vouchington-tooling 0.0.17 → 0.0.19

package/README.md

@@ -41,6 +41,8 @@ vouchington install-playwright-chromium-arm64
 vouchington ghcr-package-retention example%2Fapi
 vouchington nuget-central-version trusted.props candidate.props metadata.json out.props
 vouchington swift-semantic-equal BASE HEAD App.swift
+vouchington post-review
+vouchington stage-review-payload optional|required <source> <destination>
 ```
 
 Host-lock environment:
@@ -91,6 +93,7 @@ import { parseCsvRows, streamCsvRows } from 'vouchington-tooling/csv'
 import { readResponseBody } from 'vouchington-tooling/http-body'
 import { runAstGrepRule } from 'vouchington-tooling/ast-grep-rule'
 import { parseReviewPayload, remapReviewComments } from 'vouchington-tooling/gha-review-payload'
+import { runPostReview } from 'vouchington-tooling/gha-post-review'
 import { nextPageUrlFromLinkHeader } from 'vouchington-tooling/http-link-pagination'
 import { cmdUpload, mintPresignedControl } from 'vouchington-tooling/coverage-transport'
 import { pruneDeployedRuntimeDeps } from 'vouchington-tooling/pnpm-deploy'
@@ -107,5 +110,5 @@ import { validateResolvedPinDelta } from 'vouchington-tooling/swift-resolved-pin
 ```
 
 The artifact, review-payload, HTTP body, and pagination APIs validate untrusted inputs at their
-boundaries. They do not include provider credentials, product policy, network transport, or
-repository-specific package names; consumers supply those through their own adapters.
+boundaries. Review posting lives in `gha-post-review` and talks to GitHub only through caller-supplied
+credentials (job token or a minted Claude GitHub App token).

package/dist/cli/commands/post-review.d.mts

@@ -0,0 +1 @@
+export declare function runPostReviewCommand(): Promise<number>;

package/dist/cli/commands/post-review.mjs

@@ -0,0 +1,4 @@
+import { runPostReviewCli } from '../../gha-post-review/cli.mjs';
+export function runPostReviewCommand() {
+    return runPostReviewCli();
+}

package/dist/cli/commands/stage-review-payload.d.mts

@@ -0,0 +1 @@
+export declare function runStageReviewPayloadCommand(args: readonly string[]): number;

package/dist/cli/commands/stage-review-payload.mjs

@@ -0,0 +1,4 @@
+import { runStageReviewPayloadCli } from '../../gha-review-payload/cli.mjs';
+export function runStageReviewPayloadCommand(args) {
+    return runStageReviewPayloadCli(args);
+}

package/dist/cli/index.mjs

@@ -10,6 +10,8 @@ import { runPnpmInstallCli } from './commands/pnpm-install.mjs';
 import { runRunnerPortPolicy } from './commands/runner-port-policy.mjs';
 import { runScript } from './commands/spawn-script.mjs';
 import { runNugetCentralVersionCommand } from './commands/nuget-central-version.mjs';
+import { runPostReviewCommand } from './commands/post-review.mjs';
+import { runStageReviewPayloadCommand } from './commands/stage-review-payload.mjs';
 import { runSwiftSemanticEqualCommand } from './commands/swift-semantic-equal.mjs';
 import { runVitestBlobManifestCommand } from './commands/vitest-blob-manifest.mjs';
 import { runWithHostLock } from './commands/with-host-lock.mjs';
@@ -82,6 +84,10 @@ export function runCli(argv = process.argv) {
             return runNugetCentralVersionCommand(parsed.args);
         case 'swift-semantic-equal':
             return runSwiftSemanticEqualCommand(parsed.args);
+        case 'post-review':
+            return runPostReviewCommand();
+        case 'stage-review-payload':
+            return runStageReviewPayloadCommand(parsed.args);
         case 'http-origin':
             return runHttpOrigin(parsed.field, parsed.value);
         case 'gha-artifacts-cleanup':

