ci(github-action): update action misospace/pr-reviewer-action (v3.2.0 → v3.3.0)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
misospace/pr-reviewer-action	action	minor	v3.2.0 → v3.3.0

---

Release Notes

misospace/pr-reviewer-action (misospace/pr-reviewer-action)

v3.3.0

Compare Source

Features

• rereview: /ai-review comment command to force a re-review (#​914) (#​952) (9e7519b)

Bug Fixes

• precheck: recognize Addresses and scope past-tense closing keywords (#​953) (#​956) (5a659f7)
• requirement-trace: require strong subject evidence for scope (#​957) (#​958) (bcae3d3)
• test: list the dogfood context-window inputs as overrides (#​951) (f32389b)
• v3: split trace gap from execution gap (#​954) (#​955) (f891b14)

Chores

• ai-review: declare dogfood context windows (#​949) (69788e1)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route · pr-reviewer-action v3.3.0

Recommendation: approve

This is a routine Renovate-generated GitHub Action minor-version bump. The single-line change pins the action to the exact upstream SHA matching the annotated v3.3.0 tag, and the workflow's other surface (triggers, if: guard, permissions, concurrency group, all with: inputs) is unchanged. CI is green across all checks, including the review job itself, on the head commit.

Change-by-change findings

• .github/workflows/ai-pr-review.yaml:43 (single changed line) — bumps the uses: from misospace/pr-reviewer-action@c86f3e94191c9078e92714b10f39deb8d3466268 # v3.2.0 to misospace/pr-reviewer-action@829f395f7154b4d87c229500fd09b30a8ad2224d # v3.3.0. SHA-to-tag correspondence was independently verified against the upstream repo (v3.3.0 → 829f395f7154b4d87c229500fd09b30a8ad2224d, v3.2.0 → c86f3e94191c9078e92714b10f39deb8d3466268). No surrounding context lines changed, so the if: guard (github.event_name == 'pull_request'), the on: triggers (pull_request + workflow_dispatch), permissions, concurrency, runs-on, and the entire with: block (24 inputs including github-token, ai-base-url, three model/fallback/smart blocks, claim-falsification, equivalent-paths, requirement-trace, publish-mode, allow-approve, etc.) are byte-identical.

Claim dispositions

• Claim 1 (pin to upstream commit 829f395f… annotated as v3.3.0) — held: 1/1. GitHub tag ref lookup confirms refs/tags/v3.3.0 points to 829f395f7154b4d87c229500fd09b30a8ad2224d.
• Claim 2 (only version/comment change on the single uses: line) — held: 2/2. Diff is a single modified line; no other workflow line (triggers, permissions, concurrency, if:, with:, runs-on) was touched.
• Claim 3 (identical with: inputs) — held: 6/6. All six explicitly named inputs (github-token, ai-base-url, ai-context-window-size, ai-context-window-tokens, ai-review, custom-prompt-prefix) plus the additional 18 inputs in this workflow's with: block remain byte-identical (only the uses: line changed in the diff hunk).
• Claim 4 (if: guard unchanged, still pull_request only) — held: 1/1. The if: github.event_name == 'pull_request' line is shown as an unchanged context line in the diff and the on: block contains only pull_request and workflow_dispatch (no issue_comment).
• Claim 5 (no issue_comment trigger added; /ai-review capability not wired up) — held: 2/2. The workflow's on: block is unchanged and does not include issue_comment. The new upstream /ai-review comment-command feature (commit 9e7519b… in v3.3.0) is present in the pinned upstream tag but is not enabled by this PR — that is exactly the conservative intent of this bump. If wiring up the comment trigger is desired, it would require an additional, deliberate change to add issue_comment: [created] and the pr-gate step (as the upstream dogfood workflow does).

Sources

• Upstream tag resolution (GitHub Git Refs API): v3.3.0 → 829f395f7154b4d87c229500fd09b30a8ad2224d, v3.2.0 → c86f3e94191c9078e92714b10f39deb8d3466268 (matches the SHAs pinned in the workflow).
• Upstream release notes for v3.3.0 (published 2026-10-05): /ai-review comment command (PR 914/PR 952, commit 9e7519b…), plus four prechore/commit-level fixes (precheck Addresses/past-tense, requirement-trace strong subject, test dogfood overrides, v3 trace-vs-execution gap split) and one chore.
• Upstream compare v3.2.0...v3.3.0: status diverged, ahead_by: 9 — the additional commits are downstream-only changes since the tag was cut from this repo's view; the SHA pinned is the canonical tag commit.
• Renovate provenance: PR body is the standard Renovate minor-update template (type/minor label, renovate/misospace-pr-reviewer-action-3.x branch, --debug footer from Mend Renovate CLI 44.133.0). renovate.json extends local>misospace/renovate-config, consistent with this auto-bump.
• CI: all checks green on head commit 2823424a…, including the review job (twice) which itself uses the pinned action — live evidence the bumped action runs end-to-end on this repo.
• Repo impact scan: no hits for any upstream commit SHAs / issue numbers / comment-command tokens inside this repo (cleanly localized to the workflow line).

Standards Compliance

No repository standards in AGENTS.md govern third-party GitHub Action version pins; the standards file is focused on Godot/product conventions, GDScript testing traps, and the autonomous-loop issue-filing rails. Nothing in AGENTS.md is violated by this bump.

Tool Harness Findings

• read_file .github/workflows/ai-pr-review.yaml — full file read; confirms only one uses: line changed and the rest of the file (including on:, if: guard, permissions, concurrency, runs-on, the entire with: block) is intact.
• read_file AGENTS.md — confirms no relevant workflow-pin standards.
• gh_api calls — both errored with "platform transport not configured"; recovered with direct web_fetch to api.github.com for tag refs.
• web_fetch for v3.3.0 tag ref — confirmed SHA 829f395f7154b4d87c229500fd09b30a8ad2224d.
• web_fetch for v3.2.0 tag ref — confirmed SHA c86f3e94191c9078e92714b10f39deb8d3466268.
• read_file renovate.json — confirms Renovate is the source of the PR (extends local>misospace/renovate-config).
• run_command git_diff_stat — empty stdout; the truncated diff in the corpus is the authoritative scope.

Unknowns or Needs Verification

None. All five claims were directly verifiable from the upstream tag refs and the local file contents; CI provides live evidence the bumped action runs successfully against this repo. The new /ai-review comment-command feature is intentionally not wired up by this PR (no issue_comment trigger added) — that is a scope decision, not a gap.