fix(ci): skip maintainer, bot, and closed PRs in the ready-for-review gate

[dhruv0811]

Related issue

Part of OMNI-2214 / OMNI-2315. Fixes the gate enabled in #4188; this PR declares
Test / CI below, which is one of the exempt types.

Summary

Three exclusions the gate was missing.

Maintainer and bot PRs

The gate had no author check at all, so it labelled the team's own work. Two of the
four PRs labelled on the first enforcing run were MEMBER-authored (#4187, #4113).

That halves the signal the label exists to create. waiting-for-review is meant to
route incoming contributions into a review queue; maintainers land their own changes
and do not need routing. Half the in-window PRs are maintainer PRs (12 of 24
non-draft), so leaving them in makes the queue no more useful than the open-PR list.
The nudge already exempts maintainers for exactly this reason, and the two checks
should agree.

Detection uses both signals, matching the nudge: authorAssociation catches most
cases, and .github/MAINTAINER catches a maintainer whose org membership is private
and therefore reads as CONTRIBUTOR. The file is read from the API rather than the
checked-out tree, so a PR cannot self-grant by editing it. Bots are skipped too.

Closed and merged PRs

is:open in the search query is index-backed and lags, so a PR closed or merged in
the last few minutes still comes back from the search and would be labelled. The gate
now checks the state it was handed before writing. Drafts were already skipped.

Test Plan

• node .github/workflows/ready-for-review.test.js passes, with new cases for each
  exclusion: MEMBER / OWNER / COLLABORATOR / bot authors are skipped; a
  maintainer found only via .github/MAINTAINER is skipped; a genuine outside
  contributor is still labelled; and CLOSED / MERGED PRs are skipped.

• Verified against production with the label write rigged to throw:

  skip: maintainer 13
  skip: already labelled 2
  below bar: no issue referenced 10
  skip: draft 2
  

  The two already-labelled are the community PRs (fix(pi-native): carry catalog token limits into the pi-native model list #4178, Persist custom agent reasoning effort for bundled sessions #4128), which correctly keep
  the label. No write attempted.

Note on the two maintainer PRs already labelled

#4187 and #4113 were labelled before this fix. The gate will not remove a label it
already applied, so those two keep it until someone takes it off by hand. That is
deliberate: the sweep never removes waiting-for-review, and teaching it to would
risk fighting a maintainer who applied it on purpose.

Demo

N/A. CI label mechanics, no user-visible UI.

Type of change

• Bug fix
• Feature
• UI / frontend change
• Refactor / chore
• Docs
• Test / CI
• Breaking change

Test coverage

• Unit tests added or updated
• Integration / E2E tests added or updated
• Manual verification completed
• Not applicable

Coverage notes

Unit tests cover every new exclusion. Manual verification was running the fixed gate
against live GitHub with the label write rigged to throw.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

🏷️ Doc impact: no-doc-update

Changes only to a CI GitHub Actions script (ready-for-review.js) and its tests for internal PR-labelling logic, which is not a user-facing surface or integration.

_{Auto-classified on merge. Set the label manually before merging to override. · run}

[omnigent-ci]

Polly AI Review

Blocking issues

None. The change is correct and well-scoped.

Security vulnerabilities

None. The .github/MAINTAINER file is read from the API at the repository's default branch ref (getContent with ref: default_branch ?? "main") rather than from a checked-out tree, so a PR cannot self-grant maintainer status by editing the file in its own head — this matches the established pattern in pr-issue-link.js and is the right call. The demo-check job that invokes this script already grants contents: read, so getContent has the permission it needs.

Non-blocking notes

• Detection logic mirrors the nudge correctly. isOwnWork uses the same MAINTAINER_ASSOCIATIONS set, the same dual-signal approach (authorAssociation OR .github/MAINTAINER), and the same bot check (__typename === "Bot" or login.endsWith("[bot]")) as pr-issue-link.js's exemptReason/isBot. Good consistency; the two checks will agree as the PR intends. Worth a small future consideration: this is now the second copy of maintainer-loading + own-work detection across the two gate scripts — a shared helper would prevent the two from drifting later, but duplicating for now is a reasonable tradeoff.
• Ordering shifts some verdict reasons. isOwnWork is now evaluated before already labelled / removedByHuman, so an already-labelled maintainer PR reports skip: maintainer rather than skip: already labelled. This is harmless (still skipped, never unlabelled) and matches the production verification output in the description, but noting it since the reason strings feed the summary table.
• .github/MAINTAINER failure degrades gracefully. A missing/unreadable file is caught and logged via core.warning, leaving maintainers empty and falling back to the authorAssociation signal only. Reasonable — a maintainer with private org membership who is also unreadable from the file would then be labelled, but that's an acceptable, non-silent edge.
• Scheduled-event payload fallback is sound. context.payload.repository?.default_branch ?? "main" covers the case where the schedule event payload lacks a populated repository, and reuses the exact fallback already proven in pr-issue-link.js.

No visual demonstration is required — this is CI label mechanics with no user-visible surface.

Summary

A tight, correct bug fix that closes three real gaps in the ready-for-review gate: maintainer PRs, bot PRs, and closed/merged PRs slipping past the labeller. The maintainer/bot detection faithfully reuses the nudge's dual-signal approach and its self-grant-proof API read, and the state !== "OPEN" guard correctly compensates for the index lag in is:open. Test coverage is thorough — each exclusion has a dedicated case, plus a positive case confirming genuine contributors are still labelled — and the suite passes locally. No blocking or security concerns; ready to merge.

---

_{Automated review by Polly · workflow run}