Skip to content

Add GitHub Actions workflow for PR comments#3

Merged
willymwai merged 1 commit into
devfrom
main
May 11, 2026
Merged

Add GitHub Actions workflow for PR comments#3
willymwai merged 1 commit into
devfrom
main

Conversation

@willymwai
Copy link
Copy Markdown
Member

This workflow automates commenting on pull requests to trigger bot reviews when a PR is opened or updated.

This workflow automates commenting on pull requests to trigger bot reviews when a PR is opened or updated.
@willymwai willymwai merged commit a108533 into dev May 11, 2026
3 checks passed
@qodo-code-review
Copy link
Copy Markdown

Review Summary by Qodo

Add GitHub Actions workflow for automated PR bot reviews

✨ Enhancement

Grey Divider

Walkthroughs

Description
• Adds GitHub Actions workflow automating bot review triggers
• Posts /agentic_describe and /agentic_review comments on PR creation
• Posts /agentic_review comment on PR updates to main branch
• Uses secure bot token for authenticated comment creation
Diagram
flowchart LR
  PR["Pull Request Event"]
  OPENED["PR Opened"]
  SYNC["PR Synchronized"]
  DESC["Post /agentic_describe"]
  REV["Post /agentic_review"]
  BOT["Bot Review Triggered"]
  
  PR -->|opened event| OPENED
  PR -->|synchronize event| SYNC
  OPENED --> DESC
  OPENED --> REV
  SYNC --> REV
  DESC --> BOT
  REV --> BOT
Loading

Grey Divider

File Changes

1. .github/workflows/pr-comment.yml ✨ Enhancement +53/-0

GitHub Actions workflow for automated bot review comments

• Creates new GitHub Actions workflow triggered on PR open and update events
• Defines trigger-bot-review job running on ubuntu-latest with 5-minute timeout
• Uses actions/github-script@v7 to post bot review trigger comments via GitHub API
• Posts /agentic_describe and /agentic_review on PR creation, /agentic_review on updates
• Implements error tolerance with continue-on-error: true for robustness

.github/workflows/pr-comment.yml


Grey Divider

Qodo Logo

@qodo-code-review
Copy link
Copy Markdown

qodo-code-review Bot commented May 11, 2026

Code Review by Qodo

🐞 Bugs (5) 📘 Rule violations (0)

Grey Divider


Action required

1. Unawaited comment API calls 🐞 Bug ≡ Correctness
Description
The github-script steps call github.rest.issues.createComment(...) without awaiting the returned
Promise, so the step can finish before the HTTP requests complete and comments may not be created
reliably. This breaks the core purpose of the workflow (posting the trigger commands).
Code

.github/workflows/pr-comment.yml[R26-35]

+          script: |
+            const comments = ['/agentic_describe', '/agentic_review'];
+            for (const comment of comments) {
+            github.rest.issues.createComment({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            issue_number: context.issue.number,
+            body: comment
+            });
+            }
Evidence
In both the PR-open and synchronize scripts, createComment is invoked inside a loop without
await/Promise handling; since github-script runs a Node script that completes when the script
finishes, the workflow can exit before requests resolve.

.github/workflows/pr-comment.yml[26-35]
.github/workflows/pr-comment.yml[44-53]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow fires `github.rest.issues.createComment(...)` calls without awaiting them, which can cause the step to complete before the GitHub API requests finish.

### Issue Context
This workflow’s primary function is to reliably post PR comments (`/agentic_describe`, `/agentic_review`). Non-awaited promises can lead to missing comments.

### Fix Focus Areas
- .github/workflows/pr-comment.yml[26-35]
- .github/workflows/pr-comment.yml[44-53]

### Suggested change
Use `await` inside the loop (or `await Promise.all(...)`). Example:
```js
const comments = ['/agentic_describe', '/agentic_review'];
for (const body of comments) {
 await github.rest.issues.createComment({
   owner: context.repo.owner,
   repo: context.repo.repo,
   issue_number: context.issue.number,
   body,
 });
}
```

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


2. Errors are silently ignored 🐞 Bug ☼ Reliability
Description
Both comment steps use continue-on-error: true, so authentication/permission/API failures won’t fail
the job and the workflow can appear successful while posting no trigger comment. This makes the
automation unreliable and hard to debug.
Code

.github/workflows/pr-comment.yml[R21-23]

+        uses: actions/github-script@v7
+        continue-on-error: true
+        timeout-minutes: 5
Evidence
The workflow explicitly suppresses failures for the github-script steps, so even if the API call
errors (bad token, rate limiting, permission issues), the job continues without surfacing failure as
a failing check.

.github/workflows/pr-comment.yml[19-24]
.github/workflows/pr-comment.yml[37-42]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow suppresses failures when creating PR comments, which can hide breakages in the bot-trigger mechanism.

### Issue Context
If the token is invalid/missing or the API call fails, the workflow should fail (or at least emit explicit errors) so maintainers can diagnose why bot review wasn’t triggered.

### Fix Focus Areas
- .github/workflows/pr-comment.yml[19-24]
- .github/workflows/pr-comment.yml[37-42]

### Suggested change
Remove `continue-on-error: true` (or replace with explicit try/catch + `core.setFailed(...)` after logging).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

3. Outdated/unpinned actions 🐞 Bug ⛨ Security
Description
The workflow uses actions/checkout@v2 and mutable action tags (e.g., actions/github-script@v7),
which is inconsistent with the repo’s CI workflow and increases supply-chain/upgrade risk. Aligning
to the same major versions and optionally pinning to SHAs improves reproducibility and security
posture.
Code

.github/workflows/pr-comment.yml[R14-21]

+    env:
+      GITHUB_TOKEN: ${{ secrets.BOT_REVIEW_COMMENT_ACCESS_TOKEN }}
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Add comment on PR creation to trigger bot review
+        if: github.event.action == 'opened' && github.base_ref == 'main'
+        uses: actions/github-script@v7
Evidence
pr-comment.yml uses checkout v2, while the existing CI workflow uses checkout v4; this inconsistency
makes workflows harder to maintain and standardize across the repo.

