docs: restrict PR reviewer workflows to COMMENT-only by default

[Copilot]

GITHUB_TOKEN in GitHub Actions is only permitted to post COMMENT reviews — it cannot APPROVE or REQUEST_CHANGES. The pr-reviewer.md instruction file had no guidance on this, leaving agents free to attempt operations that fail at runtime.

Changes

• .github/aw/pr-reviewer.md: Added "Default Review Event: COMMENT Only" section
  • States the GITHUB_TOKEN constraint explicitly
  • Prescribes allowed-events: [COMMENT] as the default safe-outputs configuration
  • Warns that APPROVE/REQUEST_CHANGES require a PAT or app token with explicit pull-request approval permissions

safe-outputs:
  submit-pull-request-review:
    max: 1
    allowed-events: [COMMENT]

[pelikhan]

@copilot it can request changes but not approve

[Copilot]

Fixed in 2b4bad9 — updated to allowed-events: [COMMENT, REQUEST_CHANGES] and clarified that only APPROVE is blocked by the default GITHUB_TOKEN.

[Copilot]

Pull request overview

Documents safe review events for workflows using the default GITHUB_TOKEN.

Changes:

• Adds review-event guidance and configuration, but incorrectly permits REQUEST_CHANGES.

Show a summary per file

File	Description
.github/aw/pr-reviewer.md	Adds default review-event guidance and example.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (2)

.github/aw/pr-reviewer.md:42

• The example still permits REQUEST_CHANGES, contrary to the documented COMMENT-only default. A workflow copied from this snippet can select an event that the default token cannot submit, so the allowlist must contain only COMMENT.

    allowed-events: [COMMENT, REQUEST_CHANGES]

.github/aw/pr-reviewer.md:45

• The warning only covers APPROVE, leaving readers with the incorrect conclusion that REQUEST_CHANGES works with GITHUB_TOKEN. Include both unsupported events so the guidance is consistent with the COMMENT-only constraint.

Do not instruct the agent to approve a PR unless the workflow uses a PAT or app token with explicit pull-request approval permissions. Using `APPROVE` with the default `GITHUB_TOKEN` will fail at runtime.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Medium

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.83.3