fix: reply-to-mention doesn't work for review comments on forks (#196)

derekmisler · web-flow · commit be2371a0a84c · 2026-05-08T10:33:05.000-04:00
Signed-off-by: Derek Misler &lt;derek.misler@docker.com&gt;
diff --git a/.github/workflows/review-pr.yml b/.github/workflows/review-pr.yml
@@ -82,6 +82,10 @@ jobs:
       pr-head-sha: ${{ steps.read.outputs.pr-head-sha }}
       comment-json: ${{ steps.read.outputs.comment-json }}
       comment-author: ${{ steps.read.outputs.comment-author }}
+      comment-in-reply-to-id: ${{ steps.read.outputs.comment-in-reply-to-id }}
+      comment-has-mention: ${{ steps.read.outputs.comment-has-mention }}
+      comment-is-review-cmd: ${{ steps.read.outputs.comment-is-review-cmd }}
+      comment-author-type: ${{ steps.read.outputs.comment-author-type }}
     steps:
       - name: Setup credentials
         uses: docker/cagent-action/setup-credentials@c22076b8856ee12d9b4c4685bb49cf26eb974079 # v1.5.0
@@ -127,6 +131,10 @@ jobs:
               echo 'COMMENT_JSON_EOF'
             } >> $GITHUB_OUTPUT
             echo "comment-author=$(jq -r '.user.login' /tmp/context/comment.json)" >> $GITHUB_OUTPUT
+            echo "comment-in-reply-to-id=$(jq -r '.in_reply_to_id // empty' /tmp/context/comment.json)" >> $GITHUB_OUTPUT
+            echo "comment-has-mention=$(jq -r 'if (.body | contains("@docker-agent")) then "true" else "false" end' /tmp/context/comment.json)" >> $GITHUB_OUTPUT
+            echo "comment-is-review-cmd=$(jq -r 'if (.body | startswith("/review")) then "true" else "false" end' /tmp/context/comment.json)" >> $GITHUB_OUTPUT
+            echo "comment-author-type=$(jq -r '.user.type // empty' /tmp/context/comment.json)" >> $GITHUB_OUTPUT
           fi
 
   review:
@@ -364,7 +372,7 @@ jobs:
     if: |
       always() && needs.resolve-context.result != 'failure' && (
         (github.event_name == 'pull_request_review_comment' && github.event.comment.in_reply_to_id && github.event.comment.user.login != 'docker-agent' && github.event.comment.user.type != 'Bot') ||
-        (needs.resolve-context.result == 'success' && needs.resolve-context.outputs.trigger-event == 'pull_request_review_comment' && needs.resolve-context.outputs.comment-author != 'docker-agent')
+        (needs.resolve-context.result == 'success' && needs.resolve-context.outputs.trigger-event == 'pull_request_review_comment' && needs.resolve-context.outputs.comment-in-reply-to-id != '' && needs.resolve-context.outputs.comment-author != 'docker-agent')
       )
     runs-on: ubuntu-latest
     permissions:
@@ -712,22 +720,95 @@ jobs:
         contains(github.event.comment.body, '@docker-agent') &&
         !startsWith(github.event.comment.body, '/review') &&
         github.event.comment.user.login != 'docker-agent' &&
-        github.event.comment.user.type != 'Bot')
+        github.event.comment.user.type != 'Bot') ||
+        (needs.resolve-context.result == 'success' &&
+        needs.resolve-context.outputs.trigger-event == 'pull_request_review_comment' &&
+        needs.resolve-context.outputs.comment-in-reply-to-id == '' &&
+        needs.resolve-context.outputs.comment-has-mention == 'true' &&
+        needs.resolve-context.outputs.comment-is-review-cmd != 'true' &&
+        needs.resolve-context.outputs.comment-author != 'docker-agent' &&
+        needs.resolve-context.outputs.comment-author-type != 'Bot')
       )
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
       issues: write
       id-token: write
+      actions: read   # download cross-run artifacts
 
     steps:
       - name: Setup credentials
         uses: docker/cagent-action/setup-credentials@c22076b8856ee12d9b4c4685bb49cf26eb974079 # v1.5.0
 
