[katcosgrove]

Description

Adds an optional blunderbuss.delay duration so maintainers have time to request specific reviewers before automatic reviewer selection. The opened and ready_for_review handlers defer automatic requests to the scheduled sweep, which requests reviewers once the delay has elapsed only if no reviewer/team has been requested and no review exists. /auto-cc remains immediate.

Includes configuration documentation and tests. The sweep extends its listing window to find untouched PRs whose delay has elapsed; older PRs receive only the delayed-reviewer step.

The first authorized e2e run exposed missing bundle coverage for the new delay paths. Added __tests__/bundle/blunderbussDelay.test.ts to exercise delayed event handling, due-window requests, manual-review/draft exclusions, ready-for-review timing, configuration validation, and refusal behavior through the bundle. Coverage floors remain unchanged.

Dependency cleanup: #546 is the canonical Vite/PostCSS/Nano ID update and has merged. This branch incorporates that update; package-lock.json now matches main exactly. Unrelated dependency upgrades and their bundled output were removed, and dist/index.js was rebuilt from a clean install.

Related: #516 adds independent assertions for the existing sweep window and ignore_authors behavior. No issue is auto-closed by this feature PR.

Testing

• npx vitest run __tests__/cronJobTest/sweep.test.ts __tests__/plugins/blunderbuss.test.ts __tests__/configurationDocs.test.ts __tests__/docsYamlExamples.test.ts __tests__/utils/config.test.ts — passed: 5 files, 281 passed / 75 skipped.
• npm ci --quiet && npm run build && npm run pack — passed; bundle regenerated using the focused dependency lockfile.
• npm run lint — passed with zero errors; the existing src/issueComment/cc.ts:81 JSDoc warning remains.
• git diff --exit-code upstream/main -- package-lock.json — passed after incorporating chore(deps-dev): bump vite from 8.3.1 to 8.3.4 #546.
• npm test -- __tests__/bundle/blunderbussDelay.test.ts — passed: 17 new delay scenarios.
• npm run build && npm run pack && git diff --exit-code -- dist/ && npm run lint && npm run test:coverage && npm run test:coverage:e2e — passed on the feature combined with the reviewed main changes. Unit suite: 167 files, 2330 passed / 75 skipped; 99.91% lines and 99.35% branches. Bundle suite: 86 files, 528 passed; 100% lines/statements/functions and 99.46% branches.

The full CI jobs must pass on the updated head before merging; earlier fork workflow runs were awaiting maintainer approval.

Checklist

• I ran npm run all to lint and build my code — the explicit build/lint/pack and focused test commands above were used instead, avoiding unrelated lint autofixes.
• I ran npm run pack and committed dist/
• Commits are signed off (DCO)
• Note any new dependencies these changes bring in — none; dependency changes belong to chore(deps-dev): bump vite from 8.3.1 to 8.3.4 #546.
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generates no new warnings (please describe new warnings if unavoidable) — only the pre-existing JSDoc warning noted above.

[katcosgrove]

/kind feature

[hivecommons-hive]

ee783ce

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @katcosgrove, head ee783ce31419) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[mrbobbytables]

Maintainer cleanup: #546 has merged separately. The updated branch now has no package-lock.json delta against main; unrelated dependency churn and its generated bundle changes were removed. Reviewed the remaining feature/source changes and the sensitive-path alert that was triggered solely by the lockfile. Removing sentinel-alert for the reviewed head; updated CI must pass before merge.

[hivecommons-hive]

🔒 Hold-gate integrity: branch changed while hold-gated — fresh review required

This PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was ee783ce31419, but the branch now sits at bafd332eaff2. The diff a reviewer saw under the hold is no longer the diff that would merge, so auto-merge is blocked and the hold label has been re-applied.

Commits not present in the hold-time snapshot (2):

• 094c1f589abf by mrbobbytables — chore: isolate blunderbuss delay from dependency churn
• bafd332eaff2 by mrbobbytables — Merge focused dependency update into blunderbuss delay

Authors not in the hold-time author set: mrbobbytables

A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes.

[mrbobbytables]

Maintainer-authorized Copilot review: dependency churn is removed and the feature retains its intended deferred-review semantics. Added 17 bundle scenarios for the new delay paths; after integrating reviewed main, build, bundle freshness, lint, unit coverage and full bundle coverage all pass. Latest GitHub build-test and e2e-coverage also pass. The DCO app has not emitted a check on this head; independently verified author-matching Signed-off-by trailers on all five commits unique to this PR. No protection or failing check is overridden. Releasing the hold for this reviewed head.