fix(backend): scope automatic reviews per project and team (#2349)

The "reapply previous approvals" flow (reviews marked `automatic`)
resolved candidate previous builds by bucket name + branch + mode only.
Bucket names ("default", …) are unique within a project, so a build
could inherit approvals from a same-named build in another project — and
therefore another team.

Scope `getPreviousBuildsQuery` to `build.projectId`, which isolates the
whole automatic-review flow per project and, since a project belongs to
one account, per team.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gregberge

apps/backend/src/build/approval.e2e.test.ts

@@ -395,6 +395,35 @@ describe("getPreviousApproverUserIds", () => {
     const userIds = await getPreviousApproverUserIds({ build, compareBucket });
     expect(userIds.sort()).toEqual([userA.id, userB.id].sort());
   });
+
+  test("ignores approvals from a same-named build in another project", async ({
+    build,
+    compareBucket,
+  }) => {
+    // A build in a different project (and therefore a different team) that
+    // shares the same bucket name and branch must never contribute approvers.
+    const otherProject = await factory.Project.create();
+    const otherBucket = await factory.ScreenshotBucket.create({
+      projectId: otherProject.id,
+      branch: compareBucket.branch,
+      name: compareBucket.name,
+    });
+    const otherBuild = await factory.Build.create({
+      compareScreenshotBucketId: otherBucket.id,
+      conclusion: "changes-detected",
+      projectId: otherProject.id,
+      createdAt: new Date(Date.now() - 1000).toISOString(),
+    });
+    const otherUser = await factory.User.create();
+    await factory.BuildReview.create({
+      buildId: otherBuild.id,
+      state: "approved",
+      userId: otherUser.id,
+    });
+
+    const userIds = await getPreviousApproverUserIds({ build, compareBucket });
+    expect(userIds).toEqual([]);
+  });
 });
 
 describe("getBuildReviewableDiffIds", () => {

apps/backend/src/build/approval.ts

@@ -92,6 +92,12 @@ function getPreviousBuildsQuery(args: {
   const buildQuery = Build.query()
     .select("builds.id")
     .joinRelated("compareScreenshotBucket")
+    // Scope to the current build's project. Bucket names ("default", …) are
+    // only unique within a project, so without this a build could inherit
+    // approvals from a same-named build in another project — and therefore
+    // another team. Scoping by project keeps automatic reviews isolated per
+    // project and per team.
+    .where("builds.projectId", build.projectId)
     .where("builds.createdAt", "<", build.createdAt)
     .where("builds.mode", build.mode)
     .where("builds.conclusion", "changes-detected")