fix(pr-review): force-fetch + verify worktree HEAD matches PR head

[jacsamell]

Symptom

Roy reported judges posting 10 "new" findings on aetheronhq/aetheron-connect-v2#1266 that were all against pre-rewrite line numbers and content — referencing files/tables/triggers that no longer existed in the PR.

Root cause

PR was force-pushed (rebase / squash) several times. The review worktree at `~/.cube/worktrees//pr-review-/` was synced via `git fetch origin ` without `--force`. On force-push, the local ref refused to fast-forward and silently stayed stale. `git reset --hard origin/` then reset to the old ref. Judges Read pre-rewrite files. We logged a warning and proceeded.

Confirmed live: worktree HEAD was at `fda636a3` (May 19 12:29) while the actual PR head was `62e9fbd1` — 6 commits behind including the rewrites that obsoleted the cube findings.

Fix

1. `git fetch --force` — handles force-pushes. Failure is now fatal.
2. `git clean -fdx` after reset — leftover untracked files from a prior round could mask file moves.
3. Verify worktree HEAD == `pr.head_sha` after sync. Abort loud on mismatch with an actionable hint.
4. Log the synced SHA in the banner so this regression is visible in run output.

Test plan

• Force-push a PR, re-run `cube pr-review ` — worktree updates to the new head
• Manually pin worktree to an old commit, run cube — fails loud with SHA mismatch
• Normal (non-force-pushed) re-runs still work

🤖 Generated with Claude Code

Summary

This PR fixes a critical issue where judges posted incorrect findings after PR force-pushes due to stale review worktrees. The root cause was that git fetch without --force failed to update local refs during force-pushes, causing subsequent resets to stale commits.

Changes

peer_review.py – Strengthened worktree synchronisation to be deterministic and fail-fast:

• Use git fetch --force (failures now fatal)
• Execute git clean -fdx after reset to remove stale untracked files
• Verify synced worktree HEAD matches expected PR head SHA; abort loudly if mismatched with actionable guidance
• Log the synced SHA in output for visibility

auto_approve.py – Improved cube identity resolution:

• When a GitHub App is configured, resolve bot identity via the App rather than falling back to the operator
• Fail closed if the App is configured but login cannot be fetched
• Added caching of derived bot login

app_auth.py – Added GitHub App bot login discovery:

• New get_app_login() function that fetches and caches the App's bot login via /app endpoint
• Returns None gracefully if not configured or if the API response lacks required fields

Outcome

Eliminates the risk of running judges against stale PR content after force-pushes, ensuring findings map to correct line numbers and content. Force-push detection is now explicit and actionable rather than silent and error-prone.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: be2b4bc2-8807-4375-9452-669522191b99

📥 Commits

Reviewing files that changed from the base of the PR and between 9dfe6e3 and 40eea58.

📒 Files selected for processing (3)

• python/cube/commands/auto_approve.py
• python/cube/commands/peer_review.py
• python/cube/github/app_auth.py

---

Walkthrough

This PR enhances two independent workflows: it introduces GitHub App bot identity caching for auto-approve gating logic, and strengthens the peer-review worktree synchronisation with deterministic cleanup and commit SHA validation.

Changes

GitHub App Bot Identity Resolution

Layer / File(s)	Summary
GitHub App bot login discovery and caching python/cube/github/app_auth.py	New get_app_login() function discovers the configured GitHub App's slug, derives the bot login as <slug>[bot], caches the result, and returns None on configuration or API failures.
Auto-approve cube identity via GitHub App configuration python/cube/commands/auto_approve.py	_gh_json now accepts optional env parameter for subprocess execution, and _cube_login uses get_app_login() to determine cube identity from configured App credentials with fail-closed semantics.

Deterministic PR Review Worktree Sync

Layer / File(s)	Summary
Worktree sync parameter and safety checks python/cube/commands/peer_review.py	_ensure_pr_review_worktree adds expected_head_sha parameter, uses forced fetch with failure handling, hard-resets and cleans existing worktrees, and validates synced HEAD SHA against the expected value, aborting on mismatch.
PR review workflow integration and error handling python/cube/commands/peer_review.py	_run_pr_review logs the target PR head SHA, calls the updated worktree helper with expected SHA, converts errors to user-facing output with exit(1), and displays the head SHA in worktree reporting.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• aetheronhq/agent-cube#153: Both PRs refine the auto-approve gating flow in auto_approve.py—this PR updates cube identity resolution using the GitHub App credentials, whilst the retrieved PR adds the --allow-approve gate that posts APPROVE based on those identity conditions.

Poem

🐰 Whiskers twitch with delight,
App logins cached, worktrees synced tight,
No stale commits shall pass the gate,
Identity true, approval's fate.
Fresh as morning dew, ready to rate! ✨

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}