Repost PR Reviews To Tpf

Repost PR reviews onto the TPF

Restore reviewer-thread continuity on a GHSA temporary private fork (TPF) PR by replaying the closed public PR's review history. Each source review becomes one repost-review on the TPF, with its inline comments anchored to the original commits at the original line numbers — GitHub then renders them as "outdated on commit X" exactly the way they appeared on the original public PR.

This skill is the natural follow-up to move-pr-to-private-ghsa. That skill moves the code into the TPF; this one restores the review context that was deliberately left behind on the public PR.

Tested against BoldGrid/w3-total-cache#1313 → BoldGrid/w3-total-cache-ghsa-rgpr-5m2g-gvh2#1 on 2026-05-20: 2 Copilot reviews, 16 inline comments, anchored to a2b94e5d (round 1) and 498aa3e8 (round 2). See "Caveats to surface every time" for the line-drift / event-state / attribution issues this skill exists to avoid re-encountering.

When to use this

• A public PR has been moved to a TPF via move-pr-to-private-ghsa (the source PR is closed; its branch may be deleted).
• Review threads on the public PR — Copilot bot reviews, human reviewer comments minimized/resolved before close, anchor-context inline findings — are valuable for ongoing TPF review but did not migrate with the commits.
• The original commits the reviewers anchored to are still reachable from the TPF PR's chain. True by construction for move-pr-to-private-ghsa (the TPF starts as a fork of the public repo with all branches), so all original_commit_id SHAs should still be in the TPF chain.
• The audit-trail home for the descriptive content already lives in Jira (via pr-content-to-jira), but you want operational continuity in the TPF reviewer UI on top of the audit-trail copy.

Do not use this to manufacture review consensus — the reposts will be authored by you, not the original reviewer. Attribution lives in an inline preface on every body so the audit trail is grep-able, but anyone scanning the reviewer column in the timeline sees your login. The flip side: never use APPROVE or REQUEST_CHANGES events on the repost; that would inject your account into the TPF's review state on someone else's behalf. Always COMMENT.

Prerequisites

• gh CLI logged in. Two distinct permission surfaces:
  • repo scope on the public source repo (to read closed PR reviews + comments — public read is enough, but ratelimit-friendliness wants auth).
  • repo (or pull-requests:write via GitHub App) on the TPF repo. Repo-admin on the public repo usually carries through to the TPF; verify:

  gh api repos/{TPF-OWNER}/{TPF-REPO} --jq '{full_name, permissions}'

• Python 3 (the workable pattern is a small Python reposter that shells out to gh api).
• jq available locally.
• A writable .cursor/working/ directory (gitignored).
• The closed public PR's {owner}/{repo}#{n}, the TPF PR's {owner}/{repo}#{n}, and the parent Jira key (used in attribution prefaces so reposts are bidirectionally linkable to the audit trail).

Filename convention for scratch files

Per AGENTS.md "Working Files", every scratch file follows {KEY}-{REPO}-{PR}-{role}.{ext}. The "primary" PR for this skill is the TPF PR you're posting into — the source PR is referenced from the filename role, not the keying triple. {REPO} is the lowercase slug (right-hand half of org/repo); GHSA TPFs follow w3-total-cache-ghsa-… (ghsa lowercase). Capture the prefix once in Phase 1 and reuse:

KEY=ENG7-2908                                # Jira ticket
TPF_REPO=BoldGrid/w3-total-cache-ghsa-rgpr-5m2g-gvh2
TPF_PR=1                                     # TPF PR number (almost always 1)
TPF_SLUG="${TPF_REPO#*/}"                    # → "w3-total-cache-ghsa-rgpr-5m2g-gvh2"
PFX="${KEY}-${TPF_SLUG}-${TPF_PR}"           # canonical scratch-file prefix

Every file path below expands as .cursor/working/${PFX}-{role}.{ext}:

