Skip to content

fix(gitlab): bot authors are flagged as bots - #30383

Merged
juliusmarminge merged 3 commits into
pingdotgg:mainfrom
TonybynMp4:fix/gitlab-bot-authors
Nov 6, 2026
Merged

juliusmarminge merged 3 commits into
pingdotgg:mainfrom
TonybynMp4:fix/gitlab-bot-authors

Conversation

@TonybynMp4

@TonybynMp4 TonybynMp4 commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Problem

GitLab comments from bots are never hidden by the "Bot comments" filter. The adapter reads notes over REST, and REST note authors carry no bot field, so isBot is never set. Closes #30382.

Change

The adapter already sends one GraphQL query per activity read, for reactions (AWARD_EMOJI_GRAPHQL_QUERY), and it walks every note. Its note nodes now also ask for author { username bot }, so this costs no extra request. The decoder collects the bot usernames and the provider sets isBot on matching comment and thread comment authors. That mirrors how the GitHub provider marks bots by login.

The flag only comes from GitLab's own bot field, which covers project and group access tokens, service accounts and GitLab's built-in bots. No username guessing.

Scope and approval

Small fix for an obvious gap: the filter exists on every host, and the GitLab adapter never fed it. Tracked in #30382.

Verification

  • New tests fail on main and pass here: the decoder collects bot authors from the GraphQL page, and the provider flags bot authors in the conversation and in review threads.
  • vp run check:changed: format, lint, knip, typecheck (11 packages) and tests (136) pass.
  • Manual, web dev build against gitlab-org/gitlab!267288, "Bot comments" unchecked:
Before After
image "Comments (5)", all shown image "3 hidden", only the two human comments

Mobile reads the same isBot flag (pullRequestActivityFilter.ts) and needs no change. Not checked on a device.

Fixed by Claude Opus 5.5 in Claude Code, running inside T3 Code.

🤖 Generated with Claude Code

REST note authors carry no bot flag, so GitLab comments from bots were
never hidden by the bot comments filter. The award emoji GraphQL query
that already runs per activity read now also asks for each note's
author { username bot }, and the provider marks those authors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions github-actions Bot added the vouch:unvouched PR author is not yet trusted in the VOUCHED list. label Nov 3, 2026
@macroscopeapp

macroscopeapp Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Approvability

Verdict: Approved at a694427

Macroscope's review found this PR approvable — GitLab comment and discussion authors now receive bot flags from GitLab’s metadata, allowing existing bot filters to work consistently. The change is confined to read-side activity classification and leaves filter defaults unchanged.

You can add or adjust custom eligibility rules. Learn more.

@coderabbitai

coderabbitai Bot commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review.

Walkthrough

GitLab award-emoji data now includes bot author logins. The GitLab pull request provider uses those logins to mark matching conversation and review-thread comment authors as bots.

Changes: GitLab bot comment identification

Layer / File(s) Summary
Collect bot author logins
packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts, packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts
The award-emoji query requests note author usernames and bot flags. The decoder collects bot usernames and returns them with the page data. Tests cover bot author collection.
Mark matching activity authors
packages/source-control-gitlab/src/server/GitLabPullRequestCli.ts, packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts, packages/source-control-gitlab/src/server/GitLabPullRequestProvider.test.ts
The CLI accumulates bot logins across pages. The provider marks matching conversation and thread comment authors with isBot: true. Tests check bot and human authors.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Possibly related PRs

  • pingdotgg/t3code#28841: Uses host bot flags to filter conversation and timeline activity; this change supplies GitLab bot flags.
  • pingdotgg/t3code#20873: Uses host bot flags for bot-noise filtering; this change provides the corresponding GitLab metadata.
  • pingdotgg/t3code#25829: Filters bot-authored review activity based on bot classification, which this change supplies for GitLab comments.

Suggested reviewers: juliusmarminge

Merge Risk: Minimal · up to b41e8

Bot filtering improves, although some replies beyond the note limit may remain visible. This existing limitation does not block merging.

Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title is concise, uses the conventional commit format, and clearly describes the main GitLab change: marking bot authors as bots.
Description check Passed The description includes complete Problem, Change, Scope and approval, and Verification sections. It explains the cause, implementation, testing, manual validation, and the unverified mobile-device ch…
Linked Issues check Passed Issue #30382 requires GitLab bot comments to receive isBot so the bot-comment filter can hide them. The GraphQL note query now requests author { username bot }. The decoder collects usernames wher…
Out of Scope Changes check Passed The changed files support issue #30382. They add bot-author data to the existing GraphQL response, pass bot logins through the activity result, apply isBot to comment authors, and test the behavior.…
Full details: Description check

Explanation

The description includes complete Problem, Change, Scope and approval, and Verification sections. It explains the cause, implementation, testing, manual validation, and the unverified mobile-device check.

Full details: Linked Issues check

Explanation

Issue #30382 requires GitLab bot comments to receive isBot so the bot-comment filter can hide them. The GraphQL note query now requests author { username bot }. The decoder collects usernames where author.bot === true. The provider matches those logins case-insensitively and sets isBot on top-level and review-thread comment authors. Tests cover bot collection, bot flags, and an unflagged human author. The implementation uses the existing activity-read request and adds no extra request.

Full details: Out of Scope Changes check

Explanation

The changed files support issue #30382. They add bot-author data to the existing GraphQL response, pass bot logins through the activity result, apply isBot to comment authors, and test the behavior. No unrelated change appears in the reported diff.

Finishing Touches
Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 663cd08 and b41e806.

Files selected for processing: 5
  • packages/source-control-gitlab/src/server/GitLabPullRequestCli.ts
  • packages/source-control-gitlab/src/server/GitLabPullRequestProvider.test.ts
  • packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts
  • packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts
  • packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional comments: 1
packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts-340-340: 1

340-340: Minor · Functional Correctness · Quick win

Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Match bot logins without case sensitivity.

If GraphQL supplies BuildBot and a REST comment supplies buildbot, Set.has leaves the bot comment unflagged. The “Bot comments” filter then shows that comment. Normalize both logins before matching, and cover the mismatch in the existing activity test. GitLab supports case-insensitive username lookup. (docs.gitlab.com)

Review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between a104909 and a694427.

Files selected for processing: 5
  • packages/source-control-gitlab/src/server/GitLabPullRequestCli.ts
  • packages/source-control-gitlab/src/server/GitLabPullRequestProvider.test.ts
  • packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts
  • packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts
  • packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

@github-actions github-actions Bot added the size:M 30-99 changed lines (additions + deletions). label Nov 3, 2026
@maria-rcks

Copy link
Copy Markdown
Collaborator

Note

Written by gpt-6.1-sol on behalf of Maria

merged current main without rebasing and fixed the review finding: bot-author matching now normalizes both graphql and rest usernames. the existing activity test covers differing casing in conversation and thread comments.

blacksmith verification: the regression failed before the fix, then vp run check:changed passed formatting, lint, knip, typechecks for 11 affected packages, and 136 tests across 6 files. live gitlab api verification remains unverified. the original web failure was a message-timeline click timeout; no unrelated timeline code was changed.

@juliusmarminge juliusmarminge added bugfix Fix PR opened by an issue lead; enters the PR loop pr:gate-failed A land gate failed labels Nov 3, 2026
@juliusmarminge
juliusmarminge merged commit e945fcc into pingdotgg:main Nov 6, 2026
41 checks passed
juliusmarminge added a commit to TonybynMp4/t3code that referenced this pull request Nov 6, 2026
Combines the edited-comment fields with the bot-author fields from pingdotgg#30383.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@TonybynMp4
TonybynMp4 deleted the fix/gitlab-bot-authors branch November 6, 2026 00:30
juliusmarminge added a commit to TonybynMp4/t3code that referenced this pull request Nov 6, 2026
Comment links sit beside the edit dates and bot flags from pingdotgg#30403 and pingdotgg#30383.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
github-actions Bot added a commit to omarcresp/t3code-flake that referenced this pull request Nov 6, 2026
**v0.1.8-nightly.20261106.4247** · 67 changes from 19 contributors

- **Environment dictation.** Choose an environment for dictation in web and desktop, including desktop browser annotations.
- **Fresh sessions.** Use /clear to start a fresh session without leaving your thread.
- **Scheduled task sessions.** Run scheduled tasks in one thread, either continuing the conversation or starting fresh each time.
- **Secret requests.** Answer secret requests using a secret provider instead of copying and pasting credentials.
- **Snooze questions.** Snooze a thread with a pending question and answer it later.
- **Claude Ultracode.** Use Ultracode at any effort level, including with Claude Sonnet 5.5 and Haiku 5.5.
- **Faster pull requests.** Pull requests open faster using data already available in the app.

