The GitHub Action's PR comment rendered absolute CI-runner paths like
/home/runner/work/repo/repo/code_review_graph/embeddings.py::get_provider,
which is ugly and leaks the runner's directory layout.
Add relativize_path(): strip the GITHUB_WORKSPACE prefix (set by Actions
checkout), fall back to the doubled <repo>/<repo>/ segment derived from
GITHUB_REPOSITORY when the env is absent, and otherwise leave the path
untouched rather than guess-mangle it. The ::symbol suffix is preserved,
and already-relative paths pass through unchanged.
Wire it into the Symbol and Location columns and the test-gap list. Risk
math and sticky-comment marker logic are untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Composite action (action.yml) that builds/updates the knowledge graph on
the runner, runs 'detect-changes --base origin/<base>', renders a
risk-scored markdown report, and upserts a sticky PR comment via gh api.
Local-first: no code leaves the CI runner.
- action.yml: inputs github-token / comment / fail-on-risk /
python-version; actions/cache on .code-review-graph keyed by
runner.os + lockfile hash + schema version (v9); sticky comment found
via hidden HTML marker; optional risk gate (high >= 0.70,
critical >= 0.85)
- scripts/render_pr_comment.py: stdlib-only renderer + risk gate with
markdown escaping and control-char stripping for untrusted fields
- tests/test_action_render.py: 33 unit tests over a fixture
detect-changes JSON (tests/fixtures/detect_changes_sample.json)
- .github/workflows/pr-review.yml: dogfoods the local action (uses: ./)
with permissions: pull-requests: write
- docs/GITHUB_ACTION.md: setup, inputs table, external-repo example,
cache behavior, security notes (token scope, fork PRs, pinning)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Jacky Lam