fix(reopen): honor collaborator closes and paginate issue-events for last-closer

[JSONbored]

Motivation

• Prevent contributor reopens from bypassing the one-shot close policy when a real repo maintainer (admin/maintain/write) closed the PR.\
• Avoid missing the true last closer when the issue-events timeline is paginated and the most recent closed event appears beyond the first page.\

Description

• Walk GET /repos/{owner}/{repo}/issues/{issue_number}/events pages (per_page=100) in getLastCloserLogin so the latest closed event is discovered across all pages (src/github/pr-actions.ts).\
• Replace the brittle owner/admin-only maintainer check with a live collaborator-permission lookup via getRepositoryCollaboratorPermission, treating admin, maintain, and write as maintainer authority when deciding to allow a reopen (src/queue/processors.ts).\
• Add regression tests covering paginated issue-events and the reopen-reclose flow when a write collaborator closed the PR (test/unit/github-pr-actions.test.ts, test/unit/queue.test.ts).\

Testing

• Ran targeted unit tests with npx vitest run test/unit/github-pr-actions.test.ts test/unit/queue.test.ts -t "one-shot reopen prevention|paginated issue events", and the new/regression tests passed.\
• Verified npm run typecheck and git diff --check succeeded.\
• Attempted npm run test:ci (full local gate); execution reached unrelated existing timeouts and coverage post-processing failed with TypeError: jsTokens is not a function, so full CI was not completed here.\
• Attempted npm audit --audit-level=moderate; the npm audit endpoint returned 403 Forbidden so the audit could not be completed in this environment.

---

Codex Task

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.80%. Comparing base (46d09b3) to head (26fa374).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1185      +/-   ##
==========================================
+ Coverage   94.69%   94.80%   +0.10%     
==========================================
  Files         157      157              
  Lines       19077    19083       +6     
  Branches     6906     6909       +3     
==========================================
+ Hits        18065    18091      +26     
+ Misses        424      399      -25     
- Partials      588      593       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[superagent-security]

Superagent found 1 security concern(s).

[superagent-security]

P2: Unbounded pagination loop in issue-events fetch lacks page limit

Unbounded loop fetches every issue-events page with no maximum limit.

Add a maximum page limit (e.g., 10 pages) to prevent rate limit exhaustion.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="src/github/pr-actions.ts">
<violation number="1" location="src/github/pr-actions.ts:123">
<priority>P2</priority>
<title>Unbounded pagination loop in issue-events fetch lacks page limit</title>
<evidence>The new code introduces a `for (let page = 1; ; page += 1)` loop with no maximum page limit to walk all issue events pages. For PRs with thousands of events, this will make an excessive number of authenticated GitHub API requests, risking rate limit exhaustion and queue processor stalls.</evidence>
<recommendation>Cap pagination at a reasonable maximum (e.g., `page &lt;= 10`) and return `lastCloser` early if the limit is reached. Document the cap in a code comment.</recommendation>
</violation>
</file>