ci: triage-only Review Comment Monitor for bot reviews (auto-monitor)

.github/workflows/review-comment-monitor.yml

@@ -0,0 +1,60 @@
+name: Review Comment Monitor
+
+# Surfaces automated-reviewer (CodeRabbit / Codex) findings for human attention.
+#
+# TRIAGE ONLY — this workflow classifies and summarizes a bot review; it does
+# NOT apply code fixes and does NOT resolve review threads. Acting on findings
+# (fixing + resolving) stays a deliberate human-invoked step via the pr-trimmer
+# agent / `/pr-trim`. Keeping monitor and mutation separate means an automated
+# reviewer can never trigger an unsupervised change to the PR.
+on:
+  pull_request_review:
+    types: [submitted]
+
+concurrency:
+  group: review-monitor-${{ github.event.pull_request.number }}-${{ github.event.review.id }}
+  cancel-in-progress: false
+
+jobs:
+  triage:
+    # React only to known automated reviewers. Do NOT also require a non-empty
+    # review body: bots often post findings as inline comments with no top-level
+    # summary, and those are exactly the line-level comments we want to triage —
+    # the action fetches the review's comments itself.
+    if: |
+      github.event.review.user.login == 'coderabbitai' ||
+      github.event.review.user.login == 'coderabbitai[bot]' ||
+      github.event.review.user.login == 'chatgpt-codex-connector' ||
+      github.event.review.user.login == 'chatgpt-codex-connector[bot]'
+    runs-on: ubuntu-latest
+    # Least-privilege: reads the diff, posts ONE summary comment. No contents:write
+    # (it must not be able to push), no thread-resolution scope.
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+
+      - name: Triage automated review
+        uses: anthropics/claude-code-action@eee73e2ae5399c561de4ff038aa7b36a7aa991a7 # v1.0.143
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # claude-code-action rejects bot-triggered runs by default; this job is
+          # *intentionally* triggered by bot reviews, so allow exactly those bots.
+          allowed_bots: 'coderabbitai[bot],chatgpt-codex-connector[bot]'
+          prompt: |
+            The automated reviewer "${{ github.event.review.user.login }}" just submitted a review on ${{ github.repository }} PR #${{ github.event.pull_request.number }}.
+
+            Read that review's comments and the PR diff. Triage ONLY — you must not modify any file, push any commit, or resolve any review thread.
+
+            Classify each finding by the PMOVES pr-trim severity model (P0 = security/data-loss/broken-contract, P1 = real bug on a normal path, P2 = edge/robustness, P3 = nit/style). Then post exactly ONE summary comment on the PR:
+            - A short bullet list of every P0/P1 finding with `file:line` and a one-line why-it-matters, so a human can act via `/pr-trim`.
+            - A single count line for P2/P3 (e.g. "P2: 3, P3: 5").
+            - If there are no P0/P1 findings, post a one-line "no high-severity findings from <reviewer>" note instead.
+
+            Be terse. This comment is a triage signal for a human, not a re-review.