[DEVEX-1523] Fix AI reviewer to explicitly submit gh pr review

[ronneseth]

Summary

• Claude was completing its review as text-only output without calling gh pr review, so no approval was submitted
• Updated prompt with explicit step-by-step instructions to run gh pr diff then gh pr review --approve or --comment
• Added show_full_output: true for pilot-phase debugging visibility
• Added PR number and repo context variables to the prompt

JIRA: DEVEX-1523

Made with Cursor

[cursor]

PR Summary

Low Risk
Low risk workflow-only change; main impact is altering the AI reviewer’s behavior/output and increasing log verbosity via show_full_output: true.

Overview
Tightens the claude-review workflow so the AI reviewer must fetch the PR diff via gh pr diff and then submit a formal GitHub review using gh pr review --approve or --comment (instead of text-only output).

Also adds REPO/PR NUMBER context into the prompt and enables show_full_output: true to increase debugging visibility.

^{Reviewed by Cursor Bugbot for commit a123a62. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a123a62. Configure here.}

[cursor]

Debugging flag exposes secrets in shared workflow logs

High Severity

show_full_output: true is enabled in a reusable workflow_call workflow shared across repositories. Per the claude-code-action docs, this flag outputs ALL Claude messages including tool execution results, which may contain secrets, API keys, or other sensitive information — and these logs are publicly visible in GitHub Actions. The PR description calls this a "pilot-phase debugging" addition, suggesting it's temporary, but it's being committed to a shared workflow consumed by many repos.

 

^{Reviewed by Cursor Bugbot for commit a123a62. Configure here.}