### Plus 31 more bug fixes and performance improvements.

<details>
<summary>Full changelog</summary>

## What's Changed
* fix(threads): side chats inherit parent permissions by default by @extoci in pingdotgg/t3code#31114
* fix(server): threads follow their worktree's branch changes by @Yash-Singh1 in pingdotgg/t3code#31599
* fix(pi): usage reports include sessions stored in a --session-dir launch argument by @saphid in pingdotgg/t3code#30690
* perf(mobile): skip unchanged terminal toolbar fade updates by @saphid in pingdotgg/t3code#25312
* perf(mobile): assemble HTML replacements in one pass by @saphid in pingdotgg/t3code#25278
* perf(mobile): skip canceled SVG parsing by @saphid in pingdotgg/t3code#25314
* test(server): strengthen v1 cutover proof with event-stream waits and content snapshots by @saphid in pingdotgg/t3code#11869
* fix(contracts): a stored secret reference is always sensitive by @yordis in pingdotgg/t3code#31403
* fix(server): a settings save no longer reads an unreadable secret again by @yordis in pingdotgg/t3code#31226
* fix(threads): allow snoozing pending input requests by @saphid in pingdotgg/t3code#20058
* fix(server): repair cutover test crypto import breaking main CI by @Yash-Singh1 in pingdotgg/t3code#31630
* feat(server): sends can start a fresh provider session by @juliusmarminge in pingdotgg/t3code#30323
* feat: /clear starts a fresh session in the same thread by @juliusmarminge in pingdotgg/t3code#30325
* feat: scheduled tasks can run in one thread with a fresh session each run by @juliusmarminge in pingdotgg/t3code#30326
* fix(web): dragging a sidebar thread no longer scrolls the list out from under the pointer by @juliusmarminge in pingdotgg/t3code#30346
* fix(assets): preserve the PR repository for GitHub media by @juliusmarminge in pingdotgg/t3code#21631
* fix(server): load PR uploads from SSO organizations by @juliusmarminge in pingdotgg/t3code#21632
* fix(mobile): the Duo inspector stops at its widest instead of vanishing by @juliusmarminge in pingdotgg/t3code#31665
* test(server): launcher PATH lookup test no longer drops the Windows drive letter by @tris203 in pingdotgg/t3code#22534
* test(server): replay tests delete their temp directories by @only21mil in pingdotgg/t3code#23445
* fix(mobile): transcribe Android audio during recording by @PixPMusic in pingdotgg/t3code#31300
* test(web): linked-environment subagents keep opening in their own thread by @RealDoc06 in pingdotgg/t3code#26492
* test(server): pin post-commit outbox settle boundary by @Narayan201120 in pingdotgg/t3code#27560
* test: remove unreachable github cli decoding test by @t3-code-bot[bot] in pingdotgg/t3code#28115
* test(server): retain delegated child events when detaching a parent by @benjamin-di in pingdotgg/t3code#29622
* test(lint): pin which ResizeObserver constructions no-raw-resize-observer reports by @only21mil in pingdotgg/t3code#28781
* test(mobile): drop two deleted tests from the React test list by @only21mil in pingdotgg/t3code#28800
* test(web): worked-for expand test waits for the timeline to finish loading by @saphid in pingdotgg/t3code#29661
* test(web): avoid PDF worker startup timeouts in attachment tests by @voltcrash in pingdotgg/t3code#29933
* test(web): source control writing settings test waits for the reset button by @juliusmarminge in pingdotgg/t3code#30372
* test(web): keep the work heading test inside the viewport by @voltcrash in pingdotgg/t3code#30613
* test: use an empty config file instead of the null device for git fixtures on Windows by @Pyseph in pingdotgg/t3code#30772
* test: remove stale tests for unused thread and onboarding helpers by @t3-code-bot[bot] in pingdotgg/t3code#30817
* test(server): correct Windows path and settings assertions by @ElliotDrel in pingdotgg/t3code#30983
* feat(claude): Ultracode works with any effort, like Claude Desktop by @Bil0000 in pingdotgg/t3code#27034
