Add configurable PR comment upsert and fix UTF-8 truncation

[dannysteenman]

Summary

CI review comments are always created as new comments. This adds an opt-in ci.upsert_comments setting that finds the existing roborev marker comment and patches it in-place instead.

• Add ci.upsert_comments config (global and per-repo, default false)
• Add FindExistingComment, UpsertPRComment, and CreatePRComment in internal/github
• Fall back to creating a new comment when PATCH returns 403/404 (token mismatch)
• Target the newest marker comment to reduce fallback churn
• Fix UTF-8 truncation: replace utf8.ValidString full-string scan with boundary-only TrimPartialRune
• Propagate caller context through postCIComment for Ctrl+C cancellation

Config

# Global (~/.roborev/config.toml)
[ci]
upsert_comments = true

# Per-repo (.roborev.toml) — overrides global
[ci]
upsert_comments = false

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (07d1117)

Verdict: Refactors PR comment logic to upsert existing comments via a hidden marker, but introduces issues with comment targeting, security
, and GitHub Enterprise compatibility.

🔴 High

Incorrect jq Filter Matches Quoted Replies

• File: internal/github/comment.go:28
• Description: Using contains(%q) in the jq filter will match comments where users have quoted the
  bot's review in a reply (which typically adds > before the text). This will cause the bot to inadvertently overwrite a human user's comment.
• Suggested Fix: Change .body | contains(%q) to .body | startswith(%q) since the marker is always reliably prepended
  to the very beginning of the bot's comment.

🟡 Medium

Security: Vulnerable Comment Selection via Static Marker

• File: internal/github/comment.go:26, internal/github/comment.go:84
• Description: Existing comment selection relies
  solely on a static marker (<!-- roborev-pr-comment -->). In shared repos, any external user who can comment can post that marker, causing UpsertPRComment to target an attacker-controlled/non-bot comment. This can lead to attempted overwrites of the wrong comment or persistent failures to post
  /update roborev output (effectively suppressing CI review visibility).
• Suggested Fix: Match on both the marker and a trusted author identity (bot/app login or user ID). For example, fetch the authenticated actor and filter comments by comment.user.login == botLogin plus the marker. Consider
  adding fallback behavior to create a new bot comment instead of hard-failing if a patch fails.

GitHub Enterprise / Host-Qualified Repo Regression Risk

• File: internal/github/comment.go:34, internal/github/comment.go:97

---

Description:** FindExistingComment/patchComment build API paths with repos/%s/... using ghRepo directly. If ghRepo is host-qualified (e.g. ghe.example.com/org/repo, which gh --repo supports), this becomes an
invalid REST path. createComment still uses --repo, making behavior inconsistent across create vs. find/patch.

• Suggested Fix: Normalize ghRepo to owner/repo for REST path usage and pass the host via --hostname (or equivalent), or consistently use gh repo
  /host flags.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[wesm]

Looking at this. I actually want to see all the review comments from my CI bot rather than updating them. I'm going to take a pass on this and make the upserting behavior configurable rather than the default

[roborev-ci]

roborev: Combined Review (5ec108d)

Verdict: All agents agree the code is clean and no issues were found.

The changes successfully implement opt-in, marker-based PR comment upsert functionality, safe UTF-8 truncation, and relevant configuration/fallback logic without introducing any identified functional or security regressions
.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)