post-review.sh fails with 422 when REVIEW_TOKEN undefined after PR #2389

[rh-hemartin]

What happens

Review agent runs complete successfully, but post-review.sh fails to submit the formal GitHub review with:

Error: submitting review: create pull request review on #NNNN: github api: 422 Unprocessable Entity

This occurs when the PR author matches the GitHub Actions workflow identity. The agent completes all analysis, posts/updates comments, and minimizes stale reviews, but fails at final review submission.

Example failures across 9 days:

• 28184753135 on PR feat(sandbox): adopt provider-backed policy composition #2671 (2026-06-25)
• 28299596021 on PR feat(#2722): add reader role for self-minting tokens during harness loading #2725 (2026-06-27)
• 28395238316 on PR refactor(harness): migrate retro agent to env.runner/env.sandbox (ADR 0055) #2761 (2026-06-29)
• 28481899040 on PR fix(#2805): resolve relative resources for URL-sourced config agents #2807 (2026-06-30)
• 28650449435 on PR refactor(dispatch): inline stage workflows to fix version skew #2919 (2026-07-03)

Root cause

PR #2389 moved token minting from workflows into the fullsend binary for sandbox use, removing REVIEW_TOKEN and REVIEW_GH_TOKEN from reusable-review.yml. However, post-review.sh still expects REVIEW_TOKEN:

# internal/scaffold/fullsend-repo/scripts/post-review.sh:21
: "${REVIEW_TOKEN:?REVIEW_TOKEN is required}"

When REVIEW_TOKEN is undefined, fullsend post-review falls back to GITHUB_TOKEN (default Actions token):

// internal/cli/postreview.go:65-66
if token == "" {
    token = os.Getenv("GITHUB_TOKEN")
}

GitHub's default GITHUB_TOKEN is scoped to the workflow initiator. When the PR author matches the workflow identity, GitHub API rejects the review submission with 422 (authors cannot review their own PRs).

What should happen

post-review.sh should use a minted token with pull-requests:write permission, not the default GITHUB_TOKEN. The token minting added in PR #2389 for sandbox use needs to extend to post-script forge operations.

Context

• Started immediately after PR feat(cli): mint agent tokens in the binary instead of workflows #2389 merged on 2026-06-24
• Affects runs where workflow identity = PR author (common in per-repo installs)
• Agent work completes; only final API review submission fails
• Related: Status comment uses minted agent token and fails to update when token expires #2130 (status comment token expiry), Post-review script should handle 422 on APPROVE submission gracefully #1589 (422 handling for other cases)

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 1:17 PM UTC · Completed 1:21 PM UTC
Commit: 0a95cac · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: High — review agent runs silently fail to post formal reviews when the PR author matches the workflow identity. This has been recurring since 2026-06-24.

Problem: PR #2389 moved token minting into the fullsend binary but left a gap in how REVIEW_TOKEN reaches post-review.sh. When mintAgentToken() does not mint (no --mint-url or minting failure), the harness passes an empty REVIEW_TOKEN to the runner. The post-script either fails on its required-var check or the Go CLI falls back to GITHUB_TOKEN, which GitHub rejects with 422 because the default Actions token cannot review PRs authored by the same identity.

Root cause: internal/cli/run.go only sets REVIEW_TOKEN when minting succeeds. internal/cli/postreview.go:65-66 falls back to GITHUB_TOKEN, which is scoped to the workflow initiator.

Recommended fix:

1. Ensure mintAgentToken() reliably mints and propagates REVIEW_TOKEN for the review role
2. Update postreview.go fallback logic to prefer a minted token over GITHUB_TOKEN
3. Make post-review.sh fail with a clear diagnostic message rather than hitting the 422

Proposed test case:

// run_test.go: verify REVIEW_TOKEN is set in env after mintAgentToken for review role
func TestMintAgentToken_ReviewRole_SetsReviewToken(t *testing.T) {
    // Configure mock mint server, call mintAgentToken with role="review"
    // Assert os.Getenv("REVIEW_TOKEN") == minted token value
}

// post-review-test.sh: verify graceful failure when no valid token
// Set REVIEW_TOKEN="" and GITHUB_TOKEN to a self-authored-PR scenario
// Assert script exits with descriptive error before API call

---

Labels: Review agent post-script bug involving token minting regression, high severity due to 9-day recurring failures.

[fullsend-ai-coder]

🤖 Finished Code · ❌ Failure · Started 1:22 PM UTC · Completed 1:41 PM UTC
Commit: 0a95cac · View workflow run →