• ${PFX}-source-pr-${SRC_PR}-reviews.json — source review summaries (/reviews, filtered by author regex)
• ${PFX}-source-pr-${SRC_PR}-comments.json — source inline comments (/comments, filtered by author regex)
• ${PFX}-tpf-chain.json — TPF PR commit list (Phase 2 reachability check)
• ${PFX}-repost-reviews.py — the reposter script
• ${PFX}-repost-{round}-payload.json — POST body for /pulls/{n}/reviews (one per source review)
• ${PFX}-repost-{round}-response.json — API response for verify
• ${PFX}-verify-reposted.json — Phase 5 verification dump

Never write to /tmp/ or anywhere outside the project tree.

Workflow

Phase 0 — Confirm scope and inputs

Capture from the user (or ask):

• Source public PR URL → derive {SRC-OWNER}, {SRC-REPO}, {SRC-PR}.
• TPF PR URL → derive {TPF-OWNER}, {TPF-REPO}, {TPF-PR}.
• Parent Jira ticket key (e.g., ENG7-2908) — used in attribution prefaces.
• Author filter regex for the source content to repost — e.g., [Cc]opilot for Copilot bot reviews, a specific human login, or . to include all reviewers. Be explicit; never just default to "all" without confirming.
• Whether the source PR's branch has been deleted (informational — doesn't affect the API; reviews/comments live on the PR, not the branch).

Verify GitHub permissions on the TPF:

gh api repos/{TPF-OWNER}/{TPF-REPO} --jq '{full_name, permissions, default_branch}'
# expect permissions.push: true and permissions.admin: true (or maintain: true)

Phase 1 — Pull source reviews + comments via gh api

Two calls, both filtered by the same author regex. The /reviews endpoint gives you the review-level data (state, body, commit_id, submitted_at); /comments gives you the per-inline-comment data (path, original_line, original_commit_id, pull_request_review_id, body, side):

SRC_REPO=BoldGrid/w3-total-cache
SRC_PR=1313
FILTER='[Cc]opilot'   # or specific login, etc.

gh api "repos/${SRC_REPO}/pulls/${SRC_PR}/reviews" --paginate \
  > .cursor/working/${PFX}-source-pr-${SRC_PR}-reviews-raw.json

jq "[.[] | select(.user.login | test(\"${FILTER}\")) | {id, state, commit_id, submitted_at, body, user_login: .user.login}]" \
  .cursor/working/${PFX}-source-pr-${SRC_PR}-reviews-raw.json \
  > .cursor/working/${PFX}-source-pr-${SRC_PR}-reviews.json

gh api "repos/${SRC_REPO}/pulls/${SRC_PR}/comments" --paginate \
  > .cursor/working/${PFX}-source-pr-${SRC_PR}-comments-raw.json

jq "[.[] | select(.user.login | test(\"${FILTER}\")) | {id, path, line, original_line, original_commit_id, side, pull_request_review_id, body, user_login: .user.login}]" \
  .cursor/working/${PFX}-source-pr-${SRC_PR}-comments-raw.json \
  > .cursor/working/${PFX}-source-pr-${SRC_PR}-comments.json

Quick sanity check — comment count grouped by review:

jq '[.[] | {id, review_id: .pull_request_review_id}] | group_by(.review_id) | map({review_id: .[0].review_id, count: length})' \
  .cursor/working/${PFX}-source-pr-${SRC_PR}-comments.json

The count per review should match the body of the source review (Copilot reviews usually include a "generated N comments" line you can cross-reference).

Phase 2 — Verify every original_commit_id is reachable from the TPF chain

Inline comments anchored to a commit that's no longer in the TPF PR's chain will be rejected by the API with 422. Verify up front:

gh api "repos/${TPF_REPO}/pulls/${TPF_PR}/commits" --paginate --jq '[.[] | .sha]' \
  > .cursor/working/${PFX}-tpf-chain.json

jq -r '[.[] | .original_commit_id] | unique | .[]' \
  .cursor/working/${PFX}-source-pr-${SRC_PR}-comments.json \
| while read sha; do
    if jq -e --arg sha "$sha" 'index($sha)' \
         .cursor/working/${PFX}-tpf-chain.json > /dev/null; then
      echo "OK   $sha"
    else
      echo "MISS $sha   (will need fallback to PR-level comment)"
    fi
  done

Any MISS rows need to be handled separately — see "Caveats" #6. Most of the time everything resolves to OK because move-pr-to-private-ghsa preserves the full commit chain.