+      - name: Download trigger context
+        if: inputs.trigger-run-id != ''
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: pr-review-context
+          path: /tmp/context
+          run-id: ${{ inputs.trigger-run-id }}
+          github-token: ${{ env.GITHUB_APP_TOKEN }}
+
+      - name: Synthesize mention-reply event context
+        if: inputs.trigger-run-id != ''
+        shell: bash
+        run: |
+          if [ ! -f /tmp/context/comment.json ]; then
+            echo "::warning::comment.json not found in artifact — cannot synthesize mention event"
+            exit 0
+          fi
+          PR_NUMBER=$(cat /tmp/context/pr_number.txt 2>/dev/null || echo '')
+          if [ -z "$PR_NUMBER" ]; then
+            echo "::warning::pr_number.txt missing or empty — cannot synthesize mention event"
+            exit 0
+          fi
+          PR_HEAD_SHA=$(cat /tmp/context/pr_head_sha.txt 2>/dev/null || echo '')
+          REPO_NAME="${GITHUB_REPOSITORY##*/}"
+          REPO_FULL="${GITHUB_REPOSITORY}"
+          REPO_OWNER="${GITHUB_REPOSITORY_OWNER}"
+          jq -n \
+            --slurpfile comment /tmp/context/comment.json \
+            --arg pr_number "$PR_NUMBER" \
+            --arg pr_head_sha "$PR_HEAD_SHA" \
+            --arg repo_name "$REPO_NAME" \
+            --arg repo_full_name "$REPO_FULL" \
+            --arg repo_owner "$REPO_OWNER" \
+            '{
+              action: "created",
+              pull_request: {
+                number: ($pr_number | tonumber),
+                head: { sha: $pr_head_sha }
+              },
+              comment: $comment[0],
+              repository: {
+                name: $repo_name,
+                full_name: $repo_full_name,
+                owner: { login: $repo_owner }
+              },
+              sender: $comment[0].user
+            }' > /tmp/mention_event.json
+          echo "✅ Synthesized mention-reply event context at /tmp/mention_event.json"
+
+      - name: Resolve event context for mention-reply action
+        id: resolve-event
+        shell: bash
+        run: |
+          if [ -f /tmp/mention_event.json ]; then
+            echo "path=/tmp/mention_event.json" >> $GITHUB_OUTPUT
+            echo "name=pull_request_review_comment" >> $GITHUB_OUTPUT
+          else
+            echo "path=$GITHUB_EVENT_PATH" >> $GITHUB_OUTPUT
+            echo "name=$GITHUB_EVENT_NAME" >> $GITHUB_OUTPUT
+          fi
+
       - name: Run mention-reply handler
         id: mention-context
+        if: steps.resolve-event.outputs.path != ''
         uses: docker/cagent-action/.github/actions/mention-reply@c22076b8856ee12d9b4c4685bb49cf26eb974079 # v1.5.0
+        env:
+          GITHUB_EVENT_PATH: ${{ steps.resolve-event.outputs.path }}
+          GITHUB_EVENT_NAME: ${{ steps.resolve-event.outputs.name }}
         with:
           github-token: ${{ env.GITHUB_APP_TOKEN || github.token }}
           org-membership-token: ${{ env.ORG_MEMBERSHIP_TOKEN }}
@@ -755,14 +836,22 @@ jobs:
         env:
           GH_TOKEN: ${{ env.GITHUB_APP_TOKEN || github.token }}
           REPO: ${{ github.repository }}
-          COMMENT_ID: ${{ github.event.comment.id }}
+          EVENT_COMMENT_ID: ${{ github.event.comment.id }}
           OUTCOME: ${{ steps.run-reply.outcome }}
           EVENT_NAME: ${{ github.event_name }}
         run: |
           if [ "$OUTCOME" != "success" ]; then
             exit 0
           fi
-          if [ "$EVENT_NAME" = "pull_request_review_comment" ]; then
+          COMMENT_ID="$EVENT_COMMENT_ID"
+          if [ -z "$COMMENT_ID" ] && [ -f /tmp/mention_event.json ]; then
+            COMMENT_ID=$(jq -r '.comment.id // empty' /tmp/mention_event.json)
+          fi
+          if [ -z "$COMMENT_ID" ]; then
+            echo "::warning::No comment ID available — skipping completion reaction"
+            exit 0
+          fi
+          if [ -f /tmp/mention_event.json ] || [ "$EVENT_NAME" = "pull_request_review_comment" ]; then
             gh api "repos/$REPO/pulls/comments/$COMMENT_ID/reactions" \
               -X POST -f content='+1' || true
           else
diff --git a/review-pr/README.md b/review-pr/README.md
@@ -123,7 +123,8 @@ pull_request (opened / ready_for_review / review_requested)
 pull_request_review_comment
   → pr-review-trigger.yml (saves context as artifact)
   → workflow_run fires
-  → pr-review.yml (downloads artifact, routes to reply)
+  → pr-review.yml (downloads artifact, routes to reply-to-feedback for replies to agent
+     comments, or reply-to-mention for top-level @-mentions)
 
 /review comment  –OR–  @docker-agent mention
   → pr-review.yml directly (issue_comment has full permissions)
@@ -164,7 +165,7 @@ with:
 | PR opened/ready                      | Auto-reviews when a PR is opened or marked ready for review.                                                                             |
 | `/review` comment                    | Re-trigger a review, or trigger manually when auto-review hasn't run (e.g. after a force-push). Shows as a check run if `checks: write` is granted. |
 | Reply to review comment              | Responds in-thread and captures feedback to improve future reviews.                                                                      |
-| `@docker-agent` mention              | Answers questions and clarifies review findings in PR comments.                                                                          |
+| `@docker-agent` mention              | Answers questions and clarifies review findings. Works in both PR-level issue comments and inline file-line review comments, including on fork PRs (via the trigger workflow). |
 
 > **Built-in defense-in-depth:**
 >
