fix(review): deny reviewer gh pr comment so it stops duplicate-posting the review

[d-morrison]

Closes #381.

Problem

Every claude-code-review run posts the review twice: once as claude[bot] (the reviewer agent's own ## Code review self-post) and once as github-actions[bot] (the workflow's "Post review comment" step). Seen on Morrison-Lab/ai-config#1104 and, in the raw-command-republishing variant, on gha#380 (#381) and gha#312.

Root cause

The reviewer's gh pr comment self-post channel was documented as blocked in three places (this composite's header, check-review-execution.sh, and gha CLAUDE.md) but never actually wired up: --disallowedTools never listed it, and the upstream code-review plugin's command frontmatter re-grants Bash(gh pr comment:*). So the agent self-posts the summary as claude[bot], and the workflow re-posts the extracted text as github-actions[bot].

The claude[bot] self-post is the strictly worse of the two: it carries no run-link header, is never folded by the collapse step (which matches on the workflow's run URL), isn't cost-linked, and bypasses the stub/verdict guard. So the fix keeps the github-actions[bot] post canonical and removes the self-post.

Fix

• Add Bash(gh pr comment:*) to the reviewer's --disallowedTools -- the guard the code already assumed existed.
• Reword the reviewer prompt so it outputs its review (findings not tied to a line, plus the ### Verdict) as its final message instead of posting a top-level comment; the workflow posts it. Inline comments (the inline-comment tool) are untouched. This also fixes a latent quality bug where the workflow sometimes re-posted only the agent's short "Review complete" recap instead of the full review, because the agent had already self-posted the real one (round 2 of ai-config#1104).
• Correct the three stale "not granted / necessarily denied" comments to describe the guard that now actually exists.
• Removing the self-post also makes claude-code-review can post the reviewer's raw gh pr comment heredoc instead of the review body #312/Fix claude-code-review republishing a raw gh pr comment as the review body #318/claude-code-review still republishes a raw gh pr comment invocation as the review body (--edit-last variant, gha#312 regression) #381's unwrap_posted_body republishing class moot: the agent never calls gh pr comment, so there is never a raw command to republish.

Verification note

This depends on --disallowedTools overriding a slash-command's frontmatter allowed-tools (deny beats allow in Claude Code's permission model; gha's own comments already assert "disallowed beats the action's generated allow-list"). It can only be confirmed on a live review run after @v2 slides -- per this repo's "a PR fixing the review workflow can't self-verify before merge" gap.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Code review

Reviewed the fix for the duplicate-review-comment bug (#381): denying Bash(gh pr comment:*) in run-claude-review-attempt's --disallowedTools, rewording the prompt to have the agent output rather than post its review, and widening the prior-context/collapse steps in claude-code-review.yml to match github-actions[bot] (agent mode's actual poster) alongside claude[bot] (tag mode's tracking-comment poster).

Verified:

• The root-cause claim checks out: fetched plugins/code-review/commands/code-review.md from anthropics/claude-code directly, and its frontmatter does list Bash(gh pr comment:*) in allowed-tools — confirming the plugin really does re-grant the tool the composite's allowlist omission was assumed to block.
• The collapse-step widening fixes a real latent bug, not just tidies wording: before this PR, that step filtered on claude[bot] only, but agent-mode review/cost comments (the only kind this repo's dogfooded track-progress: false setup ever produces) are posted as github-actions[bot] — so the collapse step's author filter never matched anything in practice, and older review/cost comments never folded. The new comment explaining this (claude-code-review.yml:896-904) is accurate.
• check-review-execution.sh's edits are prose-only (no logic changes) — correctly so, since its existing verdict-extraction logic already works off assistant text / inline-comment tool_use / the denials-gated Bash fallback, none of which needed to change now that the Bash branch will just never fire.
• YAML in both modified workflow/action files parses cleanly (yaml.safe_load).
• The one explicitly-flagged unknown — whether --disallowedTools really overrides a slash-command's own frontmatter allowed-tools — is honestly caveated in the PR description as unverifiable before @v2 slides (per this repo's own "can't self-verify" pattern for PRs that fix the review workflow itself). That's the right call, not a gap to hold up merge over.

