fix(code-review): dedup prior comments and raise max-turns to 256

[lishuceo]

Summary

• Stop duplicate review comments across pushes. Add a Step 1 to the prompt that pulls prior claude[bot] inline comments, checks each against the current source, replies (✅ Fixed / still present / partially fixed) and resolves the threads that are fixed — instead of re-opening the same finding every push.
• Raise --max-turns from 30 to 256. Observed on taptap/maker#439: non-trivial PRs hit error_max_turns after ~4 min and aborted before any comment was posted. 30 was a hard cap, not a budget — small PRs still use few turns.
• Tighten the prompt: confidence ≥ 75 threshold and an explicit false-positive filter list, modeled on the working pattern from taptap/UrhoX/.github/workflows/pr-review.yml (org-generic parts only — no language-specific checks).
• Expand allowedTools: add Bash(gh api:*) and Bash(gh pr comment:*) because the dedup logic needs gh api for the comments endpoint and the GraphQL resolveReviewThread mutation.

Why org-wide and not per-repo

The reusable workflow exposes only pr_number / is_draft / head_repo_full_name as inputs, so consumers (e.g. maker/.github/workflows/code-review.yml) cannot override the prompt or args today. All four changes here are bug fixes / generic quality improvements — no language- or project-specific content was copied from UrhoX. If a repo later wants specialization, the right move is to add a extra_prompt / max_turns input to this workflow, not to fork it.

Test plan

• Open a PR in a consumer repo (e.g. taptap/maker) and verify the Code Review job reaches the Claude step and posts inline comments.
• Push a follow-up commit that fixes one of the reported issues; confirm Claude replies "✅ Fixed" and resolves that thread instead of opening a new comment.
• Push a follow-up commit that does NOT fix a reported issue; confirm Claude replies "still unresolved" and does NOT re-open the same finding.
• Confirm a large PR no longer aborts with error_max_turns.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

此 PR 通过在 prompt 中添加 Step 1（获取旧 inline comment → 判断是否已修复 → 回复并 resolve thread）来解决跨 push 重复评论的问题，同时将 --max-turns 从 30 提升至 256 以修复大型 PR 被截断的问题，并收窄了 allowedTools 中的 gh api 权限范围。整体方向正确，之前已有评论覆盖了 bot 用户名硬编码（claude[bot] 实际 slug 待确认）和工具权限范围等核心问题。

需关注：Step 1 对每个历史 comment 均需独立执行文件读取 + API 调用，在有多轮历史的 PR 上会消耗显著的时间和 turns；现有 timeout-minutes: 15 未随 --max-turns 一同上调，对历史评论较多的 PR 存在超时风险，建议考虑调整为 30–45 分钟。

Confidence Score: 4/5

可以合并，但建议在合并后确认实际 bot 用户名并评估 timeout-minutes 是否充足。

P1 级别的 bot 用户名问题已在之前评论中指出（未修复会导致去重逻辑静默失效），本轮新发现为 P2 级分页截断和超时风险，不阻断合并但应跟进。

.github/workflows/code-review.yml：Step 1 去重逻辑（bot 用户名、reviewThreads 分页、timeout 交互）需重点关注。

Important Files Changed

Filename	Overview
.github/workflows/code-review.yml	新增 Step 1 去重逻辑（获取旧 comment、检查是否 fixed、解析 thread）、将 --max-turns 从 30 提升至 256、扩展 allowedTools，并收紧提示词。主要风险：reviewThreads(first:100) 分页截断、timeout-minutes: 15 与新增 Step 1 开销的交互，以及之前已标注的 bot 用户名硬编码问题。

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant Claude as Claude (Opus)
    participant API as GitHub REST API
    participant GQL as GitHub GraphQL API

    GH->>Claude: 触发 code-review job（PR push）

    Note over Claude: Step 1: 去重旧评论
    Claude->>API: GET /pulls/{pr}/comments (filter: claude[bot])
    API-->>Claude: 旧 inline comments 列表

    Claude->>GH: gh pr diff {pr}
    GH-->>Claude: 当前 diff

    loop 每条旧 comment
        Claude->>GH: Read 当前文件内容
        GH-->>Claude: 文件内容
        alt 已修复
            Claude->>API: POST /comments/{id}/replies (✅ Fixed)
            Claude->>GQL: resolveReviewThread(threadId)
        else 未修复
            Claude->>API: POST /comments/{id}/replies (still present)
        end
    end

    Note over Claude: Step 2: 审查新变更
    Claude->>GH: 读取完整文件 / git blame / git log
    GH-->>Claude: 文件内容 & 历史

    Note over Claude: Step 3: 输出结果
    Claude->>API: mcp__github_inline_comment (新发现 ≤10)
    Claude->>GH: gh pr comment --body "…摘要…"

Loading

_{Reviews (2): Last reviewed commit: "fix(code-review): address greptile feedb..." | Re-trigger Greptile}

[greptile-apps]

Bot 用户名 claude[bot] 需确认

select(.user.login == "claude[bot]") 使用了硬编码的 bot 用户名。GitHub Apps 的 bot 登录名格式为 <app-slug>[bot]，具体取决于 Anthropic 注册 GitHub App 时使用的 slug（可能是 claude-code[bot]、anthropic-claude[bot] 等）。如果名称不匹配，Step 1 的去重逻辑会静默失效——jq 返回空数组，Claude 跳过所有去重工作，每次 push 仍然重复上报相同问题，与本 PR 目标背道而驰。

建议先在某个 consumer repo 上通过 gh api repos/{owner}/{repo}/pulls/{pr}/comments | jq '.[].user.login' 确认实际 bot 用户名后，再将其固定在此处。

[lishuceo]

回复 greptile 的 review：

P1 — claude[bot] 用户名：已实地验证，无需修改。在 taptap/maker#439 上跑：

$ gh api repos/taptap/maker/pulls/439/comments --jq '[.[] | .user.login] | unique'
["claude[bot]","greptile-apps[bot]","lishuceo"]

bot 登录名就是 claude[bot]。

P2 — Bash(gh api:*) 权限过宽：已采纳，收窄到 Bash(gh api repos/*/pulls/*/comments*) + Bash(gh api graphql*)，对应 Step 1 实际用到的两条路径（PR comments REST + resolveReviewThread GraphQL mutation）。

P3 — Bash(gh pr comment:*) 未使用：反向修复——保留权限，在 prompt 里加 Step 3「发布单条 PR 级汇总评论」（verdict + 新发现列表 + 已解决的旧问题数），对齐 taptap/UrhoX/.github/workflows/pr-review.yml 的现有模式。一行 verdict 比纯 inline 评论更易读。

均见 db1a084。