ci(bots): add daily retrospective (rolling learning PR) + bump engine

[eric-wang-1990]

Summary

Enables the daily retrospective (learning-extraction) flow on this repo — it was onboarded for the reviewer + engineer bots but never the retrospective — on the current engine d05dcb1, which maintains one rolling learning PR on a stable branch (ai/learning-pr) per databricks-bot-engine#146.

What the retrospective does

On a daily cron, the engine gathers merged PRs (diff + review comments) and recent engineer-bot author-run logs over an adaptive look-back window, and if the model finds durable, reusable engineering learnings, appends a dated section to a single rolling PR (ai/learning-pr) — human-gated, never committing the canonical log directly. The engineer author phase then reads those learnings to steer future fixes.

Changes

• .github/workflows/engineer-bot-learning.yml (new): daily schedule + workflow_dispatch (since/window-hours recovery inputs). PAT-free via the existing bot-prelude composite (same engine pin, single source of truth). Grants actions: read — Track B lists engineer-bot author runs; a missing scope hard-fails the run.
• .bot/config.yaml: adds the retrospective: block (engine-owned batch-aware prompt, no override) and author.knowledge_log = retrospective.log_path to close the loop (author reads what the retrospective writes).
• .claude/knowledge/learning-log.md (new): seed log the rolling PR appends to.
• bot-prelude: bump engine-ref default 5368de7 → d05dcb1 (also adopts the rolling-PR engine + any intervening fixes for the reviewer/engineer bots).

Also in this PR: fix the required Python Integration Tests gate (app-pinning)

Flagged and folded in during review of this PR (the gate was hanging on every PR — see below). Kept here at the maintainer's request rather than split out, since it's a live merge-blocker for the whole repo. These changes touch merge-blocking required-check gating, so calling them out explicitly:

• .github/workflows/trigger-integration-tests.yml — the required Python Integration Tests check is pinned in the main ruleset to the driver-integration-test app (integration id 2731531). The placeholder was posted via github.token, which lands as github-actions — a different check context that never satisfies the app-pinned gate — so the required check sat "Expected — Waiting for status to be reported" and PRs stayed BLOCKED (reproduced on this PR: a github-actions:success check was present yet the PR was blocked; it cleared only once driver-integration-test posted). Fix:
  • Internal PRs: skip-integration-tests-pr now mints the driver-test App token and posts the placeholder as that app (runs from the PR branch, no label, self-guarded to head repo == base repo).
  • Merge queue: mint the App token unconditionally and post the auto-pass / dispatch-failure checks as the app too (the github.token versions couldn't satisfy the pinned gate either).
• .github/workflows/skip-checks-reporter.yml (new): fork PRs can't mint secrets inline, so their placeholder is posted by a workflow_run companion (base-repo context, App token), self-guarded to forks so it doesn't double-post with the inline internal-PR job. Mirrors databricks-sql-go How to use query parameters with latest sqlalchemy dialect? #426 / databricks-sql-nodejs Slow query performance (2-5 seconds per query) on shared compute #459.

Out-of-band prerequisite (not in this PR): the Python Integration Tests required context must be pinned to the driver-test app id in the main ruleset (it already is — that's what this fix targets). If the ruleset still lists the legacy Python Proxy Tests / * contexts, swap them for Python Integration Tests. This is an admin ruleset change I can't make from a PR.

Validation

• .bot/config.yaml loads via load_bot; the retrospective: block parses; loop confirmed closed (retrospective.log_path == author.knowledge_log); bot_login_prefix present (needed for the DCO-signed learning commit).
• engineer-bot-learning.yml YAML parses; action refs match this repo's other bot workflows.
• CI gating: both workflow YAMLs parse; verified live on this PR that the inline internal-PR poster posts Python Integration Tests=success as driver-integration-test, clearing the previously-hung gate.

Provisioning note

The engineer-bot GitHub App installation must carry actions: read for Track B (author-run mining). DATABRICKS_HOST/DATABRICKS_TOKEN (azure-prod) and the App secrets are already in place from the existing bots.

This pull request and its description were written by Isaac.