package/dist/cli/parse.d.mts

@@ -30,6 +30,12 @@ export type ParsedCli = {
 } | {
     kind: 'swift-semantic-equal';
     args: string[];
+} | {
+    kind: 'post-review';
+    args: string[];
+} | {
+    kind: 'stage-review-payload';
+    args: string[];
 } | {
     kind: 'http-origin';
     field: string;

package/dist/cli/parse.mjs

@@ -41,6 +41,10 @@ export function parseCli(argv) {
         return { kind: 'nuget-central-version', args: rest };
     if (command === 'swift-semantic-equal')
         return { kind: 'swift-semantic-equal', args: rest };
+    if (command === 'post-review')
+        return { kind: 'post-review', args: rest };
+    if (command === 'stage-review-payload')
+        return { kind: 'stage-review-payload', args: rest };
     if (command === 'http-origin')
         return parseHttpOrigin(rest);
     if (command === 'gha-artifacts-cleanup')

package/dist/cli/usage.d.mts

@@ -1,2 +1,2 @@
-export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n  run-with-timeout              Run a command with GNU timeout or a Perl fallback\n  lint-links                    Two-pass lychee: internal links fail, external warn\n  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl\n  wait-for-apt-locks            Wait until apt/dpkg lock files are free\n  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json\n  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN\n  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta\n  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\nhost-pressure-diagnostics\nallocate-browser-safe-ports [count] [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]\nrun-with-timeout <timeout-seconds> <kill-after-seconds> <command...>\nlint-links [--offline] [--config PATH] [--glob PATTERN] [files...]\nmaterialize-pr-context\nwait-for-apt-locks\ninstall-playwright-chromium-arm64 [name:archive...]\nghcr-package-retention <url-encoded-package>...\nnuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>\nswift-semantic-equal <base> <head> <file.swift>\n";
+export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n  run-with-timeout              Run a command with GNU timeout or a Perl fallback\n  lint-links                    Two-pass lychee: internal links fail, external warn\n  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl\n  wait-for-apt-locks            Wait until apt/dpkg lock files are free\n  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json\n  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN\n  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta\n  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace\n  post-review                   Post one COMMENT review from a staged payload file\n  stage-review-payload          Validate a review payload file into a staging directory\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\nhost-pressure-diagnostics\nallocate-browser-safe-ports [count] [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]\nrun-with-timeout <timeout-seconds> <kill-after-seconds> <command...>\nlint-links [--offline] [--config PATH] [--glob PATTERN] [files...]\nmaterialize-pr-context\nwait-for-apt-locks\ninstall-playwright-chromium-arm64 [name:archive...]\nghcr-package-retention <url-encoded-package>...\nnuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>\nswift-semantic-equal <base> <head> <file.swift>\npost-review\nstage-review-payload optional|required <source> <destination>\n";
 export declare function printUsage(stream?: NodeJS.WritableStream): void;

package/dist/cli/usage.mjs

@@ -28,6 +28,8 @@ Commands:
   ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN
   nuget-central-version         Validate a Directory.Packages.props PackageVersion delta
   swift-semantic-equal          Compare Swift sources ignoring comments and whitespace
+  post-review                   Post one COMMENT review from a staged payload file
+  stage-review-payload          Validate a review payload file into a staging directory
 
