Review Library Bulk Update

• Confirm the PR has label library-bulk-update.
• Read the body and verify it is a bot-generated "Added tested versions" summary.
• Gather files, reviews, issue comments, inline comments, and status checks.

URL Verification Rules

If any URL field changed, verify all of the following:

• repository-url is the canonical repository root URL.
• repository-url must not include a versioned tree path such as /tree/<tag>.
• source-code-url, test-code-url, and documentation-url must point to the exact library version in the changed entry.
• Do not accept unversioned docs, latest, current, or branch-based docs unless there is no versioned source and the PR clearly justifies it.
• Prefer Maven -sources.jar, -test-sources.jar, and -javadoc.jar when they exist and are valid.
• If a Maven -sources.jar or -test-sources.jar is used, verify it contains real source files such as .java, .kt, .scala, or .groovy, not only metadata or license files.
• If the URL points to a repository tree or archive instead of Maven, verify that it resolves to real source or test files for the exact version tag.
• If a candidate source or test URL cannot be verified with confidence, it should not be approved as-is.

Use the logic from tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/PopulateArtifactURLs.java, especially the urlUpdateInstructions and sourceArtifactVerificationInstructions rules.

Decision Rules

Approve when all of these are true:

• The PR is limited to the expected metadata/**/index.json files.
• The diff is only tested-version maintenance or clearly justified URL maintenance.
• CI is green, or any rerun confirms green status.
• Any changed URLs were verified against the exact version.
• Auto-merge was enabled after approval when the PR is mergeable.

Close or reject when any of these are true:

• The PR contains unrelated files or generated code.
• The PR is stale, conflicted, or clearly superseded by a newer automation run.
• CI failures point to a real regression or invalid update.
• URL changes cannot be verified confidently.

Ask for rerun or deeper investigation when:

• The diff looks correct but CI failed in a way that smells like infrastructure noise.
• A generated file changed and you need to confirm whether the workflow accidentally regenerated something.

Output Style

Match the historical style:

• Clean PR: approve with no comment or a very short confirmation, then enable auto-merge.
• Contaminated PR: leave a short factual comment explaining why it is being closed or should not be merged.
• Flaky CI: leave a short comment requesting or noting a rerun.