---

This PR was created with GitHub MCP.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[peco-review-bot]

Verdict: 1 Medium

Mostly a CI/config PR (new daily retrospective workflow + engine SHA bump + config block) and reads cleanly against the existing bot workflows. One medium issue: the new workflow passes an undefined uv input to the setup-jfrog composite, which is silently ignored and only produces a warning.

[peco-review-bot]

Verdict: 1 Medium

CI/config-only PR enabling the daily retrospective flow. One medium concern: the new workflow's standalone setup-jfrog step is redundant with install-bot-engine's own JFrog handling, its justifying comment misstates that reuse, and it exports a token-bearing PIP_INDEX_URL into $GITHUB_ENV — the exact credential leak install-bot-engine is designed to avoid. Nit: the since input description reads "ISO lower bound to bound (shorten)" (duplicated "bound").

[peco-review-bot]

✅ No issues identified by the review bot.

[peco-review-bot]

Verdict: 1 Medium

Looks good on the stated scope — the retrospective flow (.bot/config.yaml block, seed log, daily-cron workflow) and the bot-prelude engine bump are internally consistent and the read/write loop is correctly closed (retrospective.log_path == author.knowledge_log). One medium concern: the diff also carries two undocumented, unrelated CI changes to required-check gating (new skip-checks-reporter.yml and a trigger-integration-tests.yml app-token rework) that the description never mentions.

Other findings

• 🟡 Medium — PR scope does not match its description. The description enumerates exactly four changes (learning workflow, .bot/config.yaml retrospective block, learning-log.md seed, bot-prelude engine bump). But the diff also includes two undocumented, unrelated CI changes:

• A new .github/workflows/skip-checks-reporter.yml (124 lines) handling the fork-PR placeholder for the required Python Integration Tests check via workflow_run.

• A substantial rework of .github/workflows/trigger-integration-tests.yml migrating the required-check posting from github.token to the driver-test App token, and splitting internal-vs-fork placeholder posting.

Both touch merge-blocking required-check gating — a high-risk area where a mistake can either wedge the merge queue or silently green a gate. Bundling them under a PR titled/described purely as "add daily retrospective + bump engine" hides them from reviewers who scope their attention to the stated changes. Please either split these into their own PR or update the description to document and justify them (and note that the required-checks ruleset change described in the workflow's own comments — swapping Python Proxy Tests / * for Python Integration Tests, and ensuring the check is pinned to the driver-test app id — is an out-of-band prerequisite for this rework to not block PRs).

[eric-wang-1990]

Good catch on scope. The CI gating changes (new skip-checks-reporter.yml + the trigger-integration-tests.yml app-token rework) were folded into this PR deliberately at my request during review — the required Python Integration Tests gate was hanging on every PR (posted via github.token → github-actions context, which never satisfies the driver-integration-test–pinned check), so it was a live merge-blocker worth fixing in place rather than stacking behind another PR. I've updated the description to document and justify both, including the out-of-band ruleset note. DCO sign-off failure was my three commits missing the Signed-off-by trailer — re-signed and force-pushed.

[peco-review-bot]

Verdict: 1 High

Mostly solid CI wiring (retrospective flow + integration-test gate fix). One HIGH concern: in the merge-queue-python job the driver-test-scoped app token is reused to post check-runs on databricks-sql-python (Auto-pass / dispatch-failure steps), which will 403 given the repositories: databricks-driver-test scope — worth verifying against the app's installation before merge.

[peco-review-bot]

✅ No issues identified by the review bot.

[peco-review-bot]

Verdict: 1 Low

Solid, exceptionally well-documented CI PR. The app-pinning fix for the Python Integration Tests required gate is internally consistent (merge-queue token minted unconditionally and scoped to both repos, all placeholder/auto-pass/fail steps in the merge-queue and internal-PR paths now attributed to the driver-test app), the fork reporter self-guards correctly against double-posting, and the retrospective config-loop invariant (retrospective.log_path == author.knowledge_log) holds. One low defensive note inline. Two operational preconditions worth confirming out-of-band (not code defects): (1) the INTEGRATION_TEST app installation must carry checks: write, since the internal-PR placeholder now relies on the app token instead of the job's github.token — a missing scope would 403 and block every internal PR's gate; (2) the ENGINEER_BOT app must carry actions: read for the retrospective's Track B, as the workflow comments note.