 Options:
   -h, --help       Show this help
@@ -78,6 +80,8 @@ install-playwright-chromium-arm64 [name:archive...]
 ghcr-package-retention <url-encoded-package>...
 nuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>
 swift-semantic-equal <base> <head> <file.swift>
+post-review
+stage-review-payload optional|required <source> <destination>
 `;
 export function printUsage(stream = process.stdout) {
     stream.write(USAGE);

package/dist/gha-post-review/claude-token.d.mts

@@ -0,0 +1,25 @@
+export declare const CLAUDE_OIDC_AUDIENCE = "claude-code-github-action";
+export declare const CLAUDE_APP_TOKEN_EXCHANGE_URL = "https://api.anthropic.com/api/github/github-app-token-exchange";
+export declare const CLAUDE_POSTER_PERMISSIONS: {
+    readonly contents: 'read';
+    readonly pull_requests: 'write';
+};
+export declare const GITHUB_INSTALLATION_TOKEN_URL = "https://api.github.com/installation/token";
+export type FetchLike = (url: string, init: RequestInit) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+export type ClaudeTokenIo = {
+    getOidcToken(): Promise<string>;
+    fetch: FetchLike;
+    mask(token: string): void;
+};
+export declare function oidcTokenRequest(env: NodeJS.ProcessEnv): {
+    url: string;
+    token: string;
+};
+export declare function mintClaudeAppToken(io: ClaudeTokenIo): Promise<string>;
+export declare function revokeClaudeAppToken(token: string, io: Pick<ClaudeTokenIo, 'fetch'>): Promise<void>;
+export declare function withClaudeAppToken<T>(io: ClaudeTokenIo, fn: (token: string) => T | Promise<T>): Promise<T>;
+export declare function createActionsClaudeTokenIo(env?: NodeJS.ProcessEnv, fetchImpl?: FetchLike): ClaudeTokenIo;

package/dist/gha-post-review/claude-token.mjs

@@ -0,0 +1,107 @@
+import { ReviewPayloadError as PostReviewError } from '../gha-review-payload/index.mjs';
+export const CLAUDE_OIDC_AUDIENCE = 'claude-code-github-action';
+export const CLAUDE_APP_TOKEN_EXCHANGE_URL = 'https://api.anthropic.com/api/github/github-app-token-exchange';
+// Anthropic rejects the exchange unless custom permissions include contents
+// (read or write), even when the token is only used to POST /reviews.
+export const CLAUDE_POSTER_PERMISSIONS = {
+    contents: 'read',
+    pull_requests: 'write',
+};
+export const GITHUB_INSTALLATION_TOKEN_URL = 'https://api.github.com/installation/token';
+export function oidcTokenRequest(env) {
+    const base = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const token = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!base || !token) {
+        throw new PostReviewError('OIDC token request env is missing.');
+    }
+    const separator = base.includes('?') ? '&' : '?';
+    return {
+        url: `${base}${separator}audience=${encodeURIComponent(CLAUDE_OIDC_AUDIENCE)}`,
+        token,
+    };
+}
+function readToken(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return '';
+    const record = payload;
+    const token = record.token ?? record.app_token ?? record.value;
+    return typeof token === 'string' ? token : '';
+}
+function readErrorMessage(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return '';
+    const record = payload;
+    if (typeof record.message === 'string' && record.message.length > 0)
+        return record.message;
+    const nested = record.error;
+    if (nested !== null && typeof nested === 'object') {
+        const message = nested.message;
+        if (typeof message === 'string')
+            return message;
+    }
+    return '';
+}
+function exchangeErrorMessage(status, payload) {
+    const detail = readErrorMessage(payload);
+    const suffix = detail.length > 0 ? `: ${detail}` : '';
+    return `Claude App token exchange failed (HTTP ${status})${suffix}.`;
+}
+export async function mintClaudeAppToken(io) {
+    const oidcToken = await io.getOidcToken();
+    const response = await io.fetch(CLAUDE_APP_TOKEN_EXCHANGE_URL, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${oidcToken}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ permissions: CLAUDE_POSTER_PERMISSIONS }),
+    });
+    if (!response.ok) {
+        throw new PostReviewError(exchangeErrorMessage(response.status, await response.json().catch(() => null)));
+    }
+    const appToken = readToken(await response.json());
+    if (appToken.length === 0) {
+        throw new PostReviewError('Claude App token exchange returned no token.');
+    }
+    io.mask(appToken);
+    return appToken;
+}
+export async function revokeClaudeAppToken(token, io) {
+    await io.fetch(GITHUB_INSTALLATION_TOKEN_URL, {
+        method: 'DELETE',
+        headers: {
+            Accept: 'application/vnd.github+json',
+            Authorization: `Bearer ${token}`,
+        },
+    });
+}
+export async function withClaudeAppToken(io, fn) {
+    const token = await mintClaudeAppToken(io);
+    try {
+        return await fn(token);
+    }
+    finally {
+        await revokeClaudeAppToken(token, io);
+    }
+}
+export function createActionsClaudeTokenIo(env = process.env, fetchImpl = fetch) {
+    return {
+        async getOidcToken() {
+            const request = oidcTokenRequest(env);
+            const response = await fetchImpl(request.url, {
+                headers: { Authorization: `Bearer ${request.token}` },
+            });
+            if (!response.ok) {
+                throw new PostReviewError(`OIDC token request failed (HTTP ${response.status}).`);
+            }
+            const jwt = readToken(await response.json());
+            if (jwt.length === 0)
+                throw new PostReviewError('OIDC token request returned no token.');
+            return jwt;
+        },
+        fetch: fetchImpl,
+        mask(token) {
+            process.stdout.write(`::add-mask::${token}\n`);
+        },
+    };
+}

