Hide /review, /review rerun, and /review tests command comments as resolved

.github/workflows/copilot-review-tests.md

@@ -9,6 +9,10 @@ on:
     pull_request_review_comment: [contributor, first_time_contributor, first_timer, mannequin, none]
   reaction: none
   status-comment: false
+  # Grant the pre-activation job (the on.steps below) issues:write so it can delete the
+  # triggering `/review tests` comment once the command is recognized and authorized.
+  permissions:
+    issues: write
   steps:
     - name: Confirm exact /review tests command
       id: exact_command
@@ -28,6 +32,44 @@ on:
         else
           echo "should_run=false" >> "$GITHUB_OUTPUT"
         fi
+    - name: Delete the /review tests command comment when authorized
+      if: github.event_name == 'issue_comment' && steps.exact_command.outputs.should_run == 'true'
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      with:
+        github-token: ${{ github.token }}
+        script: |
+          // Only delete when the command is exactly `/review tests` (should_run) AND the
+          // commenter is an authorized collaborator (write/maintain/admin). This mirrors
+          // the workflow's own role gate but is self-contained, so an unauthorized user's
+          // comment is always left visible. A failed delete must not block activation.
+          // Only act on newly-created comments. The gh-aw slash_command trigger also fires
+          // on `edited`, so without this guard, editing any existing comment to say
+          // `/review tests` would delete that comment (and its entire history).
+          if (context.payload.action !== 'created') {
+            core.info('Skipping delete: comment was edited, not created.');
+            return;
+          }
+          const { owner, repo } = context.repo;
+          const actor = context.actor;
+          let permission = 'none';
+          try {
+            const res = await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username: actor });
+            permission = res.data.permission;
+          } catch (e) {
+            core.info(`Permission lookup for ${actor} failed: ${e.message}`);
+          }
+          // Must mirror the workflow `roles:` frontmatter (admin/maintain/write) — keep in sync.
+          if (!['admin', 'maintain', 'write'].includes(permission)) {
+            core.info(`Actor ${actor} is not an authorized collaborator (${permission}); leaving the /review tests comment.`);
+            return;
+          }
+          const commentId = context.payload.comment.id;
+          try {
+            await github.rest.issues.deleteComment({ owner, repo, comment_id: commentId });
+            core.info(`Deleted /review tests command comment ${commentId}.`);
+          } catch (e) {
+            core.warning(`Could not delete /review tests command comment ${commentId}: ${e.message}`);
+          }
   workflow_dispatch:
     inputs:
       pr_number:

.github/workflows/review-trigger.yml

@@ -139,6 +139,24 @@ jobs:
           "Reason: ${{ steps.rerun.outputs.reason }}" >> $env:GITHUB_STEP_SUMMARY
           "Label: ${{ steps.rerun.outputs.label }}" >> $env:GITHUB_STEP_SUMMARY
 
+      - name: Delete the /review rerun command comment
+        if: github.event_name == 'issue_comment' && steps.rerun.outputs.eligible == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          # Only delete once a rerun was actually triggered (eligible == 'true'). Ineligible
+          # reruns (no-ai-summary / review-in-progress / no-new-activity) keep the comment as
+          # the implicit "seen, nothing changed" signal and preserve the previous-rerun
+          # checkpoint Get-LatestRerunCommentBefore relies on. Eligibility resolution already
+          # read this comment by id. A failed delete must never fail the job.
+          if gh api -X DELETE "repos/${REPO}/issues/comments/${COMMENT_ID}" --silent; then
+            echo "Deleted /review rerun command comment ${COMMENT_ID}"
+          else
+            echo "::warning::Could not delete /review rerun command comment ${COMMENT_ID}"
+          fi
+
   trigger-review:
     needs: match
     if: needs.match.outputs.matched == 'true' && needs.match.outputs.command == 'review'
@@ -453,3 +471,19 @@ jobs:
         run: |
           . .github/scripts/shared/Update-AgentLabels.ps1
           Clear-AgentReviewInProgress -PRNumber $env:PR_NUMBER -Owner '${{ github.repository_owner }}' -Repo '${{ github.event.repository.name }}' | Out-Null
+
+      - name: Delete the /review command comment
+        if: github.event_name == 'issue_comment' && steps.trigger_azdo.outcome == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          # Delete only after the pipeline was actually triggered, so a lock-skip
+          # (locked == 'true') or a failed AzDO trigger leaves the /review comment visible
+          # for the user to retry. A failed delete must never fail the review trigger.
+          if gh api -X DELETE "repos/${REPO}/issues/comments/${COMMENT_ID}" --silent; then
+            echo "Deleted /review command comment ${COMMENT_ID}"
+          else
+            echo "::warning::Could not delete /review command comment ${COMMENT_ID}"
+          fi