From 1edb9d6d74b936a564d51632633d26e2d470b1a8 Mon Sep 17 00:00:00 2001
From: Clint Branham <goodolclint@gmail.com>
Date: Tue, 1 Sep 2026 13:20:52 -0500
Subject: [PATCH] ci: review bot submits a formal review verdict

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/claude-code-review.yml | 46 ++++++++++++++++++++----
 1 file changed, 40 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 6b09211..d995581 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -34,8 +34,8 @@ jobs:
             Review this pull request for the PSProxmoxVE PowerShell module.
 
             Focus areas:
-            1. **DECISIONS.md compliance** — Check against the 13 architectural
-               decisions (D001-D013). Any violation is a regression.
+            1. **DECISIONS.md compliance** — Check against the architectural
+               decisions (D001-D016). Any violation is a regression.
             2. **Code quality** — Cmdlet conventions (sealed, OutputType,
                ConfirmImpact.High for destructive, VmId ValidateRange),
                SecureString for passwords, Uri.EscapeDataString on path params,
@@ -48,9 +48,43 @@ jobs:
             5. **Security** — No hardcoded credentials, no secrets in logs,
                TLS verification on by default.
 
-            Provide inline comments for specific issues and a summary comment
-            for general observations. Skip nitpicks unless they indicate a
-            real problem.
+            Use inline comments for issues tied to specific lines. Skip
+            nitpicks unless they indicate a real problem.
+
+            You MUST end the review by submitting a formal review verdict with
+            `gh pr review`, because branch protection only recognises a review
+            state — plain PR comments and inline-only comments do not count:
+
+            - Nothing blocks merge:
+              `gh pr review ${{ github.event.pull_request.number }} --approve --body "<summary>"`
+            - Something must change before merge:
+              `gh pr review ${{ github.event.pull_request.number }} --request-changes --body "<summary>"`
+
+            Always pass a non-empty `--body`. If you cannot complete the
+            review for any reason, still submit
+            `gh pr review ${{ github.event.pull_request.number }} --comment --body "<why you could not review>"`
+            rather than staying silent.
 
           claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr review:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh api:*)"
+
+      - name: Verify formal review was submitted
+        if: always() && steps.claude-review.outputs.execution_file != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          # Branch protection requires a formal review state. Plain PR comments
+          # don't count, and inline-only comments create empty-body COMMENTED
+          # reviews that don't count either.
+          formal_count=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
+            --jq '[.[] | select(.user.login == "claude[bot]") |
+                   select(.state == "APPROVED" or
+                          .state == "CHANGES_REQUESTED" or
+                          ((.body // "") | length > 0))] | length')
+          echo "Formal claude[bot] reviews on PR #$PR_NUMBER: $formal_count"
+          if [ "$formal_count" -eq 0 ]; then
+            echo "::error title=No formal review submitted::Claude reviewed the PR but did not call 'gh pr review'. Re-run the workflow or invoke '@claude re-review' on the PR."
+            exit 1
+          fi