ci(comment-length-review): committable inline suggestions as workweave-bot

[steventohme]

What

Fixes the advisory comment-length reviewer so it posts actual inline review comments (not one summary dump), authored by workweave-bot.

Why

On main (#592) the reviewer drives inline comments through the action's mcp__github_inline_comment__create_inline_comment tool, but the @beta claude-code-action doesn't expose that tool. At runtime the model reported "inline comment tool unavailable" and fell back to posting every finding in one issue comment (e.g. #644).

Changes

• Committable inline suggestions — post via the working gh api POST .../reviews path. Each comment is a real GitHub ```suggestion block spanning the whole comment block (start_line..line), so the shortened comment is one-click committable.
• workweave-bot authorship — run the gh api call under WEAVE_BOT_TOKEN (PAT) instead of GITHUB_TOKEN, which stamped every comment github-actions[bot].

Still advisory: event=COMMENT, never REQUEST_CHANGES, no required status check registered.

Note

Requires WEAVE_BOT_TOKEN to have pull_requests: write on this repo (fine-grained) or classic repo scope.

🤖 Generated with Claude Code

[greptile-apps]

T-Rex Logs

What T-Rex did

• The PR tool boundary verifier was reproduced, confirming the workflow uses anthropics/claude-code-action@beta with allowed_tools including Bash(gh api:*), reads the PR diff via git diff, and posts a review via gh api, with GH_TOKEN bound to WEAVE_BOT_TOKEN in the step environment and gh installed and available without live GitHub API calls.
• The standalone verification script was executed to validate the comment-length review flow; the run exited with code 0 and PASS results for endpoint, COMMENT event, suggestion block, and required payload fields, and live authorship posting was intentionally not performed in the sandbox.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "ci(comment-length-review): committable i..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 560a255. Configure here.}

[cursor]

Heredoc terminator invalid in example

Medium Severity

The direct_prompt example for posting reviews uses a bash <<'JSON' heredoc whose closing JSON line is indented like the surrounding YAML. Bash only accepts the closing delimiter at the start of the line, so a command copied from that example never ends the heredoc and gh api --input - gets broken or incomplete JSON instead of a review payload.

 

^{Reviewed by Cursor Bugbot for commit 560a255. Configure here.}