* perf(pr): pull requests paint from data already held, on web, desktop and mobile by @Bil0000 in pingdotgg/t3code#27798
* fix(mobile): approval card buttons line up by @shivamhwp in pingdotgg/t3code#31415
* fix(gitlab): author names link to GitLab profiles by @TonybynMp4 in pingdotgg/t3code#30418
* fix(gitlab): merge messages drop agent credits by @TonybynMp4 in pingdotgg/t3code#30441
* fix(gitlab): file and image comments appear as review threads by @TonybynMp4 in pingdotgg/t3code#30425
* fix(web): screen readers no longer read out a secret typed into the request card by @juliusmarminge in pingdotgg/t3code#31653
* perf(pr): actions update every client from the host's reply instead of re-reads by @Bil0000 in pingdotgg/t3code#25761
* feat(mobile): start side chats with /side by @juliusmarminge in pingdotgg/t3code#31709
* feat(claude): expose Ultracode on Claude Sonnet 5.5 and Haiku 5.5 by @DrSeedon in pingdotgg/t3code#30781
* feat(settings): Simlock, Antigravity and OpenCode credentials can come from a secret provider by @juliusmarminge in pingdotgg/t3code#31652
* refactor(mobile): screens declare what they are; layout and AppBar own every platform bar decision by @juliusmarminge in pingdotgg/t3code#31310
* fix(server): a saved source control token that can't be read no longer falls back to another account by @juliusmarminge in pingdotgg/t3code#31646
* feat(secrets): answer a secret request with a secret provider reference by @juliusmarminge in pingdotgg/t3code#31670
* fix(settings): removing a secret provider clears the fields that used it by @juliusmarminge in pingdotgg/t3code#31651
* docs(user): explain secret providers and secret requests by @juliusmarminge in pingdotgg/t3code#31654
* feat(server): transcribe audio on a chosen environment by @juliusmarminge in pingdotgg/t3code#30625
* feat(web): opt into environment dictation on this device by @juliusmarminge in pingdotgg/t3code#30623
* feat(desktop): dictate into browser annotations with the same consent by @juliusmarminge in pingdotgg/t3code#30624
* feat(mobile): opt in to dictation on a paired environment by @juliusmarminge in pingdotgg/t3code#31059
* fix(web): keep the folder path caret in place while editing by @juliusmarminge in pingdotgg/t3code#31642
* perf(mobile): call the highlights lexer through Nitro, up to 10x faster calls on Android by @camchis in pingdotgg/t3code#31188
* fix(claude): turns use the downloaded model catalog by @juliusmarminge in pingdotgg/t3code#31717
* fix(gitlab): bot authors are flagged as bots by @TonybynMp4 in pingdotgg/t3code#30383
* fix(gitlab): merge requests can edit their labels by @TonybynMp4 in pingdotgg/t3code#30483
* perf(mobile): faster thread sync, connects, and reconnects on bad wifi by @Bil0000 in pingdotgg/t3code#28487
* fix(mobile): iPad composer drops when the keyboard floats or minimizes by @juliusmarminge in pingdotgg/t3code#31251
* perf(mobile): stop iOS syntax highlighting from looking up a thread-local on every lexer call by @camchis in pingdotgg/t3code#31187
* fix(gitlab): edited comments wake PR watchers by @TonybynMp4 in pingdotgg/t3code#30403

## New Contributors
* @benjamin-di made their first contribution in pingdotgg/t3code#29622
* @ElliotDrel made their first contribution in pingdotgg/t3code#30983
* @DrSeedon made their first contribution in pingdotgg/t3code#30781

**Full Changelog**: pingdotgg/t3code@v0.1.8-nightly.20261105.4234...v0.1.8-nightly.20261106.4247

</details>


Upstream release: https://github.com/pingdotgg/t3code/releases/tag/v0.1.8-nightly.20261106.4247
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Fix PR opened by an issue lead; enters the PR loop pr:gate-failed A land gate failed size:M 30-99 changed lines (additions + deletions). vouch:unvouched PR author is not yet trusted in the VOUCHED list.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: GitLab bot comments are never flagged as bots, so the bot comments filter hides nothing

3 participants