package/dist/gha-post-review/cli.d.mts

@@ -0,0 +1 @@
+export declare function runPostReviewCli(env?: NodeJS.ProcessEnv): Promise<number>;

package/dist/gha-post-review/cli.mjs

@@ -0,0 +1,22 @@
+import { fileURLToPath } from 'node:url';
+import { writePostedOutput, postReviewFromEnv } from './github.mjs';
+export async function runPostReviewCli(env = process.env) {
+    try {
+        const result = await postReviewFromEnv(env);
+        writePostedOutput(result.posted, env.GITHUB_OUTPUT);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
+/* v8 ignore next 12 */
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    runPostReviewCli().then((code) => {
+        process.exitCode = code;
+    }, (error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/gha-post-review/github.d.mts

@@ -0,0 +1,20 @@
+import { execFileSync } from 'node:child_process';
+import { type PostResult, type PostReviewIo, type SanitizedReview } from './post.mts';
+export type GhExec = (args: readonly string[], options?: {
+    input?: string;
+    env?: NodeJS.ProcessEnv;
+}) => string;
+export declare function createGhExec(exec?: typeof execFileSync): GhExec;
+export declare function postWithGh(repository: string, prNumber: string, payload: SanitizedReview, token: string, exec: GhExec): PostResult;
+export declare function writePostedOutput(posted: boolean, outputPath?: string | undefined): void;
+export declare function createGhPostReviewIo(options: {
+    repository: string;
+    prNumber: string;
+    payloadPath: string;
+    payloadBytes: Buffer;
+    token: string;
+    exec: GhExec;
+}): PostReviewIo;
+export declare function postReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<{
+    posted: boolean;
+}>;

