fix(bots): address review — author bot-guard, engine-repo-scoped token, reviewer concurrency

Three low-severity review findings (all verified real against the branch):

- engineer-bot.yml: add `github.event.sender.type != 'Bot'` to the author `if:`,
  matching the followup gate — defense-in-depth since a GitHub App with
  `issues: write` could apply the trigger label without a human.
- bot-prelude: derive owner/name from the `engine-repo` input for the
  engine-scoped token mint instead of hardcoding databricks/databricks-bot-engine,
  so the overridable input is honored (a fork/rename gets a correctly-scoped token
  rather than a confusing auth failure).
- reviewer-bot.yml: add a `concurrency:` group (cancel-in-progress) so rapid
  pushes to a PR collapse to one review run, matching the other three workflows.

Co-authored-by: Isaac
Signed-off-by: eric-wang-1990 <e.wang@databricks.com>

Author: eric-wang-1990

.github/actions/bot-prelude/action.yml

@@ -49,6 +49,20 @@ runs:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
 
+    # Split `engine-repo` (owner/name) so the token mint below is scoped to the
+    # SAME repo `install-bot-engine` clones. Deriving it (rather than hardcoding
+    # databricks/databricks-bot-engine) keeps the overridable `engine-repo` input
+    # honest: a fork/renamed engine gets a correctly-scoped token instead of an
+    # auth failure against the wrong repo.
+    - name: Derive engine repo owner/name
+      id: engine-scope
+      shell: bash
+      env:
+        ENGINE_REPO: ${{ inputs.engine-repo }}
+      run: |
+        echo "owner=${ENGINE_REPO%%/*}" >> "$GITHUB_OUTPUT"
+        echo "repo=${ENGINE_REPO##*/}" >> "$GITHUB_OUTPUT"
+
     # Engine-scoped token: a SECOND, per-run token scoped to ONLY the engine repo
     # (contents:read), used to `pip install` the private engine with no stored
     # PAT. Requires the same App installed on the engine repo with contents:read.
@@ -58,8 +72,8 @@ runs:
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
-        owner: databricks
-        repositories: databricks-bot-engine
+        owner: ${{ steps.engine-scope.outputs.owner }}
+        repositories: ${{ steps.engine-scope.outputs.repo }}
         permission-contents: read
 
     - name: Setup Node (for the Claude Code CLI the SDK spawns)

.github/workflows/engineer-bot.yml

@@ -37,9 +37,13 @@ jobs:
   author:
     # Manual dispatch, OR the `engineer-bot` label was just applied. Applying a
     # label requires triage+ on the repo, so this is the maintainer-only gate.
+    # The `sender.type != 'Bot'` guard is defense-in-depth (matching the followup
+    # gate): a GitHub App with `issues: write` could apply the label without a
+    # human, so the triage+ argument doesn't fully cover automation.
     if: >-
       github.event_name == 'workflow_dispatch'
-      || github.event.label.name == 'engineer-bot'
+      || (github.event.label.name == 'engineer-bot'
+          && github.event.sender.type != 'Bot')
     environment: azure-prod   # DATABRICKS_HOST / DATABRICKS_TOKEN live here
     runs-on:
       group: databricks-protected-runner-group

.github/workflows/reviewer-bot.yml

@@ -44,6 +44,14 @@ jobs:
       github.event_name == 'workflow_dispatch'
       || (github.event.pull_request.draft == false
           && github.event.pull_request.head.repo.fork == false)
+    # Collapse redundant reviews: this triggers on every `synchronize` (push to a
+    # PR), so rapid pushes would otherwise spawn overlapping runs against the same
+    # PR. cancel-in-progress: true — a review of a superseded head is wasted work
+    # (unlike the followups, which use cancel-in-progress: false to avoid dropping
+    # a reconcile mid-thread). Matches the sibling workflows' concurrency pattern.
+    concurrency:
+      group: reviewer-bot-pr-${{ github.event.pull_request.number || inputs.pr_number }}
+      cancel-in-progress: true
     environment: azure-prod   # DATABRICKS_HOST / DATABRICKS_TOKEN live here
     runs-on:
       group: databricks-protected-runner-group