Conversation
There was a problem hiding this comment.
Pull request overview
This pull request standardizes fleet GitHub mutations to go through portable hub tooling (or authenticated gh) and extends scripts/pr_review.py with a comment subcommand to post PR-conversation responses for suppressed findings.
Changes:
- Add
scripts/pr_review.py commentto post and confirm PR conversation comments (target PR node ID read live in-run). - Extend unit tests and docs to cover
comment, and tighten the “writes owned by this script” guardrails. - Update governance and distributed skills/runbook guidance to avoid provider-connector writes for fleet mutations.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/pr_review.py | Adds comment subcommand and GraphQL documents for PR conversation comments. |
| scripts/tests/test_pr_review.py | Adds comment command tests and updates write-document assertions. |
| scripts/README.md | Documents the new comment workflow for suppressed findings. |
| GOVERNANCE.md | Declares provider connectors read-only for fleet mutations and routes writes via hub tooling/gh. |
| .github/skills/pr-review-conduct/SKILL.md | Instructs using pr_review.py comment for suppressed findings and forbids connector mutations. |
| .agents/skills/pr-review-conduct/SKILL.md | Same guidance as the GitHub skill distribution copy. |
| .claude-plugin/fleet-skills/skills/pr-review-conduct/SKILL.md | Same guidance as the Claude skill distribution copy. |
| .github/copilot-instructions.md | Updates runbook to include comment for PR conversation responses. |
| .claude-plugin/fleet-skills/.source-digest | Updates skill distribution digest to match regenerated content. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.
Suppressed comments (1)
scripts/pr_review.py:1603
- Normalize newlines in the
--bodytext before sending and confirming it. GitHub stores comment bodies with\n, so if a Windows shell passes\r\nthe comment can land successfully but this code returnsCOMMENT_NOT_CONFIRMEDbecause the echoed body differs only by line endings.
edge = (gh_graphql(M_COMMENT, subjectId=target["id"], body=body).get("addComment") or {}).get(
"commentEdge"
) or {}
comment = edge.get("node") or {}
if not comment.get("url") or (comment.get("body") or "") != body:
Suppressed findings (1) in review round: scripts/pr_review.py:1603 "Normalize newlines in the --body text before sending and confirming it." Fixed in 6285cd4. The command normalizes CRLF and bare CR to LF before sending, then compares GitHub response against the normalized body. A regression test covers both forms. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.
Suppressed comments (2)
scripts/pr_review.py:14
commentdocuments exit code 64 as "the target is under another owner", butcomment_on_pr()returns 64 for any out-of-scope write, including whenorigin_owner()is unreadable. Update the docstring so callers do not misinterpret a missing-origin refusal as a cross-owner target.
comment Post one PR-conversation answer, including a suppressed-finding disposition. The PR
node id is read in the same run, and the returned comment URL and body confirm the
write. Exit 0 = done, 64 = the target is under another owner, 65 = the PR could not
be read, 66 = the response did not confirm the comment.
scripts/tests/test_pr_review.py:2426
- Add coverage for the
commentout-of-scope path whenorigin_owner()is unreadable. Todayreplycovers this scenario, butcommentdoes not, and a regression could allow a write (or a confusing error) when scope cannot be established.
def test_a_target_under_another_owner_is_refused_before_the_pr_read(self) -> None:
self.wire({"id": "PR_wrong_owner", "url": "https://github.com/x/r/pull/7"})
self.assertEqual(64, self.run_comment(repo="x/r"))
self.assertEqual([], self.calls)
self.assertIn("OUT_OF_SCOPE", self.out.getvalue())
ptr727
commented
Aug 18, 2026
Suppressed findings (2) in review round. (1) scripts/pr_review.py:14 "comment documents exit code 64 as the target is under another owner." Fixed in dea0e97. The command now documents both an unreadable origin and an excluded target. (2) scripts/tests/test_pr_review.py:2426 "Add coverage for the comment out-of-scope path when origin_owner() is unreadable." Fixed in dea0e97. The regression test verifies exit 64, no GraphQL call, and the OUT_OF_SCOPE result. |
Uh oh!
There was an error while loading. Please reload this page.
Summary
ghpr_review.py commentfor suppressed-finding responses in the PR conversationWhy
Codex's GitHub connector can report repository access while its mutation token receives
403 Resource not accessible by integration. The verifiedghsession already has the required access. A common hub-tooling path gives Codex, Claude, opencode, and terminal users the same write behavior.Addresses #805.
Verification
pr_review.pycoverage at 97%