Community automations updates: bot and community review

[MisRob]

Disclosure: I was assisted by Claude. Revisited, adjusted & tested whole diff.

Summary

Few smaller updates to community-related automations in response to rtibblesbot and community reviews.

Fixes

• Adds rtibbles bot to the list of bots so that it's not considered a contributor
  • Fixes LE bot replying to rtibblesbot PRs
  • Fixes rtibblesbot PRs being added to community PRs spreadsheet

New

• Workflow that sends an info message on a community PR when rtibblesbot review requested
• Workflow that sends an info message on a community PR when community-label added

Reviewer guidance

• Code review should be sufficient. I tested the changes in my local environment. After code review, will give it one last try in our environment via test-actions repo.
• You could also have a look at phrasing of the 2 new info messages.

[MisRob]

• @ozer550 would you please review as a whole
• @rtibbles your eyes on security would be appreciated as always
• cc @akolson I also welcome your feedback, or just check it out quickly to see the latest updates

[rtibbles]

Generally looks good - still wish we could drive things via team membership, but as rtibblesbot is a bit of an edge case, it makes sense.

Claude (and other LLMs) always use old versions of Github Actions because that's the version in their training data :) Should update.

[MisRob]

Claude (and other LLMs) always use old versions of Github Actions because that's the version in their training data :) Should update.

@rtibbles I actually copy-pasted those versions myself when I was verifying, because they're used in other actions right now, but perhaps it's not best approach? Should we upgrade all of them at once, or should I just address those that I added?

[rtibblesbot]

Clean set of additions — bot exclusion fix, two new info-message workflows, and community review docs. Well-structured with proper contributor gating on both new workflows.

CI passing. Screenshot confirms both messages render correctly.

• suggestion:pull-request-label.js — consider duplicate comment prevention for the label scenario (label can be removed and re-added)
• nitpick:docs/community-review.md — mixed bullet style on last line

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Reviewed the pull request diff checking for:

• Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
• Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
• Architecture: duplicated concerns, minimal interfaces, composition over inheritance
• Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
• Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
• Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
• Checked CI status and linked issue acceptance criteria
• For UI changes: inspected screenshots for layout, visual completeness, and consistency

[rtibbles]

@rtibbles I actually copy-pasted those versions myself when I was verifying, because they're used in other actions right now, but perhaps it's not best approach? Should we upgrade all of them at once, or should I just address those that I added?

Oh, in that case, we should add a dependabot.yml to autoupdate our actions version!

Can copy this one from ricecooker: https://github.com/learningequality/ricecooker/blob/main/.github/dependabot.yml I think it has the same dependency ecosystems, right? Python and Github actions

[MisRob]

@rtibbles yes, thank you. I added dependabot.yml just to notice later it was there, but in a wrong directory. Hopefully it's fine now. Also ran pre-commit which formatted some previously forgotten files.

All looks well now? If so, I would go ahead and prepare handlers in the 5 related repos before we merge this.

[rtibblesbot]

Clean follow-up — bot list refactoring, new info-message workflows, community review docs, and dependabot fix all look good.

CI passing.

2 prior finding(s) resolved.

• suggestion:npm ecosystem dropped from dependabot config (see inline comment)
• praise:BOT_USERNAMES refactoring centralizes the bot list nicely

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Compared the current PR state against findings from a prior review:

• Retrieved prior bot reviews deterministically via the GitHub API
• Classified each prior finding as RESOLVED, UNADDRESSED, ACKNOWLEDGED, or CONTESTED
• Only raised NEW findings for newly introduced code
• Reviewed the pull request diff checking for correctness, design, architecture, testing, completeness, and adherence to DRY/SRP principles
• Checked CI status and linked issue acceptance criteria

[rtibblesbot]

Clean PR — bot exclusion, info-message workflows, community review docs, dependabot fix, and formatting cleanup all look good.

CI passing.

3 prior finding(s) resolved.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Compared the current PR state against findings from a prior review:

• Retrieved prior bot reviews deterministically via the GitHub API
• Classified each prior finding as RESOLVED, UNADDRESSED, ACKNOWLEDGED, or CONTESTED
• Only raised NEW findings for newly introduced code
• Reviewed the pull request diff checking for correctness, design, architecture, testing, completeness, and adherence to DRY/SRP principles
• Checked CI status and linked issue acceptance criteria