected, and the post-merge Renovate checks plus the in-PR review jobs are all green on af91f4d.

Change-by-change findings

• .github/workflows/ai-pr-review.yaml — single-line change at line 43 (new file): uses: misospace/pr-reviewer-action@22c7da6cbc914d2bc235ca2e928d32b6408fcfff # v3.0.1 → uses: misospace/pr-reviewer-action@aa12ad9909b1ee8a5a7fe00dceeb1a8c97ab27dd # v3.1.0. Same action, pinned by SHA with the version comment kept in sync — consistent with the existing pattern across every other uses: in the file (actions/checkout@… # v7.0.1, actions/create-github-app-token@… # v3.2.0). No inputs were touched, so the action surface the workflow depends on is preserved.

SHA-to-tag verification (upstream)

• v3.1.0 (published 2026-10-01) compares 3 commits ahead / 1 behind v3.0.1. The first commit is bf937d0 ("feat(tools): raise the native-loop budget and report a real cache hit ratio"), the second is the release-please release commit (d1f8c7a), and the third is the dist build (aa12ad9). The SHA pinned by this workflow (aa12ad99…) matches the dist-for-v3.1.0 commit from the upstream compare metadata, so the bump resolves to the documented v3.1.0 tag.
• v3.1.0's only functional change is internal to the tool harness: the tier-aware default for tool-max-requests on the primary route moves from ~16 to ~24, and the round-cap scaling switches from "~1 round per 2 tool calls, capped at 25" to "one round per tool call, capped at 32". The windowstead workflow does not set tool-max-requests or tool-max-rounds, so it inherits whatever defaults the action picks for the auto routing mode — this bump widens those budgets, with no input-name changes that could break the workflow.

Sources

• .github/workflows/ai-pr-review.yaml (workflow file, head of branch renovate/misospace-pr-reviewer-action-3.x).
• .github/ai-review-rules.md (least-privilege note confirms the action is the canonical AI reviewer and uses an app token).
• Upstream compare misospace/pr-reviewer-action@v3.0.1...v3.1.0 (3 commits, only one feature + release-please + dist).
• Upstream release metadata for v3.1.0 (published 2026-10-01T02:46:28Z).

Standards Compliance

AGENTS.md does not document a specific convention for Renovate bumps of GitHub Actions. The general "Push directly to main unless told otherwise" preference is consistent with the Automerge-enabled Renovate behavior noted in the PR body. The bump is a digest-only shape change (one pinned SHA + a one-line version comment in a workflow) that matches the existing pattern in the same file, so there is no conflict with the documented workflow conventions. .github/ai-review-rules.md explicitly calls for a compact review on Renovate digest-only updates; this review stays compact and flags nothing blocking.

Tool Harness Findings

The harness executed 8 tool calls across 5 rounds (8 issued; stop reason: model-stopped):

• read_file succeeded for .github/workflows/ai-pr-review.yaml, AGENTS.md, and .github/ai-review-rules.md (corpus confirmation).
• gh_api calls to repos/misospace/pr-reviewer-action/git/refs/tags/v3.1.0 and …/v3.0.1 errored with "platform transport not configured" — the harness falls back to the structured release/compare metadata already provided in the corpus.
• web_fetch to the GitHub release page and the compare page returned the GitHub JS shell with no readable body, but the structured compare metadata for v3.0.1…v3.1.0 and the release metadata for v3.1.0 are present in the corpus and were used to verify the SHA→tag mapping and the change set.
• web_fetch to raw.githubusercontent.com/.../action.yml errored with "Host not allowlisted" — the action.yml inputs are already covered by the upstream README patch in the corpus, which lists the input defaults and shows no breaking changes.
  No tool failure leaves a question that would change the verdict.

Unknowns or Needs Verification

None remaining. The only verification that was unreachable through this harness — the literal action.yml of the v3.1.0 dist — is unnecessary because the upstream README patch documents the relevant input defaults (tool-max-requests, tool-max-rounds, tool-loop-summarize, etc.) and shows none are renamed, removed, or have new required values, and the windowstead workflow sets none of those knobs anyway.