Add mannequin bot reclaim support for customer owned bot accounts

[dpmex4527]

This PR adds bot-target support to gh gei reclaim-mannequin, so an organization admin or enterprise admin can reattribute migrated content from a bot mannequin to a customer-owned GitHub App / bot account (previously only human users were supported). Attribution to GitHub owned/first party apps is rejected on the backend.

Context

Customers whose automation moved from machine-user "bot accounts" to GitHub Apps couldn't reclaim their apps' bot-authored content. The reclaim path resolves the target via the GraphQL user(login:) query, which hides bots (it only resolves accounts where user? is true), so an app login like example-ci[bot] could not be resolved or reclaimed.

Notable Changes

• The CLI detects the [bot] suffix on the target and routes to a new ReattributeMannequinToBot mutation.

• Since bots can't be resolved through graphql, the CLI now uses rest API to fetch the bot gql ID

• The new mutation is under feature flag so we pass the mannequin_claiming_bot feature flag in the GraphQL-Features header

• Since bots can't receive emails, there is no manual confirmation flow. Only org admins and enterprise admins can call the new mutation and this mutation immediately reattributes the mannequin to bot after passing ownership checks

• Similar to the auto attribution process for users, the CLI displays prompts a confirmation step for both individual reclaim and CSV reclaim of bots warning users that mannequin reclamation is a one way step and that they need to confirm their intent to reclaim. It also has the --no-prompt flag to skip the prompt step

• If a user attempts to reclaim a mannequin bot that doesn't have the [bot] suffix, a warning is displayed. We allow this because non GitHub sources don't use GitHub bot conventions and we still want customers to be able to reclaim ADO/BBS bot accounts

• Did you write/update appropriate tests

• Release notes updated (if appropriate)

• Appropriate logging output

• Issue linked

• Docs updated (or issue created)

• New package licenses are added to ThirdPartyNotices.txt (if applicable)

Screenshots and functional testing

Reclaiming against target customer owned bot

Advisory warning when reclaiming against mannequin that doesn't end with [bot]

Reclaim against bot in another org fails

[Copilot]

Pull request overview

Adds bot-account targets to mannequin reclaim workflows.

Changes:

• Resolves [bot] targets through REST and invokes the bot reattribution mutation.
• Adds irreversible-action confirmations, CSV support, and warnings.
• Adds models, tests, feature flag, and release notes.

Show a summary per file

File	Description
RELEASENOTES.md	Documents bot reclaim support.
ReclaimMannequinCommandHandler.cs	Adds bot confirmations and CSV target parsing.
ReclaimMannequinToBotResult.cs	Defines mutation response models.
GithubApi.cs	Adds bot lookup and reattribution API calls.
GithubClient.cs	Enables the bot-claiming feature flag.
ReclaimService.cs	Routes bot targets through immediate reattribution.
ReclaimMannequinCommandHandlerTests.cs	Tests prompting behavior.
GithubApiTests.cs	Tests bot lookup and mutation handling.
ReclaimServiceTests.cs	Tests single bot-target reclaim routing.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 9/9 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

Unit Test Results

    1 files      1 suites   25s ⏱️
1 164 tests 1 164 ✅ 0 💤 0 ❌
1 165 runs  1 165 ✅ 0 💤 0 ❌

Results for commit d28abab.

♻️ This comment has been updated with latest results.

[brianaj]

What is the behavior for non-GH source migrations? I think we should have clear warnings this functionality is only for github [bot] in the command help and while running the command.

[dpmex4527]

What is the behavior for non-GH source migrations? I think we should have clear warnings this functionality is only for github [bot] in the command help and while running the command.

