workflows(pr-review): post the review via REST with GH_TOKEN — f.github has no mount on Cloud

Merged
KH
2mo ago
+35-19

First live run of the deployed flows-pr-review (PR #478 → run e652a267): all four lens agents and the consensus step completed (~13 min), then the final step was refused:

helper_provider.mount_required: f.github requires a relayfile github mount; direct-token transport is not implemented.

Authored runs on Cloud get GH_TOKEN (the repository grant git uses via askpass — prepareRelayflowV2Repository), not a relayfile GitHub mount. So the comment now goes through the REST API with that token — the curl transport examples/pr-reviewer already documents — and is idempotent: the marker is <!-- flows-pr-review <headSha> --> and an existing comment carrying it makes a re-dispatched step skip (a deterministic step is not exactly-once). Body still bounded from the front under GitHub's limit.

Typecheck + flows check pass. After merge: redeploy (flows undeploy 92c60da5… && flows deploy workflows/pr-review.flow.ts …) — Cloud runs the stored copy.

Open question this run will answer: whether the PR-head grant's token has issues:write. If not, the step fails legibly with curl's 403 and the fix is on the cloud side (PR-head grants need comment write).

🤖 Generated with Claude Code

[!NOTE]
Medium Risk
Changes how production PR comments are authenticated and posted; depends on PR-head GH_TOKEN having issues:write, with shell/curl idempotency logic on busy PRs.

Overview
Fixes Cloud deployment of flows-pr-review by replacing f.github.comment (which fails without a relayfile GitHub mount) with a deterministic curl step that posts issue comments using the sandbox GH_TOKEN.

The post is idempotent per head SHA: comments are scanned across paginated API results for a <!-- flows-pr-review <sha> --> marker before creating a new comment. The consensus body is still truncated from the front under GitHub’s size limit, and workflows/README.md now describes this transport instead of the workspace GitHub connection.

PR-head staleness behavior is unchanged (decline if remote head moved), but a failed or invalid git ls-remote lookup now fails the step so a completed review is not silently dropped.

Reviewed by Cursor Bugbot for commit 4eb654309d06cd53581960daf55491e78e8d0281. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by cubic

Fixes the flows-pr-review comment step so it can run on Cloud, where f.github has no relayfile mount. The review now posts via the GitHub REST API using the sandbox's GH_TOKEN instead of f.github.comment.

  • The post is idempotent per head SHA; the check walks every comment page and counts comments by occurrence (each page is a single JSON line), so re-dispatched steps skip and busy PRs don't double-post. The scan fails instead of posting if it exceeds 50 pages.
  • A failed head lookup now fails the step instead of declining, so a finished review is not silently dropped.
  • Bounds the comment body from the front so the verdict is never dropped, and documents the new transport in workflows/README.md.
  • After merge, redeploy the workflow; Cloud runs the stored copy. Whether the PR-head grant's token can write comments is still open; if not, the step fails with a readable HTTP 403.