Phase 3 — Build the reposter script

One payload per source review. For each comment, anchor to original_commit_id + original_line. Attribution wrapper goes on both the review body and each inline comment body, so attribution survives every UI surface (timeline, file-tree review, individual comment permalink).

The template script (write to .cursor/working/${PFX}-repost-reviews.py):

#!/usr/bin/env python3
"""
Repost reviews from {SRC_REPO}#{SRC_PR} onto TPF PR {TPF_REPO}#{TPF_PR}.

Each review is anchored to its source's original_commit_id, with each inline
comment placed on its original_line. GitHub then renders them as historical
outdated comments anchored on those commits, matching the original review UX.

Audit-trail copy of the same content lives on Jira {KEY} (added via
pr-content-to-jira) so this is operational continuity, not the audit trail.
"""

import json
import subprocess
import sys
from pathlib import Path

WORKING        = Path("/home/.../.cursor/working")
TPF_REPO       = "{TPF-OWNER}/{TPF-REPO}"
TPF_PR         = {TPF-PR}
SOURCE_PR_URL  = "https://github.com/{SRC-OWNER}/{SRC-REPO}/pull/{SRC-PR}"
JIRA_KEY       = "{KEY}"
# Filename prefix per AGENTS.md "Working Files": {KEY}-{REPO-SLUG}-{TPF-PR}-...
# (the TPF PR is the keying PR for this skill; SRC-PR lives in the role part).
PREFIX         = f"{JIRA_KEY}-{TPF_REPO.split('/', 1)[1]}-{TPF_PR}"


def load_reviews():
    with open(WORKING / f"{PREFIX}-source-pr-{{SRC-PR}}-reviews.json") as fh:
        return json.load(fh)


def load_comments():
    with open(WORKING / f"{PREFIX}-source-pr-{{SRC-PR}}-comments.json") as fh:
        return json.load(fh)


def build_payload(review, comments):
    login = review["user_login"]
    header = (
        f"_Reposted from [{login}] review on {SOURCE_PR_URL} "
        f"(review id {review['id']}, submitted {review['submitted_at']}). "
        f"Anchored to commit `{review['commit_id'][:10]}` so file/line positions match the original review. "
        f"Audit-trail copy also lives on Jira {JIRA_KEY}._\n\n"
        f"---\n\n"
    )
    body = header + (review["body"] or "")

    comments_payload = []
    for c in comments:
        if c["pull_request_review_id"] != review["id"]:
            continue
        inline_body = (
            f"_From {c['user_login']} inline comment on PR #{{SRC-PR}} "
            f"(comment id {c['id']}, originally anchored at L{c['original_line']} of `{c['path']}` "
            f"at commit `{c['original_commit_id'][:10]}`). Verbatim text below._\n\n"
            f"{c['body']}"
        )
        comments_payload.append({
            "path": c["path"],
            "line": c["original_line"],
            "side": c.get("side") or "RIGHT",
            "body": inline_body,
        })

    return {
        "commit_id": review["commit_id"],   # the source's original commit
        "event":     "COMMENT",             # ALWAYS COMMENT — never re-use APPROVE / REQUEST_CHANGES
        "body":      body,
        "comments":  comments_payload,
    }


def post(payload, round_label):
    payload_path = WORKING / f"{PREFIX}-repost-{round_label}-payload.json"
    payload_path.write_text(json.dumps(payload, ensure_ascii=False, indent=2))

