Auto-address PR reviews: respond, push fixes, resolve threads

[fishjojo]

What this does

Lets Claude automatically respond to PR reviews, push fixes, and resolve the review threads it addressed — no @claude mention required. Motivated by #119, where Codex's review (P1/P2 inline threads) went unhandled because the bot's author_association is NONE and it never mentions @claude.

How it works

1. Auto-trigger on reviews (claude.yml if:)
A submitted pull_request_review now triggers Claude when either:

• the reviewer is the Codex bot (chatgpt-codex-connector[bot]), or
• the reviewer is a trusted human (OWNER/MEMBER/COLLABORATOR).

approved/dismissed reviews are skipped. The existing @claude mention path (all four events, trusted authors only) is unchanged. A github.actor != 'claude[bot]' guard prevents self-triggering.

2. allowed_bots
The action skips bot-triggered runs by default, so the Codex bot is added to allowed_bots (scoped, not '*') — otherwise the auto-run is silently skipped.

3. Resolve threads
Thread resolution has no REST endpoint, so the system prompt instructs Claude to:

• enumerate unresolved threads via gh api graphql (reviewThreads),
• fix valid findings, run tests, commit & push,
• reply to each handled thread,
• and call the resolveReviewThread GraphQL mutation only for threads it actually fixed — disputed/unfixable ones stay open with an explanation.

This uses the already-granted pull-requests: write permission.

4. Loop bounding
A per-PR concurrency group with cancel-in-progress collapses stacked runs (Claude pushes → Codex re-reviews → supersedes the prior run). Full convergence still relies on the reviewer settling; a maintainer can intervene.

Security / cost notes

• Auto-runs are scoped to the Codex bot + trusted humans — not arbitrary external reviewers (avoids prompt-injection / cost abuse).
• Every qualifying review spends one Opus run.

Verification

• YAML + embedded settings JSON parse cleanly; if: parens/brackets balanced.
• Confirmed the Codex login is exactly chatgpt-codex-connector[bot] (type Bot) via the reviews API.
• actionlint not run (binary download blocked in this environment) — expression checked by hand.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0dd8af14ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[fishjojo]

@claude address codex's review

[claude]

Claude finished @fishjojo's task in 5m 13s —— View job

---

Addressing Codex's review

• Read the workflow and Codex's P1 finding
• Verify how claude-code-action@v1 selects tag vs. agent mode when prompt is empty
• Decide on a fix for the no-mention auto-review path
• Prepare the change (patch below — I can't push .github/workflows/, so please apply it manually)

---

Codex's P1 is correct — confirmed in the action source

I traced anthropics/claude-code-action@v1. For a pull_request_review with no @claude mention and no prompt:

1. src/modes/detector.ts — review events return tag mode only if (checkContainsTrigger(context)) (i.e. an @claude mention). With none, it falls through to the final return "agent" (commented "which won't trigger without a prompt").
2. src/entrypoints/prepare.ts — the run gate is:

   const containsTrigger = modeName === "tag"
       ? isEntityContext(context) && checkContainsTrigger(context)
       : !!context.inputs?.prompt;        // agent mode
   if (!containsTrigger) { /* skip */ }

   In agent mode with an empty prompt this is false → the run is skipped entirely.
3. Even if it ran, src/modes/agent/index.ts sets promptContent = context.inputs.prompt || "Repository: owner/repo" and claudeCommentId: undefined — so no PR/review context and no tracking comment.

So the intended no-mention auto-address path would silently no-op. (The actor check is fine: checkHumanActor honors allowed_bots, so the Codex bot passes.)

Fix

Set a prompt only for the no-mention auto-review case. A non-empty prompt selects agent mode and makes containsTrigger true, so the run proceeds with the PR number + task in-context. Every other trigger (all @claude paths) evaluates to '' → tag mode, unchanged. The detailed thread-handling procedure already lives in --append-system-prompt, which applies in both modes.

Apply this to .github/workflows/claude.yml (replaces the # NOTE: no prompt: comment block, just before the claude_args section):

@@ jobs.claude.steps[Run Claude Code].with @@
-          # NOTE: no `prompt:` input. Setting `prompt:` forces the action into
-          # "agent mode", which runs headlessly and does NOT post a reply back to
-          # the issue/PR. Omitting it selects "tag mode", which responds to the
-          # @claude mention and manages a response comment automatically. The
-          # behavioral guidance that used to live in `prompt:` is moved into
-          # `--append-system-prompt` below so tag mode keeps it.
+          # PROMPT / MODE SELECTION.
+          # claude-code-action auto-detects "tag" vs "agent" mode:
+          #   - tag mode (empty prompt + @claude mention): posts/updates a tracking
+          #     comment and auto-fetches PR context. This is the @claude path.
+          #   - agent mode (non-empty prompt): runs headlessly; the prepare step
+          #     only proceeds when `prompt` is non-empty.
+          # A pull_request_review submitted WITHOUT an @claude mention matches
+          # neither the tag trigger (no mention) nor the agent trigger (empty
+          # prompt). With an empty prompt that run is SKIPPED — and even if it ran,
+          # agent mode would only see "Repository: owner/repo" with no PR/review
+          # context. So set a prompt ONLY for that no-mention auto-review case: it
+          # selects agent mode, lets the run proceed, and carries the PR number +
+          # task. Every other trigger yields '' -> tag mode, unchanged. The detailed
+          # thread-handling procedure stays in `--append-system-prompt` below and
+          # applies in both modes.
+          prompt: >-
+            ${{ (github.event_name == 'pull_request_review'
+                 && !contains(github.event.review.body, '@claude'))
+                && format('A pull request review was submitted on PR #{0} of {1} without an @claude mention. Follow the review-handling procedure in your system prompt: enumerate the PR''s unresolved review threads with `gh api graphql`, fix the valid findings, run the relevant tests when you touch code, commit and push to the PR branch, reply to each thread you handled, resolve ONLY the threads you actually fixed, and post one summary comment of what you fixed and what you left open.', github.event.pull_request.number, github.repository)
+                || '' }}
+
           #

Notes

• The @claude paths (and trusted-human reviews that do mention @claude) keep tag mode with its tracking comment — the expression yields '' for them.
• '' inside format(...) is escaped as PR''s; the ${{ }} expression spans multiple lines, which is valid (whitespace/newlines inside an expression are ignored by the Actions expression engine).
• Verified locally: the edited file parses as valid YAML and the prompt key resolves to the expression above.
• Tradeoff worth knowing: agent mode does not create a managed tracking comment, so on the no-mention path Claude posts its summary via gh instead. If you'd rather keep the tracking-comment UX there too, an alternative is to set both track_progress: true and the same conditional prompt (the track_progress branch in detector.ts forces tag mode for review events, and the non-empty prompt flips checkContainsTrigger to true). I went with the minimal agent-mode change since it most directly matches Codex's suggestion.

I can't commit changes under .github/workflows/ (GitHub App workflow-permission restriction), so this needs to be applied by a maintainer.
• claude-auto-address-reviews

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5782d1b95

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99366cf9fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[fishjojo]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".