Add agentic code review workflow

[popey]

Summary

• run Tessl change review for eligible pull requests and maintainer-triggered reruns
• reject cross-repository pull requests before privileged setup
• publish structured Tessl findings as a GitHub pull request review
• retain raw review and publisher output as workflow artifacts

Validation

• node --check .github/change-review/publish-review.mjs
• workflow YAML parsed successfully
• git diff --check
• just check attempted but could not complete because Google Chrome is unavailable at the configured path

---

Note

Medium Risk
New CI posts PR reviews using GITHUB_TOKEN and TESSL_TOKEN, with cross-repo rejection and maintainer-only rerun triggers; misconfiguration could spam reviews or block merges if request-changes mode is enabled.

Overview
Adds automated Tessl change reviews on pull requests via a new Change Review workflow and a publish-review.mjs publisher.

The workflow runs on PR open/reopen/ready-for-review (non-draft), on maintainer @tessl-change-review comments, or manual dispatch. It resolves the PR head SHA, blocks cross-repository PRs, checks out the PR and sparse workflow scripts, and skips a second automatic run if a prior Tessl-marked github-actions[bot] review exists (explicit comment/dispatch bypasses that). When it runs, it uses tesslio/setup-tessl, runs tessl change review run against origin/main with configured skills, then posts a GitHub PR review from the JSON output.

publish-review.mjs validates the review JSON, builds the review body (overview, skills, collapsible unplaced findings/warnings, re-review hint), maps inline comments to the GitHub API shape, optionally uses REQUEST_CHANGES when REVIEW_ACTION=request-changes-on-findings and there are findings, and writes review-publish.json. The workflow uploads raw review and publish artifacts.

^{Reviewed by Cursor Bugbot for commit 440809c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

tessl change review:

Reviewed against skills: review-code-legibility

• Found 1 issue; overall, the workflow is readable but splits review policy behind a broad gate name.

---

To trigger a re-review write a comment that says @tessl-change-review.

[github-actions]

This cold-reader gap makes Check review policy sound like the workflow's single review eligibility gate, but draft filtering, comment authorization, cross-repository rejection, and automatic de-duplication are split across separate conditions. That can mislead readers when changing which reviews should run. Consider renaming this step/id to the specific decision it makes, such as Check automatic review has not already run, or consolidating the policy gates into one named phase.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 440809c. Configure here.}

[cursor]

Invalid Tessl review CLI command

High Severity

The workflow runs tessl change review run, but the Tessl CLI command is tessl change review (no run). That extra token matches the separate tessl review run skill-quality command, so the change-review step is likely to fail before any review JSON is produced, and the publish step never runs.

 

^{Reviewed by Cursor Bugbot for commit 440809c. Configure here.}