package/dist/gha-post-review/github.mjs

@@ -0,0 +1,77 @@
+import { execFileSync } from 'node:child_process';
+import { appendFileSync, rmSync } from 'node:fs';
+import { parseReviewFilesJson } from '../gha-review-payload/index.mjs';
+import { ReviewPayloadError } from '../gha-review-payload/index.mjs';
+import { createActionsClaudeTokenIo, withClaudeAppToken } from './claude-token.mjs';
+import { runPostReview } from './post.mjs';
+import { requireEnv, resolveReviewPostToken } from './token.mjs';
+import { readRegularReviewPayload } from '../gha-review-payload/index.mjs';
+export function createGhExec(exec = execFileSync) {
+    return (args, options) => exec('gh', [...args], {
+        encoding: 'utf8',
+        input: options?.input,
+        env: options?.env ?? process.env,
+    }).trim();
+}
+export function postWithGh(repository, prNumber, payload, token, exec) {
+    try {
+        exec(['api', '--method', 'POST', `repos/${repository}/pulls/${prNumber}/reviews`, '--input', '-'], {
+            input: JSON.stringify(payload),
+            env: { ...process.env, GH_TOKEN: token, GITHUB_TOKEN: token },
+        });
+        return { ok: true, status: 201, body: '' };
+    }
+    catch (error) {
+        const err = error;
+        const text = `${err.stdout ?? ''}${err.stderr ?? ''}${err.message ?? ''}`;
+        const status = Number(/HTTP\s+(\d{3})/u.exec(text)?.[1] ?? 0);
+        return { ok: false, status, body: text };
+    }
+}
+export function writePostedOutput(posted, outputPath = process.env.GITHUB_OUTPUT) {
+    if (!outputPath)
+        return;
+    appendFileSync(outputPath, `posted=${posted ? 'true' : 'false'}\n`);
+}
+export function createGhPostReviewIo(options) {
+    const { repository, prNumber, payloadBytes, token, exec } = options;
+    return {
+        readFile() {
+            return payloadBytes;
+        },
+        removeFile(path) {
+            rmSync(path, { force: true });
+        },
+        getHeadSha() {
+            const sha = exec(['api', `repos/${repository}/pulls/${prNumber}`, '--jq', '.head.sha']);
+            if (!/^[0-9a-f]{40}$/u.test(sha)) {
+                throw new ReviewPayloadError(`Could not resolve PR head SHA (got "${sha}").`);
+            }
+            return sha;
+        },
+        listPullFiles() {
+            return parseReviewFilesJson(exec(['api', '--paginate', `repos/${repository}/pulls/${prNumber}/files?per_page=100`]));
+        },
+        postReview(payload) {
+            return postWithGh(repository, prNumber, payload, token, exec);
+        },
+    };
+}
+export async function postReviewFromEnv(env = process.env, exec = createGhExec(), claudeIo = createActionsClaudeTokenIo(env)) {
+    const repository = requireEnv('GITHUB_REPOSITORY', env);
+    const prNumber = requireEnv('PR_NUMBER', env);
+    const payloadPath = requireEnv('CODE_REVIEW_PAYLOAD_PATH', env);
+    const payloadBytes = readRegularReviewPayload(payloadPath, 'required');
+    const postWithToken = (token) => runPostReview(payloadPath, createGhPostReviewIo({
+        repository,
+        prNumber,
+        payloadPath,
+        payloadBytes,
+        token,
+        exec,
+    }));
+    const token = resolveReviewPostToken(env);
+    if (token.source === 'github-token')
+        return postWithToken(token.token);
+    return await withClaudeAppToken(claudeIo, postWithToken);
+}

package/dist/gha-post-review/index.d.mts

@@ -0,0 +1,9 @@
+export { MAX_COMMENTS, MAX_PAYLOAD_BYTES, PostReviewError, runPostReview } from './post.mts';
+export type { PostResult, PostReviewIo, PullFile, ReviewComment, SanitizedReview } from './post.mts';
+export { requireEnv, resolveReviewPostToken } from './token.mts';
+export type { ReviewPostToken } from './token.mts';
+export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from './claude-token.mts';
+export type { ClaudeTokenIo, FetchLike } from './claude-token.mts';
+export { createGhExec, createGhPostReviewIo, postReviewFromEnv, postWithGh, writePostedOutput, } from './github.mts';
+export type { GhExec } from './github.mts';
+export { runPostReviewCli } from './cli.mts';

package/dist/gha-post-review/index.mjs

@@ -0,0 +1,5 @@
+export { MAX_COMMENTS, MAX_PAYLOAD_BYTES, PostReviewError, runPostReview } from './post.mjs';
+export { requireEnv, resolveReviewPostToken } from './token.mjs';
+export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from './claude-token.mjs';
+export { createGhExec, createGhPostReviewIo, postReviewFromEnv, postWithGh, writePostedOutput, } from './github.mjs';
+export { runPostReviewCli } from './cli.mjs';

