fix(commands): reply instead of declining a command in silence

[devops-thiago]

What type of PR is this?

• 🐛 Bug fix

Description

Every recognized comment command is acknowledged with a 👀 reaction before it runs, so any
handler that returns without posting leaves the commenter looking at an acknowledged command that
produced nothing — which reads as a hang, not as a decision.

/summary on a PR that already carries a summary did exactly that. The decline was deliberate and
logged (Ignoring /summary — a summary comment is already present on <repo> #<n>) but nothing
reached the PR. It now states the decline and how to get a fresh summary anyway:

📋 A ThrillhouseBot summary is already on this PR, so /summary did nothing. Delete that summary
comment and comment /summary again to regenerate it.

Audit of the same shape. Five other paths acknowledged and then declined in silence; all are
now answered:

Path	Was	Now
/add-docs, /improve, /generate-tests disabled by their kill switch	logged only	notice naming the config key an administrator would flip (thrillhousebot.review.<key>=true)
/describe, /changelog, /generate-tests whose generator returned nothing	nothing posted	notice saying there is no output, and to re-run

Two decisions worth flagging for review:

• The kill-switch check moved to after the authorization check in all three handlers. Posting
  the "disabled" notice before authorizing would let any commenter make the bot speak on a
  repository whose maintainers switched the command off. Behaviour for authorized users is
  unchanged; unauthorized users now cost one permission lookup on a disabled command.
• A command from someone without write access stays silent, logged only. That is the one
  deliberate exception to the new rule, for the same anti-abuse reason, and it is now stated in the
  class contract and pinned by a test.

The generator-returned-nothing notice deliberately names both possible causes ("it found nothing to
suggest, or the generation did not complete"): the generators return null for both, and the
handler has no way to tell them apart, so asserting either one would be a claim this code cannot
support.

Related Issues

Fixes #538

How Has This Been Tested?

• Unit tests

CommentCommandServiceTest — 7 tests written/updated against the unfixed code first. All 7 failed
in exactly the way the issue describes: the command runs, decides, and never posts.

Tests run: 45, Failures: 7, Errors: 0, Skipped: 0
  summaryExplainsItselfWhenSummaryCommentIsLiveOnPr
  describeSaysSoWhenGeneratorReturnsNothing
  changelogSaysSoWhenGeneratorReturnsNothing
  generateTestsSaysSoWhenGeneratorReturnsNothing
  addDocsSaysSoWhenDisabled
  improveSaysSoWhenDisabled
  generateTestsSaysSoWhenDisabled

Verbatim red output for the issue's own case:

dev.thiagogonzaga.thrillhousebot.webhook.CommentCommandServiceTest.summaryExplainsItselfWhenSummaryCommentIsLiveOnPr -- Time elapsed: 0.002 s <<< FAILURE!
Wanted but not invoked:
commentClient.createComment(
    <any>,
    <any>,
    "owner",
    "repo",
    7,
    <Capturing argument: CreateCommentRequest>
);
-> at dev.thiagogonzaga.thrillhousebot.webhook.CommentCommandServiceTest.postedBody(CommentCommandServiceTest.java:115)
Actually, there were zero interactions with this mock.

	at dev.thiagogonzaga.thrillhousebot.webhook.CommentCommandServiceTest.summaryExplainsItselfWhenSummaryCommentIsLiveOnPr(CommentCommandServiceTest.java:168)

Green after the fix: Tests run: 45, Failures: 0, Errors: 0, Skipped: 0.

Gates (Java 25):

• ./mvnw -B clean compile spotbugs:check spotless:check → BugInstance size is 0, BUILD SUCCESS
• ./mvnw -B clean test → Tests run: 2595, Failures: 0, Errors: 0, Skipped: 0
• Coverage ∩ git diff -U0 abd76e5...HEAD on changed main code → 17 executable changed lines,
  17 fully covered, 0 uncovered lines and 0 uncovered branches

Checklist

• My code follows the project's coding standards
• I have performed a self-review of my own code
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly
• My changes generate no new warnings or errors

Additional Notes

/add-docs and /improve already post their own outcome from DocGenerationService /
PrImprovementService, so they need no reply here beyond the kill-switch case. No behaviour change
for any command that was already producing output.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[thrillhousebot]

🤖 ThrillhouseBot PR Summary

What this PR does

Recognized slash-commands now produce a visible reply instead of silently declining: /summary says a summary already exists, disabled commands name the config key to re-enable, and null generator output gets a no-output notice. The kill-switch check is moved after the authorization check so only authorized users can trigger the disabled-command notice.

Control-Flow Diagram

🔀 Show diagram

flowchart TD
  A["Webhook: recognized command + 👀 ack"] --> B{"Authorized?"}
  B -- "No" --> C["Log only; no reply"]
  B -- "Yes" --> D{"Command disabled?"}
  D -- "Yes" --> E["Post disabled notice naming config key"]
  D -- "No" --> F["Run command handler"]
  F --> G{"Summary already live?"}
  G -- "Yes" --> H["Post summary-already-present notice"]
  G -- "No" --> I["Dispatch summary review"]
  F --> J{"Generator returned null?"}
  J -- "Yes" --> K["Post no-output notice"]
  J -- "No" --> L["Post generated output"]

Loading

Changes Overview

• Files changed: 2
• Lines added: +106
• Lines removed: -41

Changed Files

File	Change	Summary
src/main/java/dev/thiagogonzaga/thrillhousebot/webhook/CommentCommandService.java	Modified	Adds visible PR replies for live-summary declines, disabled commands, and null generator output; reorders auth before kill-switch checks.
src/test/java/dev/thiagogonzaga/thrillhousebot/webhook/CommentCommandServiceTest.java	Modified	Updates unit tests to assert posted notices for summary, disabled, and no-output paths, plus silence for disabled-and-unauthorized.

Risk Assessment

Risk	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🔵 Low	0

No new issues found in this PR, but the review cannot be approved until CI is confirmed green.

⚠️ CI Checks Status

Some checks are still pending or have failed:

Check	Type	Status	Detail
trivy	check-run	⏳ Pending	-
frontend	check-run	⏳ Pending	-
test	check-run	⏳ Pending	-
format	check-run	⏳ Pending	-
changes	check-run	⏳ Pending	-
actionlint	check-run	⏳ Pending	-
dependency-review	check-run	⏳ Pending	-

---

Automated review by ThrillhouseBot. Reply with /review to re-run.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud