Add bot-guarded scripts for PR review thread reply and resolve#203
Draft
ikuwow wants to merge 2 commits into
Draft
Add bot-guarded scripts for PR review thread reply and resolve#203ikuwow wants to merge 2 commits into
ikuwow wants to merge 2 commits into
Conversation
Three bin/ scripts: gh-pr-review-threads (list), gh-pr-thread-reply, gh-pr-thread-resolve. The two write scripts share a bot-guard helper that refuses to act on threads whose first comment author is not a recognised bot (GraphQL __typename == Bot, or a login in the known list). Adds an allow entry per script, a new pr-review-response.md rule, and an ask entry for top-level gh pr comment. Closes #126. Co-authored-by: Claude Opus 4.6 <[email protected]>
The earlier reviewThreads(first:100) + jq-side id filter had two issues: PRs with >100 threads would silently fail with "not found" for valid ids beyond the page, and the id was interpolated into the jq filter string where a stray quote could break it. Direct node(id: $tid) lookup removes both. A regex check on the id charset prevents anything outside opaque base64-style strings from reaching the GraphQL variable. Co-authored-by: Claude Opus 4.6 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #126.
Why
ghdoes not expose review-thread reply or resolve through its native CLI, so today every reply requires an interactivegh api graphql ... -f ...call that lives behind theaskclaw-back. That is fine for one-off use but makes a "bot answers bot" workflow impractical, since each step prompts. At the same time, an unguarded auto-reply path on human review threads would be a hard rule violation. The structural fix is to keep the GraphQL behind wrapper scripts that perform the bot check themselves; the scripts then sit inallowwithout enabling the wrong behavior.What
bin/gh-pr-review-threads— read-only GraphQL list of review threads with their first comments,isResolved,isOutdated, author login and__typename.bin/gh-pr-thread-replyandbin/gh-pr-thread-resolve— write paths gated by the sharedbin/gh-pr-thread-bot-guard.sh. The guard accepts a thread iff the first comment author is either__typename == "Bot"or appears in the bot login allowlist (github-actions[bot],dependabot[bot],renovate[bot],copilot-pull-request-reviewer[bot],coderabbitai[bot],devin-ai-integration[bot],claude[bot]).claude/rules/pr-review-response.md— the procedural rule the wrappers serve.claude/settings.json—allowfor the three wrappers;askfor top-levelgh pr comment *so direct PR comments still surface a prompt.Notes
reviewThreads(first:100)+ jq-side ID filter to a directnode(id: $tid)lookup, plus a regex check on the thread id charset. This closes the 100-thread pagination cap and removes the quoting risk of interpolating the id into a jq filter string.realpath "$0"so the executable scripts find their guard helper even when invoked through the~/binsymlink thatscripts/deploy.shcreates.[bot]-suffixed and unsuffixed forms ofcopilot-pull-request-reviewer, since GitHub has varied that suffix across the App's lifetime.gh-pr-thread-bot-guard.shis mode 0644, soscripts/deploy.sh's-perm 0755filter skips it — the helper stays adjacent to the wrappers in the source tree only.Verification
gh-pr-review-threads ikuwow/dotfiles 207returns valid JSON (0 threads on that PR, query path exercised end-to-end).gh-pr-thread-replyrejects a malformed thread id ('PRT_kw"; echo pwned') withError: thread id contains unexpected characters: ...before any GraphQL call.gh-pr-thread-replyagainst a syntactically-valid-but-unknown id (INVALID_THREAD_ID_xxx) reaches GraphQL and getsCould not resolve to a node with the global id of ...— confirms the node(id:) path is wired correctly.gh-pr-thread-replyagainst a real human-authored review thread refuses (would require a PR with an existing human thread; deferred to first organic use).gh-pr-thread-replyagainst a real bot-authored thread successfully posts andgh-pr-thread-resolveresolves it (defer until a bot PR review actually lands; would otherwise post a noise comment).shellcheck bin/gh-pr-*clean.claude/settings.jsonvalid JSON (jq . claude/settings.json).