.github/workflows/pr-comment.yml[14-21]
.github/workflows/ci.yml[17-20]
Best Practice: GitHub Actions security hardening guidance

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow uses `actions/checkout@v2` and unpinned action tags. This is inconsistent with the repo and reduces reproducibility.

### Issue Context
The repo already uses `actions/checkout@v4` in CI.

### Fix Focus Areas
- .github/workflows/pr-comment.yml[14-21]
- .github/workflows/ci.yml[17-20]

### Suggested change
- Update to `actions/checkout@v4`.
- Consider pinning `actions/checkout` and `actions/github-script` to commit SHAs for tighter supply-chain control.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


4. Duplicate comments on updates 🐞 Bug ⚙ Maintainability
Description
On every synchronize event, the workflow always creates a new “/agentic_review” comment, which can
clutter PR discussions and repeatedly trigger downstream automation. If repeated triggers aren’t
required, this should deduplicate or update an existing comment instead.
Code

.github/workflows/pr-comment.yml[R37-53]

+      - name: Add comment on PR update
+        if: github.event.action == 'synchronize' && github.base_ref == 'main'
+        uses: actions/github-script@v7
+        continue-on-error: true
+        timeout-minutes: 5
+        with:
+          github-token: ${{ env.GITHUB_TOKEN }}
+          script: |
+            const comments = ['/agentic_review'];
+            for (const comment of comments) {
+            github.rest.issues.createComment({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            issue_number: context.issue.number,
+            body: comment
+            });
+            }
Evidence
The workflow triggers on pull_request synchronize and unconditionally calls issues.createComment
with a fixed body, meaning every push to the PR will add another identical trigger comment.

.github/workflows/pr-comment.yml[3-8]
.github/workflows/pr-comment.yml[37-53]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Each PR update (`synchronize`) adds a new identical trigger comment.

### Issue Context
If the bot only needs a single trigger comment, repeated comments create noise and may cause redundant bot work.

### Fix Focus Areas
- .github/workflows/pr-comment.yml[37-53]

### Suggested change
Option A: Before commenting, list recent comments and only post if a matching trigger comment is not already present.
Option B: Create one comment on open and on synchronize only re-trigger via a different mechanism (e.g., edit the existing comment, or use a less noisy signal if your bot supports it).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Advisory comments

5. Unnecessary repository checkout 🐞 Bug ➹ Performance
Description
The job checks out the repository but never uses the working tree, which adds runtime and expands
the action surface area unnecessarily. This is avoidable because commenting via GitHub API doesn’t
require the repo contents.
Code

.github/workflows/pr-comment.yml[R16-18]

+    steps:
+      - uses: actions/checkout@v2
+
Evidence
After checkout, the job only runs actions/github-script to call the GitHub API; there are no steps
that read files, run scripts, or otherwise require the checked-out code.

.github/workflows/pr-comment.yml[16-53]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow checks out the repo even though the job only posts PR comments.

### Issue Context
Removing checkout reduces execution time and avoids pulling untrusted PR code when it isn’t needed.

### Fix Focus Areas
- .github/workflows/pr-comment.yml[16-18]

### Suggested change
Delete the `actions/checkout` step unless a later step truly needs the repository contents.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Qodo Logo

Comment on lines +26 to +35
script: |
const comments = ['/agentic_describe', '/agentic_review'];
for (const comment of comments) {
github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
body: comment
});
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Unawaited comment api calls 🐞 Bug ≡ Correctness

The github-script steps call github.rest.issues.createComment(...) without awaiting the returned
Promise, so the step can finish before the HTTP requests complete and comments may not be created
reliably. This breaks the core purpose of the workflow (posting the trigger commands).
Agent Prompt
### Issue description
The workflow fires `github.rest.issues.createComment(...)` calls without awaiting them, which can cause the step to complete before the GitHub API requests finish.

### Issue Context
This workflow’s primary function is to reliably post PR comments (`/agentic_describe`, `/agentic_review`). Non-awaited promises can lead to missing comments.

### Fix Focus Areas
- .github/workflows/pr-comment.yml[26-35]
- .github/workflows/pr-comment.yml[44-53]

### Suggested change
Use `await` inside the loop (or `await Promise.all(...)`). Example:
```js
const comments = ['/agentic_describe', '/agentic_review'];
for (const body of comments) {
  await github.rest.issues.createComment({
    owner: context.repo.owner,
    repo: context.repo.repo,
    issue_number: context.issue.number,
    body,
  });
}
```

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Comment on lines +21 to +23
uses: actions/github-script@v7
continue-on-error: true
timeout-minutes: 5
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. Errors are silently ignored 🐞 Bug ☼ Reliability

Both comment steps use continue-on-error: true, so authentication/permission/API failures won’t fail
the job and the workflow can appear successful while posting no trigger comment. This makes the
automation unreliable and hard to debug.
Agent Prompt
### Issue description
The workflow suppresses failures when creating PR comments, which can hide breakages in the bot-trigger mechanism.

### Issue Context
If the token is invalid/missing or the API call fails, the workflow should fail (or at least emit explicit errors) so maintainers can diagnose why bot review wasn’t triggered.

### Fix Focus Areas
- .github/workflows/pr-comment.yml[19-24]
- .github/workflows/pr-comment.yml[37-42]

### Suggested change
Remove `continue-on-error: true` (or replace with explicit try/catch + `core.setFailed(...)` after logging).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant