ci: post reviews to the PR + drop debug log flag (#6)

* ci: let review agent read the plugin cache (fixes code-review skill)

The requesting-code-review skill reads code-reviewer.md from the plugin
cache (~/.claude/plugins), which claude-code-action's repo-only sandbox
blocks. Grant read access via project settings (settingSources: project),
loaded without touching the workflow file. Track the shared settings file
via a .gitignore negation instead of force-add.

Verified: review ran full (21 turns, is_error:false) on this branch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: allow the agent App bot to trigger PR review

Agents push feature branches as claude-agent-ahrzb (App identity), which
claude-code-action blocks by default. Scope allowed_bots to that bot only
(not '*') so only our agents' pushes trigger a review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: drop show_full_output debug flag from review workflow

Public repo — show_full_output publishes the review agent's full transcript
to public Actions logs. It was a temporary capture flag; remove it so the
merge to master also clears it there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: post the review to the PR (track_progress + sticky comment)

The review agent produced its findings as final text but never called a
GitHub comment tool, and every auto-post flag was off, so nothing landed on
the PR. track_progress posts the report as a tracking comment;
use_sticky_comment keeps it to one comment per PR across pushes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: actually post the review — grant comment tools + instruct posting

track_progress alone was not enough. Per Anthropic's canonical
pr-review-comprehensive.yml example, the agent needs the comment tools
granted in --allowedTools (mcp__github_inline_comment + gh pr comment) and
an explicit instruction to post; otherwise it reviews and exits without
writing anything to the PR. Drop use_sticky_comment (not in the recipe).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: ahrzb

.github/workflows/claude-review.yml

@@ -28,13 +28,23 @@ jobs:
           allowed_bots: claude-agent-ahrzb # agents push feature branches as this App bot
           plugin_marketplaces: https://github.com/anthropics/claude-plugins-official.git
           plugins: superpowers@claude-plugins-official
-          claude_args: --model claude-sonnet-5 --max-turns 20
-          show_full_output: true
+          # Grant the comment tools — without these the agent has no way to
+          # write anything back to the PR (this was the "nothing gets posted" bug).
+          claude_args: >-
+            --model claude-sonnet-5 --max-turns 30
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+          track_progress: true # tracking comment + PR context
           prompt: |
-            Review this pull request.
+            Review this pull request. Use the superpowers:requesting-code-review
+            skill for the review methodology, diffing the PR branch against
+            ${{ github.event.pull_request.base.ref }}.
 
-            Use the superpowers:requesting-code-review skill and follow it exactly.
-            Diff the PR branch against ${{ github.event.pull_request.base.ref }}.
+            Then POST the review to GitHub — a review that isn't posted is useless:
+            - inline comments (mcp__github_inline_comment__create_inline_comment)
+              for specific, line-level issues
+            - one top-level PR comment (`gh pr comment`) for the overall summary
+              and assessment
 
             Report only what you verified in the diff. No speculative findings, no
-            style nits. If nothing needs changing, say so in one line.
+            style nits. If nothing needs changing, post a one-line top-level
+            comment saying so.