vulnerability evaluator: Submit reviews with just comment if the auth…

…or is the same as the mediator identity

Because github doesn't let you review your own code, in case mediator is
running as the same identity as the contributor submitting the PR, we
can't request changes.

In that case, let's just mark the review as commenting instead of
changes requested. A follow-up patch would then set the commit status to
failed to prevent merge.

Fixes: #951

internal/controlplane/handlers_githubwebhooks.go

@@ -802,10 +802,16 @@ func getPullRequestInfoFromPayload(
 		return nil, fmt.Errorf("error getting pull request number from payload: %w", err)
 	}
 
+	prAuthorId, err := util.JQReadFrom[float64](ctx, ".pull_request.user.id", payload)
+	if err != nil {
+		return nil, fmt.Errorf("error getting pull request author ID from payload: %w", err)
+	}
+
 	return &pb.PullRequest{
-		Url:     prUrl,
-		Number:  int32(prNumber),
-		Patches: nil, // to be filled later with a separate call
+		Url:      prUrl,
+		Number:   int32(prNumber),
+		AuthorId: int64(prAuthorId),
+		Patches:  nil, // to be filled later with a separate call
 	}, nil
 }
 

internal/engine/eval/vulncheck/review.go

@@ -134,6 +134,7 @@ type reviewPrHandler struct {
 	pr  *pb.PullRequest
 
 	mediatorReview *github.PullRequestReview
+	failStatus     *string
 
 	comments []*github.DraftReviewComment
 	status   *string
@@ -157,11 +158,28 @@ func newReviewPrHandler(
 		Str("repo-name", pr.RepoName).
 		Logger()
 
+	cliUser, err := cli.GetAuthenticatedUser(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("could not get authenticated user: %w", err)
+	}
+
+	// if the user wants mediator to request changes on a pull request, they need to
+	// be different identities
+	var failStatus *string
+	if pr.AuthorId == cliUser.GetID() {
+		failStatus = github.String("COMMENT")
+		logger.Debug().Msg("author is the same as the authenticated user, can only comment")
+	} else {
+		failStatus = github.String("REQUEST_CHANGES")
+		logger.Debug().Msg("author is different than the authenticated user, can request changes")
+	}
+
 	return &reviewPrHandler{
-		cli:      cli,
-		pr:       pr,
-		comments: []*github.DraftReviewComment{},
-		logger:   logger,
+		cli:        cli,
+		pr:         pr,
+		comments:   []*github.DraftReviewComment{},
+		logger:     logger,
+		failStatus: failStatus,
 	}, nil
 }
 
@@ -219,7 +237,7 @@ func (ra *reviewPrHandler) submit(ctx context.Context) error {
 func (ra *reviewPrHandler) setStatus() {
 	if len(ra.comments) > 0 {
 		// if this pass produced comments, request changes
-		ra.status = github.String("REQUEST_CHANGES")
+		ra.status = ra.failStatus
 		ra.text = github.String(reviewBodyRequestChangesCommentText)
 	} else {
 		// if this pass produced no comments, resolve the mediator review