    print(f"\n=== Posting {round_label} ===")
    print(f"  commit_id: {payload['commit_id'][:10]}")
    print(f"  comments:  {len(payload['comments'])}")

    result = subprocess.run(
        ["gh", "api", "--method", "POST",
         f"/repos/{TPF_REPO}/pulls/{TPF_PR}/reviews",
         "--input", str(payload_path)],
        capture_output=True, text=True,
    )
    if result.returncode != 0:
        print("STDERR:", result.stderr)
        sys.exit(result.returncode)

    response = json.loads(result.stdout) if result.stdout.strip() else {}
    (WORKING / f"{PREFIX}-repost-{round_label}-response.json").write_text(
        json.dumps(response, ensure_ascii=False, indent=2)
    )
    print(f"  Review ID: {response.get('id')}")
    print(f"  URL:       {response.get('html_url')}")


def main():
    reviews = sorted(load_reviews(), key=lambda r: r["submitted_at"])
    comments = load_comments()
    for i, r in enumerate(reviews, start=1):
        post(build_payload(r, comments), f"round{i}")


if __name__ == "__main__":
    main()

Fill in the curly-brace tokens for the specific run. Keep event: "COMMENT" regardless of the source review's state (see "Caveats" #2).

Phase 4 — Post the reposts

python3 .cursor/working/${PFX}-repost-reviews.py

Expect one POST per source review, each returning a review id + html_url. Save responses to ${PFX}-repost-{round}-response.json.

If a POST fails with 422:

• Pull request review thread line must be part of a diff → the original_line isn't in the original_commit_id's diff against base. Most often a data integrity issue from the source PR (force-push or rebase) rather than the script. Pull the comment out of that review's payload and fall back to a PR-level conversation comment for it (see "Caveats" #6).
• Pull request review thread commit_oid is not part of the pull request → the original_commit_id isn't in the TPF chain. Same fallback.
• Pull request comment body is too long → 65536-char ceiling per body; trim the verbatim content or split into multiple comments.

Phase 5 — Verify

Read back the comments on the TPF PR and assert each reposted comment's original_line matches the source. Same script pattern works for both — query, then sort by id, then diff:

gh api "repos/${TPF_REPO}/pulls/${TPF_PR}/comments" --paginate \
  --jq "[.[] | select(.body | test(\"Reposted from\\\\b|From ${FILTER} inline comment\")) | {path, original_line, original_commit_id: (.original_commit_id // \"\")[0:10], review_id: .pull_request_review_id}]" \
  > .cursor/working/${PFX}-verify-reposted.json

jq '. | length' .cursor/working/${PFX}-verify-reposted.json
# expect: same as total inline-comment count across all source reviews

Optional sanity check: open https://github.com/${TPF_REPO}/pull/${TPF_PR} in a browser, click "Conversation", and confirm the reposted reviews appear in chronological order with their inline comments rendered as outdated against the historical commits.

Phase 6 — Optional: note the repost in the Jira back-link

The Jira back-link comment from move-pr-to-private-ghsa Phase 5b is the place to record that the TPF now has the original review threads as well. Add a short follow-up comment (Jira MCP cannot edit existing comments) referencing the reposted review URLs so future ticket-readers know the operational view of the reviews lives on the TPF, not just the audit-trail view that's in Jira:

## Follow-up to GHSA back-link: source PR reviews reposted on the TPF

For ongoing-review continuity, the original [{login}] reviews from {SOURCE_PR_URL}
have been reposted on the TPF, anchored to the historical commits so file/line
positions match the source review exactly:

- Round 1 ({source review id, source commit_id[:10]}): {tpf-review-1-url}
- Round 2 ({source review id, source commit_id[:10]}): {tpf-review-2-url}

Each comment is attributed to its original author via an inline preface; the
reposts are authored by my account on the TPF.

Audit-trail copy of the same content remains as comment {original-jira-comment-id}
on this ticket — Jira is the durable record; the TPF reposts are the operational
view for active reviewers.

Skip this step if there's no Jira ticket in scope.