Add success check-run publishing to reviewer workflows

[Copilot]

Reviewer workflows currently complete with review comments/verdicts but do not always emit a green check when the review outcome is clean. This update wires reviewer flows (including Matt Pocock reviewer) to publish a success check run when no blocking issues are found.

• What changed

  • Added create-check-run to the shared PR review safe-output config (shared/pr-code-review-config.md) so reviewer workflows importing the shared base can emit check runs.
  • Extended shared review guidance to explicitly create one create_check_run with conclusion: "success" when verdict is APPROVE.
  • Updated mattpocock-skills-reviewer.md instructions to require a success check run on approve.
  • Recompiled affected reviewer lock workflows that import the shared review config.

• Scope impact

  • Applies to reviewer workflows built on shared/pr-review-base.md (e.g., code-quality, nitpick, grumpy, triage, security, refiner, Matt Pocock reviewer).
  • Behavior change is limited to approved-review outcomes; no new write surface beyond the configured single check-run budget.

safe-outputs:
  submit-pull-request-review:
    max: 1
  create-check-run:
    max: 1

[Copilot]

Pull request overview

Wires AI reviewer workflows to optionally publish a “success” GitHub check run when the final review verdict is clean, so approved reviews can surface a green check in the PR UI.

Changes:

• Adds create-check-run to the shared PR review safe-outputs configuration and documents intended usage on approve.
• Recompiles multiple reviewer .lock.yml workflows to include create_check_run in safe-output tooling/config and grants checks: write where needed.
• Updates action pin data and the release workflow to use a pinned SHA for docker/metadata-action sourced from @v6.

Show a summary per file

File	Description
pkg/workflow/data/action_pins.json	Adds a pinned entry for docker/metadata-action@v6.
pkg/actionpins/data/action_pins.json	Mirrors the new docker/metadata-action@v6 pin in the actionpins package copy.
.github/aw/actions-lock.json	Updates the repo-level actions lock data with the new docker/metadata-action@v6 pin.
.github/workflows/shared/pr-code-review-config.md	Enables create-check-run safe-output for reviewer bases and adds guidance text.
.github/workflows/security-review.lock.yml	Allows create_check_run safe output and adds checks: write permission.
.github/workflows/release.lock.yml	Switches docker/metadata-action usage to the newly pinned @v6 SHA.
.github/workflows/refiner.lock.yml	Allows create_check_run safe output and adds checks: write permission.
.github/workflows/pr-triage-agent.lock.yml	Allows create_check_run safe output and adds checks: write permission.
.github/workflows/pr-nitpick-reviewer.lock.yml	Allows create_check_run safe output and adds checks: write permission.
.github/workflows/pr-code-quality-reviewer.lock.yml	Allows create_check_run safe output and adds checks: write permission.
.github/workflows/mattpocock-skills-reviewer.md	Updates reviewer instructions to require a success check run on approve.
.github/workflows/mattpocock-skills-reviewer.lock.yml	Allows create_check_run safe output and adds checks: write permission.
.github/workflows/grumpy-reviewer.lock.yml	Allows create_check_run safe output and adds checks: write permission.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

.github/workflows/shared/pr-code-review-config.md:37

• In this document the safe-output identifiers are listed with hyphens (e.g. create-pull-request-review-comment, submit-pull-request-review), but this new entry uses the underscore tool name create_check_run. Please make the naming consistent (either document the hyphenated safe-output key create-check-run or switch all entries to underscore tool names). Also, create_check_run requires both title and summary fields (per pkg/workflow/js/safe_outputs_tools.json), so the guidance should mention providing a title as well as a summary.

- `create-pull-request-review-comment` — Post inline comments on specific lines
- `submit-pull-request-review` — Submit the overall review (APPROVE / REQUEST_CHANGES / COMMENT)
- `create_check_run` — When the final verdict is `APPROVE`, create one check run with `conclusion: "success"` summarizing that no blocking issues were found

• Files reviewed: 13/13 changed files
• Comments generated: 2