feat(code-reviewer) config to skip or permit bots

[St0rmz1]

Summary

Adds a per-org setting that skips automated (webhook) code reviews for
bot-authored pull requests (Dependabot, Renovate, etc.), on by default. These
high-volume, low-value dependency PRs otherwise consume review compute and post
review comments on every bump. Bots are detected with GitHub's authoritative
user.type === 'Bot', and the skip runs before any review is created, so it
applies to both standard and council reviews. Manual reviews are unaffected.

Changes

• packages/db/src/schema-types.ts: add skip_bot_pull_requests to the code
  review config. Absent is treated as true (skip), so existing orgs start
  skipping bot PRs on rollout. Enforced on GitHub only; the comment notes GitLab
  and Bitbucket webhooks do not expose a bot flag.
• apps/web/.../github/webhook-handlers/pull-request-handler.ts: compute the
  bot-skip decision once (skip_bot_pull_requests ?? true AND user.type === 'Bot'). Gate the merge-commit path (step 4) on it so a bot PR whose head is a
  merge commit is not re-pointed to a new SHA with a fresh check run. Enforce the
  skip after the supersession/cancellation step, so a bot push still cancels any
  stale in-flight review and resolves its check run instead of leaving it stuck.
• apps/web/src/routers/organizations/organization-code-reviews-router.ts and
  code-reviews-router.ts: thread skipBotPullRequests through save and load
  (default true) for org and personal configs.
• apps/web/src/components/code-reviews/ReviewConfigForm.tsx: add a "Skip pull
  requests from bots" toggle to Global Settings, shown for GitHub only (hidden on
  GitLab, where it would have no effect).
• Tests: handler integration (bot PR skipped by default and creates no review;
  reviewed when the setting is false; non-bot reviewed; a skipped bot PR still
  cancels a superseded review and resolves its stale check run; a bot PR with a
  merge-commit head takes the skip path, not merge-commit migration) and a router
  round-trip (default true, persists false).

Verification

• No manual testing for this PR. The behavior is decision logic plus a config
  field and toggle, covered by handler integration tests and a router round-trip,
  all passing. The automated webhook review flow it gates was validated end to end
  in earlier work.

Visual Changes

Adds one toggle to the code review config screen (Global Settings), shown for
GitHub only. Screenshots to be added.

Before	After

Reviewer Notes

• Default-on is a behavior change: on rollout, orgs stop getting Dependabot and
  Renovate reviews unless they turn the toggle off. Worth a changelog note.
• The skip is placed after supersession and the merge-commit path defers to it, so
  a bot PR cannot leave a stale/queued check run that blocks the PR. Both are
  covered by tests.
• GitHub only for now: GitLab and Bitbucket webhooks carry no authoritative bot
  flag, so the setting has no effect there and the toggle is hidden on GitLab.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the bot-PR skip guardrail (config schema, personal/org routers, UI toggle, and webhook handler ordering) and found no correctness, security, or logic issues in the changed lines.

Files Reviewed (7 files)

• apps/web/src/components/code-reviews/ReviewConfigForm.tsx
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/pull-request-handler.ts
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/pull-request-handler.test.ts
• apps/web/src/routers/code-reviews-router.ts
• apps/web/src/routers/organizations/organization-code-reviews-router.ts
• apps/web/src/routers/organizations/organization-code-reviews-router.test.ts
• packages/db/src/schema-types.ts

---

_{Reviewed by claude-sonnet-5 · Input: 42 · Output: 7.1K · Cached: 1.3M}

_{Review guidance: REVIEW.md from base branch main}