fix(agentic-ci): surface incomplete reviews

[andreatnvidia]

📋 Summary

Increase the Agentic CI PR-review turn budget and make incomplete advisory reviews visible on the PR instead of only in the workflow summary.

🔗 Related Issue

N/A

🔄 Changes

• Raise the Claude review limit from 30 to 50 turns.
• Post a short, best-effort comment linking the workflow run when review generation does not complete.
• Preserve the existing one-time and manual review triggers.

🧪 Testing

• Repository Ruff checks and formatting pass
• Workflow YAML parses successfully
• Pre-commit hooks pass

✅ Checklist

• Follows commit message conventions
• Commits are signed off (DCO)
• Architecture docs updated (N/A - no architecture change)

[greptile-apps]

Greptile Summary

The PR increases the Agentic CI review turn ceiling and makes unsuccessful reviews visible directly on the pull request.

• Raises the Claude review limit from 30 to 50 turns.
• Posts a best-effort PR comment linking to the workflow run when review generation fails or times out.
• Retains the existing success-path review posting behavior.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

Supported triggers produce a validated PR number, the workflow grants the token permission needed to comment, and the new notification remains best-effort without disrupting existing review paths.

Important Files Changed

Filename	Overview
.github/workflows/agentic-ci-pr-review.yml	Increases the review turn budget and adds a correctly permissioned fallback PR notification for incomplete runs.

_{Reviews (1): Last reviewed commit: "fix(agentic-ci): surface incomplete revi..." | Re-trigger Greptile}

[github-actions]

Code Review: PR #887 — fix(agentic-ci): surface incomplete reviews

Summary

This PR makes two focused changes to the Agentic CI PR-review workflow (.github/workflows/agentic-ci-pr-review.yml), the only file touched (+6 / -1):

1. Raises the Claude review turn budget from --max-turns 30 to --max-turns 50.
2. Surfaces incomplete reviews on the PR itself — when the review step does not succeed (failure/timeout), the "Report incomplete review" step now posts a short PR comment linking to the workflow run, in addition to the existing $GITHUB_STEP_SUMMARY note.

The change is small, scoped, and matches the intent described in the PR body. No application code, tests, or docs are affected.

Findings

Correctness

• steps.pr.outputs.number (used for PR_NUMBER) is defined earlier at the id: pr step (lines 114–123) and already consumed by sibling steps, so the reference is valid.
• RUN_URL is composed entirely from trusted GitHub context (github.server_url, github.repository, github.run_id) — no interpolation of attacker-controllable data.
• The gh pr comment ... || echo "::warning::..." fallback correctly prevents a comment-post failure (e.g., transient API error) from failing the step; the step is best-effort, which is appropriate for an advisory flow.
• The gating step condition if: steps.review.outcome != 'success' is sound. Because the review step uses continue-on-error: true, outcome still reflects the true result (failure/timeout → failure), so the report step fires on genuine incompletion. When a run is cancelled by cancel-in-progress concurrency, subsequent steps are skipped, so this won't spam comments on superseded runs.

Observations / minor suggestions (non-blocking)

• Comment noise on repeated triggers. The workflow triggers on opened, ready_for_review, and labeled. A PR that repeatedly fails/times out across multiple triggering events will accumulate multiple "did not complete" comments, since there is no dedup/update-in-place. For an advisory bot this is tolerable, but consider updating a single sticky comment (e.g., a marker + gh pr comment --edit-last or the comment-upsert pattern) if noise becomes a problem.
• Turns vs. time budget. --max-turns was the raised limit, but the step is also wall-clock-bounded by timeout-minutes (gate-resolved, capped at 45 min). Raising turns only helps reviews that hit the turn ceiling before the time ceiling. This matches the PR's stated cause; just flagging that if timeouts (not turn exhaustion) are the real failure mode, this change won't move the needle. No action needed.

Security

• Workflow uses pull_request_target, but is already hardened: a gate job enforces collaborator write/admin permission, and the agent prompt is read from base-agents/ (base branch) rather than the PR head, preventing fork tampering. The new comment body is a static string, and GH_TOKEN is scoped to pull-requests: write. No new attack surface introduced.

Conventions

• New env: keys (GH_TOKEN, PR_NUMBER, RUN_URL) mirror the existing pattern used by other steps in this file. GH_TOKEN: ${{ github.token }} is correctly added since the report step previously did not need repo API access. Consistent with surrounding style.

Testing

• Not automatable in-repo; the PR checklist notes YAML parses and pre-commit passes. The incomplete-review path is only exercised on an actual failed/timed-out run — reasonable for a workflow change of this size.

Verdict

Approve (advisory). This is a clean, low-risk improvement to CI observability. The logic is correct, trusted-input-only, and consistent with the file's conventions. The only follow-up worth considering is de-duplicating incomplete-review comments if they prove noisy in practice — not a blocker for merge.