fix(github): aggregate leader answers unscoped usage errors despite respond_to_unscoped

[aparajon]

Why this matters

Some repos are served by a fleet of SchemaBot deployments arranged in an aggregate: one leader plus several participants. When a comment command has a usage error that isn't scoped to any one deployment — a bare schemabot apply missing its -e environment flag, an -e value naming an unknown environment, a help request, or an unrecognized command — the participants deliberately stay silent and defer the reply to the leader, so the error is posted exactly once instead of once per deployment.

To reinforce that, fleets also set respond_to_unscoped: false on every deployment. The problem: the leader's own reply path consulted that same policy and silenced itself. So nobody replied. The operator's command died with no PR-visible feedback at all, and the skip was logged only at debug level — invisible in production logs — so there was nothing to explain why.

What it does

• The leader now answers unscoped usage errors (missing/malformed/unknown -e), help, and invalid commands regardless of respond_to_unscoped — it is the designated responder by role, and the deployments that deferred to it must not find it silenced. Repos without an aggregate role keep the existing respond_to_unscoped single-responder behavior.
• The policy skips now log at info instead of debug, naming the policy and the deployment expected to post the reply, so a missing reply is triageable from logs.

operator comments: "schemabot apply"        (missing -e)

BEFORE                                      AFTER
──────────────────────────────────────      ──────────────────────────────────────
participant A ── defers to leader           participant A ── defers to leader
participant B ── defers to leader           participant B ── defers to leader
leader ── respond_to_unscoped=false         leader ── designated responder by role
          → silent                                    → replies once with usage help

PR reply: (nothing)                         PR reply: ❌ missing environment: use -e

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes a webhook reply gap in aggregate-repo setups where all deployments set respond_to_unscoped: false: aggregate participants defer unscoped usage/help/invalid-command replies to the leader, but the leader previously also consulted respond_to_unscoped and could silence itself—resulting in no PR-visible feedback for certain commands.

Changes:

• Add an aggregate-aware responder predicate (answersUnscopedUsageErrors) so aggregate leaders reply even when respond_to_unscoped is false.
• Route help, invalid env, missing env, unknown env, and invalid-command reply gating through that predicate, and promote “skip” logs from debug to info.
• Add a regression test covering aggregate-leader replies under respond_to_unscoped: false.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/webhook/schema_source_policy.go	Adds aggregate-aware logic to decide when this deployment should post unscoped usage/help replies.
pkg/webhook/issue_comment.go	Uses the new aggregate-aware responder logic and upgrades skip logs to info for triageability.
pkg/webhook/check_runs_test.go	Adds coverage to ensure the aggregate leader posts replies despite respond_to_unscoped: false.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.