fix(workflow): restrict pr-code-quality-reviewer to COMMENT/REQUEST_CHANGES reviews

[Copilot]

GITHUB_TOKEN cannot approve pull requests — without allowed-events, the agent would attempt APPROVE on clean PRs and fail at the GitHub API level.

Changes

• Frontmatter — adds allowed-events: [COMMENT, REQUEST_CHANGES] to submit-pull-request-review, enforcing the constraint at the safe-outputs layer before it reaches GitHub
• Step 5 prompt — replaces APPROVE instruction with COMMENT for the no-blocking-issues path; removes the contradictory trailing sentence
• Lock file — recompiled to propagate allowed_events into the runtime handler config

---

Run: https://github.com/github/gh-aw/actions/runs/30375513874

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.1 AIC · ⌖ 6.1 AIC · ⊞ 7.2K · ◷
_{Comment /souschef to run again}

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. PR #48663 contains only workflow configuration changes (.md and .lock.yml files). Test Quality Sentinel skipped.

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #48663 does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100).

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[Copilot]

Pull request overview

Restricts the reviewer workflow to review events supported by GITHUB_TOKEN.

Changes:

• Allows only COMMENT and REQUEST_CHANGES.
• Replaces APPROVE prompt guidance with COMMENT.
• Recompiles the generated workflow configuration.

Show a summary per file

File	Description
.github/workflows/pr-code-quality-reviewer.md	Updates review constraints and instructions.
.github/workflows/pr-code-quality-reviewer.lock.yml	Propagates allowed events into runtime configuration.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

✅ Config change verified

Small, correct, self-consistent change: adds allowed-events: [COMMENT, REQUEST_CHANGES] to submit-pull-request-review and updates the prompt to drop the now-disallowed APPROVE path. Lock file JSON (allowed_events) matches the frontmatter change exactly. No correctness, security, or maintainability issues found in the diff.

🔎 Code quality review by PR Code Quality Reviewer · sonnet50 · 8.67 AIC · ⌖ 4.21 AIC · ⊞ 7.4K
_{Comment /review to run again}

[github-actions]

Changes are correct and consistent. The allowed-events: [COMMENT, REQUEST_CHANGES] constraint is properly propagated from frontmatter through to both the config.json and GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG in the lock file. The prompt update removes the APPROVE path cleanly with no contradictions remaining.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 10 AIC · ⌖ 4.53 AIC · ⊞ 5K

[github-actions]

Skills-Based Review

Applied /diagnosing-bugs — correct, minimal fix for a well-understood root cause. No blocking issues found.

Positive highlights:

• Fix applied at safe-outputs layer so even a misbehaving LLM cannot bypass the constraint
• Both config.json heredoc and GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG env var updated in sync
• Prompt changes minimal and focused; lock file properly recompiled

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 14.8 AIC · ⌖ 5.18 AIC · ⊞ 6.7K
_{Comment /matt to run again}

[pelikhan]

@copilot run pr-finisher skill