[deep-report] Prevent silent 422 in safe-output PR review submission (11 silent failures in 24h)

[github-actions]

Problem

The safe-output handler silently swallows PR-review submission failures. Over a 24h window (2026-05-16 → 2026-05-17) there were 11 occurrences in Test Quality Sentinel (10) and Matt Pocock Skills Reviewer (1). The workflow run is marked success in the UI even though no review was posted on the PR.

Sub-pattern A (10 cases) — empty review

The agent calls submit_pull_request_review with no body and zero inline comments. The handler still POSTs:

POST /repos/github/gh-aw/pulls/{n}/reviews — event=COMMENT, comments=0, bodyLength=0

GitHub returns 422 Unprocessable Entity: "".

Log excerpt from run §25963330141:

##[error]Failed to submit PR review: Unprocessable Entity: ""
=== Processing Summary ===
Total messages: 2
Successful: 2     ← misleading
Failed: 0         ← does not reflect the 422

Sub-pattern B (1 case) — paths not in diff

Review comments buffered at file paths/lines that are not part of the PR's diff. GitHub returns 422: "Path could not be resolved".

Fix

1. Pre-check (Sub-pattern A): Before POSTing the aggregated review, validate that body is non-empty OR at least one inline comment exists. If both are empty, skip the POST and record the safe-output as Failed: 1 (or call noop with an explanatory message).
2. Pre-check (Sub-pattern B): Validate that each buffered review comment's path appears in the PR's changed-files list before POSTing.
3. Count 422s as failures: Roll back the per-message success count for submit_pull_request_review and create_pull_request_review_comment when the finalization POST fails. Currently Successful: 2 / Failed: 0 even after a 422.

Evidence

Safe Output Health Report 2026-05-17 (#32768) — Cluster 1, High severity.

Acceptance Criteria

• Empty review submissions are blocked before POST
• 422 responses correctly increment the Failed: counter
• Test Quality Sentinel no longer logs Failed: 0 after a 422
• Test coverage for both empty-review and resolved-path cases

Suggested Agent

Copilot — well-scoped fix in safe-output handler (likely pkg/workflow/safe_output_handlers.go, which had +667 lines in the last 7 days).

Estimated Effort

2–3h

---

Source: DeepReport Intelligence Briefing 2026-05-17 — pulls from Safe Output Health Report (#32768).

Generated by 🔬 DeepReport - Intelligence Gathering Agent · ● 24.9M · ◷

• expires on May 19, 2026, 7:40 PM UTC