fix: retrigger CodeRabbit plan on unlock and log skip reason (hiero-ledger#2350)

Signed-off-by: Anshul Kushwaha <137977998+sudo-anshul@users.noreply.github.com>

Author: sudo-anshul

.github/scripts/coderabbit_plan_trigger.js

@@ -1,7 +1,7 @@
-// Script to trigger CodeRabbit plan for intermediate and advanced issues
+// Script to trigger CodeRabbit plan for all difficulty-labeled issues (including GFI)
 
 const CODERABBIT_MARKER = '<!-- CodeRabbit Plan Trigger -->';
-const { DIFFICULTY_LABELS, GOOD_FIRST_ISSUE_LABEL } = require('./shared/labels.js');
+const { DIFFICULTY_LABELS } = require('./shared/labels.js');
 
 async function triggerCodeRabbitPlan(github, owner, repo, issue, marker = CODERABBIT_MARKER) {
   const comment = `${marker} @coderabbitai plan`;
@@ -27,13 +27,10 @@ async function triggerCodeRabbitPlan(github, owner, repo, issue, marker = CODERA
   }
 }
 
-function hasBeginnerOrHigherLabel(issue, label) {
-  // Only beginner+ labels qualify here; GFI gets its own CodeRabbit plan
-  // trigger via the assignment bot chain (bot-gfi-assign-on-comment.js).
-  const beginnerPlus = DIFFICULTY_LABELS
-    .filter(d => d !== GOOD_FIRST_ISSUE_LABEL)
-    .map(d => d.toLowerCase());
-  const allowed = new Set(beginnerPlus);
+function hasDifficultyLabel(issue, label) {
+  // All difficulty labels now qualify — CodeRabbit plan is delivered on
+  // approval for every difficulty tier, including Good First Issue.
+  const allowed = new Set(DIFFICULTY_LABELS.map(d => d.toLowerCase()));
 
   const hasAllowedLabel = issue.labels?.some(l => allowed.has(l?.name?.toLowerCase()));
 
@@ -80,6 +77,30 @@ async function hasExistingCodeRabbitPlan(github, owner, repo, issueNumber) {
   }
 }
 
+async function getLatestIssue(github, owner, repo, issue) {
+  if (!issue?.number) return issue;
+
+  try {
+    const { data } = await github.rest.issues.get({
+      owner,
+      repo,
+      issue_number: issue.number,
+    });
+
+    return data || issue;
+  } catch (error) {
+    console.log('Failed to refresh issue state; falling back to event payload:', {
+      message: error?.message,
+      status: error?.status,
+      owner,
+      repo,
+      issueNumber: issue?.number,
+    });
+
+    return issue;
+  }
+}
+
 function logSummary(owner, repo, issue) {
   console.log('=== Summary ===');
   console.log(`Repository: ${owner}/${repo}`);
@@ -92,13 +113,21 @@ function logSummary(owner, repo, issue) {
 async function main({ github, context }) {
   try {
     const { owner, repo } = context.repo;
-    const { issue, label } = context.payload;
+    const { issue: eventIssue, label } = context.payload;
 
     // Validations
-    if (!issue?.number) return console.log('No issue in payload');
+    if (!eventIssue?.number) return console.log('No issue in payload');
+
+    // Refresh issue state to avoid stale payload fields (e.g., locked status)
+    // when this script is invoked after earlier workflow steps mutate the issue.
+    const issue = await getLatestIssue(github, owner, repo, eventIssue);
+
+    if (issue.locked) {
+      return console.log(`Issue #${issue.number} is locked. CodeRabbit plan trigger will be deferred until the issue is approved and unlocked.`);
+    }
 
-    if (!hasBeginnerOrHigherLabel(issue, label)) {
-      return console.log('Issue does not have beginner/intermediate/advanced label');
+    if (!hasDifficultyLabel(issue, label)) {
+      return console.log('Issue does not have a difficulty label');
     }
 
     if (await hasExistingCodeRabbitPlan(github, owner, repo, issue.number)) {

.github/workflows/approved-issues.yml

@@ -13,6 +13,7 @@ defaults:
 
 permissions:
   issues: write
+  contents: read
 
 concurrency:
   group: approve-issues-${{ github.event.issue.number }}
@@ -50,3 +51,17 @@ jobs:
           issue-number: ${{ github.event.issue.number }}
           body: |
             Approved by @hiero-ledger/hiero-sdk-python-triage and @hiero-ledger/hiero-sdk-python-committers and @hiero-ledger/hiero-sdk-python-maintainers.
+
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Trigger CodeRabbit Plan
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const script = require('./.github/scripts/coderabbit_plan_trigger.js');
+            await script({ github, context });