Findings (both minor, posted inline):

• changelog.d/fix-duplicate-review-comments.fixed.md:8 and .github/actions/run-claude-review-attempt/action.yml:191 — the same sentence ("...never issues the command there is nothing to republish") is missing a conjunction in both places, reading as a run-on. Suggested fixes posted inline.

Not flagged (judged non-blocking): the job-level comment at claude-code-review.yml:177 ("Fetch the last few claude[bot] review comments...") and the step name at claude-code-review.yml:255 ("Fetch prior claude[bot] review comments") are now slightly stale given the step itself matches both bots — but this is cosmetic naming drift, not a functional or documentation-accuracy problem worth a blocking comment.

No bugs, no CLAUDE.md violations, no hallucinated APIs/symbols found. The GitHub Actions permission precedence claims that are checkable were checkable, and the one that isn't is disclosed as such.

Verdict

Ready for merge (once the two inline grammar nits are optionally addressed — neither is blocking).

[github-actions]

Claude finished review — View run

---

Review posted. Summary:

Findings: two minor grammar nits (identical missing-conjunction run-on sentence) posted inline at changelog.d/fix-duplicate-review-comments.fixed.md:8 and .github/actions/run-claude-review-attempt/action.yml:191, each with a committable suggestion.

Verification performed:

• Confirmed against upstream anthropics/claude-code's actual code-review plugin frontmatter that Bash(gh pr comment:*) really is re-granted there, validating the PR's stated root cause.
• Traced through claude-code-review.yml's comment-fetch/collapse logic and confirmed the github-actions[bot]/claude[bot] author-widening fixes a real latent bug (the collapse step previously matched nothing in agent mode, since agent-mode comments post as github-actions[bot], not claude[bot]).
• Confirmed check-review-execution.sh's changes are prose-only, consistent with its logic not needing to change.
• YAML-parsed both modified workflow/action files cleanly.
• The one unverifiable claim (--disallowedTools overriding a plugin command's frontmatter allowed-tools) is honestly disclosed by the PR author as unconfirmable pre-merge, consistent with this repo's documented "can't self-verify" pattern.

Verdict

Ready for merge — no bugs or CLAUDE.md violations found; only two non-blocking grammar polish suggestions.

[github-actions]

💰 Cost: $2.7132 (review) — run

[d-morrison]

Live verification (agent mode, real review) ✅

The one claim the round-1 review flagged as unverifiable pre-merge -- that --disallowedTools overrides the code-review plugin command's frontmatter allowed-tools grant of gh pr comment -- has now been confirmed on a live agent-mode review, along with the fetch/collapse changes.

Setup: a throwaway dispatch-only caller pointed at this branch (@test-live-fix, with the composite's internal ref bumped so the run actually used this PR's run-claude-review-attempt) reviewed a throwaway PR in Morrison-Lab/rpt twice, in agent mode (workflow_dispatch forces it). Both the caller and all test artifacts have since been removed.

Results:

Check	Result
Duplicate comment	Gone -- each round posted exactly one review comment (github-actions[bot]) + one cost comment; zero claude[bot] self-post
Deny effective	Yes -- the agent could not self-post, confirming deny beats the plugin's frontmatter allow
Kept comment content	Full review with ### Verdict (not a thin recap) -- the prompt reword makes the agent output its review as text, which the workflow posts
Collapse fix	Works -- round 1's review + cost comments folded as OUTDATED when round 2 landed; the unrelated older comment (different workflow) was left alone
Prior-review fetch	Works -- round 2 fetched and cited round 1's github-actions[bot] verdict by URL

Runs (rpt): round 1, round 2. (A first attempt surfaced that rpt's CLAUDE_CODE_OAUTH_TOKEN had expired -- unrelated to this PR, filed as Morrison-Lab/rpt#180 and since refreshed.)

Since this workflow can't self-verify on its own PR (the @v2 self-review gap -- visible right here, where gha's own review of this PR duplicated), this rpt run is the pre-slide confirmation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.