@brianaj great Q. The new behavior is an advisory warning indicating that the source mannequin does not look like a bot (missing [bot] suffix) but we intentionally are not blocking this. While this feature was built for GHES -> GitHub with Data residency mannequin bot reclamations I did not want to block customers migrating from other sources from being able to reclaim their bot mannequins. So for now non-GitHub reclaims would show an advisory warning like so:

Reclaiming Mannequin...
[WARNING] "some-ado-bot" does not look like a bot mannequin (its login does not end in "[bot]"). Are you sure you want to do this?
You are about to reattribute mannequin "some-ado-bot" to the GitHub App / bot account "chopper[bot]". Reattributing content to a bot is immediate and cannot be undone. Are you sure you wish to continue? [y/N]

There is future work we could do to strengthen/harden source mannequin bot detection (including passing info to our backend to indicate that a mannequin is truly a bot) but this would have significantly increased the scope of the work and would also not be backwards compatible with existing mannequin bot accounts that have already been imported (and that customers would want to reclaim).

I'm happy to add/update our help commands to make this behavior clear. Would something like this be good?

[WARNING] "some-ado-bot" does not look like a bot mannequin (its login does not end in "[bot]"). Are you sure you want to do this?
You are about to reattribute mannequin "some-ado-bot" to the GitHub App / bot account "chopper[bot]". Reattributing content to a bot is immediate and cannot be undone. Are you sure you wish to continue? [y/N]

[brianaj]

What is the behavior for non-GH source migrations? I think we should have clear warnings this functionality is only for github [bot] in the command help and while running the command.

@brianaj great Q. The new behavior is an advisory warning indicating that the source mannequin does not look like a bot (missing [bot] suffix) but we intentionally are not blocking this. While this feature was built for GHES -> GitHub with Data residency mannequin bot reclamations I did not want to block customers migrating from other sources from being able to reclaim their bot mannequins. So for now non-GitHub reclaims would show an advisory warning like so:

Reclaiming Mannequin...
[WARNING] "some-ado-bot" does not look like a bot mannequin (its login does not end in "[bot]"). Are you sure you want to do this?
You are about to reattribute mannequin "some-ado-bot" to the GitHub App / bot account "chopper[bot]". Reattributing content to a bot is immediate and cannot be undone. Are you sure you wish to continue? [y/N]

There is future work we could do to strengthen/harden source mannequin bot detection (including passing info to our backend to indicate that a mannequin is truly a bot) but this would have significantly increased the scope of the work and would also not be backwards compatible with existing mannequin bot accounts that have already been imported (and that customers would want to reclaim).

I'm happy to add/update our help commands to make this behavior clear. Would something like this be good?

[WARNING] "some-ado-bot" does not look like a bot mannequin (its login does not end in "[bot]"). Are you sure you want to do this?
You are about to reattribute mannequin "some-ado-bot" to the GitHub App / bot account "chopper[bot]". Reattributing content to a bot is immediate and cannot be undone. Are you sure you wish to continue? [y/N]

Got I think if other sources won't work as is (do we know their bot names) we should be more explicit that bot reclaims should only work from GitHub sources so ado/bbs/gitlab customers won't see it as a bug if it doesn't work for them.

[dpmex4527]

Got I think if other sources won't work as is (do we know their bot names) we should be more explicit that bot reclaims should only work from GitHub sources so ado/bbs/gitlab customers won't see it as a bug if it doesn't work for them.

From what I've been able to see other sources should work as long as we don't block on not having [bot] suffix. ADO has a property in their API response that indicates the user is a bot, BBS has a type value in their response that returns SERVICE and I believe GitLab bots has group as a prefix and bot as a suffix with bot set to true in API response. Customers should be able to pick these users from list of mannequins and attribute to their GitHub with Data Residency bot accounts with the advisory warning asking them to double check it's okay to reattribute.

[brianaj]

@dpmex4527 got it, well as long as there is a disclaimer 👍🏾

[dpmex4527]

I've updated the help message with the disclaimer

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
gei	81%	74%	682	✔
gl2gh	77%	70%	417	✔
bbs2gh	83%	78%	668	✔
ado2gh	71%	70%	749	➖
Octoshift	80%	70%	2037	✔
Summary	79% (9012 / 11399)	72% (2307 / 3205)	4553	✔