fix: require 2+ reviews for ready-to-merge, not just maintainer alone

Addresses maintainer feedback: a single maintainer approval with only
1 total review should not mark a PR as ready-to-merge, since branch
protection requires 2+ reviews.

Changes:
- determineLabel() now requires maintainerApproval >= 1 AND anyApproval >= 2
  for ready-to-merge
- If a maintainer approves alone, the PR stays at queue:maintainers until
  a second reviewer also approves
- Updated and added unit tests (38 total, all passing)

Signed-off-by: darshit2308 <darshit2308@gmail.com>

Author: darshit2308

.github/scripts/review-sync/helpers/labels.js

@@ -57,19 +57,23 @@ async function ensureLabel(github, owner, repo, label, dryRun) {
  * Determine the correct queue label for a PR based on approval counts.
  *
  * Phase 1 logic (4-stage pipeline):
- *   maintainerApproval >= 1  → ready-to-merge      (CODEOWNERS satisfied)
- *   writeApproval >= 1       → queue:maintainers    (committer approved, needs maintainer)
- *   anyApproval >= 1         → queue:committers     (has any approval, needs committer)
- *   else                     → queue:junior-committer (no approvals yet)
+ *   maintainerApproval >= 1 AND anyApproval >= 2  → ready-to-merge      (CODEOWNERS + min reviews)
+ *   writeApproval >= 1 OR maintainerApproval >= 1 → queue:maintainers   (senior review present, needs more)
+ *   anyApproval >= 1                               → queue:committers    (has any approval, needs committer)
+ *   else                                           → queue:junior-committer (no approvals yet)
+ *
+ * Note: ready-to-merge requires BOTH a maintainer approval AND at least 2
+ * total reviews. This prevents a single maintainer approval from marking
+ * a PR as ready-to-merge when branch protection requires 2+ reviews.
  *
  * @param {{ maintainerApproval: number, writeApproval: number, softApproval: number, anyApproval: number }} approvals
  * @returns {object} The correct QUEUE_LABELS entry
  */
 function determineLabel(approvals) {
-  if (approvals.maintainerApproval >= 1) {
+  if (approvals.maintainerApproval >= 1 && approvals.anyApproval >= 2) {
     return QUEUE_LABELS.MERGE;
   }
-  if (approvals.writeApproval >= 1) {
+  if (approvals.writeApproval >= 1 || approvals.maintainerApproval >= 1) {
     return QUEUE_LABELS.MAINTAINERS;
   }
   if (approvals.anyApproval >= 1) {

.github/scripts/review-sync/tests/test-labels.js

@@ -39,19 +39,27 @@ const unitTests = [
     },
   },
   {
-    name: 'determineLabel: 1 maintainer → ready-to-merge',
+    name: 'determineLabel: 1 maintainer alone → queue:maintainers (NOT ready-to-merge, needs 2 reviews)',
     test: () => {
+      // Sophie's edge case: maintainer approves first, only 1 total review
       const r = determineLabel({ maintainerApproval: 1, writeApproval: 0, softApproval: 0, anyApproval: 1 });
-      return r.name === 'ready-to-merge';
+      return r.name === 'queue:maintainers';
     },
   },
   {
-    name: 'determineLabel: 1 maintainer + 1 write → ready-to-merge',
+    name: 'determineLabel: 1 maintainer + 1 write → ready-to-merge (2 reviews satisfied)',
     test: () => {
       const r = determineLabel({ maintainerApproval: 1, writeApproval: 1, softApproval: 0, anyApproval: 2 });
       return r.name === 'ready-to-merge';
     },
   },
+  {
+    name: 'determineLabel: 1 maintainer + 1 soft → ready-to-merge (2 reviews satisfied)',
+    test: () => {
+      const r = determineLabel({ maintainerApproval: 1, writeApproval: 0, softApproval: 1, anyApproval: 2 });
+      return r.name === 'ready-to-merge';
+    },
+  },
   {
     name: 'determineLabel: 3 soft, 0 write → queue:committers',
     test: () => {
@@ -103,8 +111,14 @@ const unitTests = [
     name: 'syncLabel: stale label → adds correct, removes stale',
     test: async () => {
       const mock = createMockGithub({
-        roles: { sophie: { role_name: 'maintain', permission: 'write' } },
-        reviews: [{ user: { login: 'sophie' }, state: 'APPROVED', submitted_at: '2026-01-01T00:00:00Z' }],
+        roles: {
+          sophie: { role_name: 'maintain', permission: 'write' },
+          bob: { role_name: 'write', permission: 'write' },
+        },
+        reviews: [
+          { user: { login: 'sophie' }, state: 'APPROVED', submitted_at: '2026-01-01T00:00:00Z' },
+          { user: { login: 'bob' }, state: 'APPROVED', submitted_at: '2026-01-02T00:00:00Z' },
+        ],
       });
       const changed = await syncLabel(mock, 'o', 'r', { number: 1, labels: [{ name: 'queue:junior-committer' }] }, false);
       return changed === true && mock.calls.labelsAdded.includes('ready-to-merge') && mock.calls.labelsRemoved.includes('queue:junior-committer');