CodeRabbit ignores owner review requests on Dependabot PRs, blocking auto-merge

[acgetchell]

Problem

Dependabot PRs receive an owner-authored CodeRabbit review request and have native squash auto-merge enabled, but CodeRabbit skips the bot author and does not submit a review. GitHub correctly keeps them in REVIEW_REQUIRED. This is a regression in the workflow previously established by #198; the underlying configuration, eligibility, or provider cause is not yet established.

Reproduction and evidence

• PR #256, head 4e14f6730100fb1c014da3bfe8e5bd4ee6f71ef3, remains open with no submitted reviews. Its CodeRabbit status is successful even though the review was skipped; that status is not an approval.
• The workflow posted an owner-authored review request on September 21 at 10:10:08 UTC and enabled auto-merge. CodeRabbit then reported "Bot user detected", recommending the same review command already posted.
• Failed CodeRabbit run ID: dce36036-6dd0-46b8-a9ef-f83e23ff8ffb.
• Two controlled diagnostics were posted by acgetchell on September 24: @coderabbitai configuration at 21:10:10 UTC and @coderabbitai full review at 21:10:53 UTC. Both remained unanswered at the latest check around 21:13 UTC. Recheck these requests before issuing any further review commands.
• PR #257 has the same missing-review/approval behavior.
• In contrast, PR #240 received an owner review request, CodeRabbit approval, and automatic merge on September 7. Its .coderabbit.yaml and chore(deps): bump the github-actions group across 1 directory with 7 updates #256's have the same Git blob SHA: e6c1bf6f079fe91c77f4acf8c228e35859bd7e58.
• The Dependabot review/auto-merge workflow has not changed since July 31. Successful and failed requests use the same owner identity and command format.
• The same symptom appears in causal-triangulations #286 and markov-chain-monte-carlo #168. The latter was closed without a CodeRabbit review. Its subsequent research-repo-tools 0.1.6 upgrade does not establish a fix: no later Dependabot PR has exercised it, and that package is not invoked by the review-request workflow.

Investigation and resolution

• Inspect the effective configuration and its source annotations, particularly forced organization overrides. The repository enables reviews.request_changes_workflow; an ordinary organization UI default does not by itself prove that setting is overridden.
• Determine why owner-issued commands on bot-authored PRs are not acknowledged. Distinguish configuration/eligibility, event delivery, and provider processing before changing the workflow.
• If configuration is correct and the fresh commands remain unresponsive, provide CodeRabbit support with the PR URLs, command timestamps, run ID, and successful comparison. CodeRabbit's troubleshooting guidance recommends support for consistent failures across repositories.

Acceptance criteria

• Identify and document the cause and the narrow fix, including any provider-side resolution.
• Verify that one owner-authored review request on a current Dependabot head produces an actual CodeRabbit review and approval after any findings are addressed.
• Verify native squash auto-merge completes only after the approval, current required checks, and resolved-thread requirements are satisfied.
• Record PR/head/run links and verify the resulting default-branch checks.
• Preserve required approvals, strict checks, existing bypass policy, disabled Actions self-approval, and exact-head request deduplication. Do not use repeated requests or weaker branch protections as a workaround.

Related: #198. This tracks hosted GitHub review behavior; the local CodeRabbit CLI adoption work in #253/#255 is separate.