package/dist/gha-post-review/post.d.mts

@@ -0,0 +1,18 @@
+import { type ReviewFile, type SanitizedReview } from '../gha-review-payload/index.mts';
+export { MAX_REVIEW_COMMENTS as MAX_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES as MAX_PAYLOAD_BYTES, ReviewPayloadError as PostReviewError, type ReviewComment, type SanitizedReview, } from '../gha-review-payload/index.mts';
+export type PullFile = ReviewFile;
+export type PostResult = {
+    ok: boolean;
+    status: number;
+    body: string;
+};
+export type PostReviewIo = {
+    readFile(path: string): Buffer;
+    removeFile(path: string): void;
+    getHeadSha(): string;
+    listPullFiles(): PullFile[];
+    postReview(payload: SanitizedReview): PostResult;
+};
+export declare function runPostReview(payloadPath: string, io: PostReviewIo): {
+    posted: boolean;
+};

package/dist/gha-post-review/post.mjs

@@ -0,0 +1,27 @@
+import { ReviewPayloadError, bodyOnlyReviewFallback, indexReviewFiles, parseReviewPayload, remapReviewComments, } from '../gha-review-payload/index.mjs';
+export { MAX_REVIEW_COMMENTS as MAX_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES as MAX_PAYLOAD_BYTES, ReviewPayloadError as PostReviewError, } from '../gha-review-payload/index.mjs';
+export function runPostReview(payloadPath, io) {
+    try {
+        let review = parseReviewPayload(io.readFile(payloadPath), io.getHeadSha());
+        try {
+            review = remapReviewComments(review, indexReviewFiles(io.listPullFiles()));
+        }
+        catch {
+            // Keep the parsed review when the PR file list is unavailable.
+        }
+        const first = io.postReview(review);
+        if (first.ok)
+            return { posted: true };
+        if (first.status !== 422) {
+            throw new ReviewPayloadError(`GitHub review POST failed (HTTP ${first.status}).`);
+        }
+        const retry = io.postReview(bodyOnlyReviewFallback(review, first.status));
+        if (!retry.ok) {
+            throw new ReviewPayloadError(`GitHub review POST retry failed (HTTP ${retry.status}).`);
+        }
+        return { posted: true };
+    }
+    finally {
+        io.removeFile(payloadPath);
+    }
+}

package/dist/gha-post-review/token.d.mts

@@ -0,0 +1,8 @@
+export type ReviewPostToken = {
+    source: 'github-token';
+    token: string;
+} | {
+    source: 'claude-app';
+};
+export declare function resolveReviewPostToken(env?: NodeJS.ProcessEnv): ReviewPostToken;
+export declare function requireEnv(name: string, env?: NodeJS.ProcessEnv): string;

package/dist/gha-post-review/token.mjs

@@ -0,0 +1,20 @@
+import { ReviewPayloadError } from '../gha-review-payload/index.mjs';
+export function resolveReviewPostToken(env = process.env) {
+    const source = env.CODE_REVIEW_TOKEN_SOURCE || 'claude-app';
+    if (source === 'github-token') {
+        const token = env.GH_TOKEN || env.GITHUB_TOKEN;
+        if (!token)
+            throw new ReviewPayloadError('GH_TOKEN or GITHUB_TOKEN is required.');
+        return { source, token };
+    }
+    if (source !== 'claude-app') {
+        throw new ReviewPayloadError(`Unknown CODE_REVIEW_TOKEN_SOURCE "${source}".`);
+    }
+    return { source: 'claude-app' };
+}
+export function requireEnv(name, env = process.env) {
+    const value = env[name];
+    if (!value)
+        throw new ReviewPayloadError(`${name} is required.`);
+    return value;
+}

package/dist/gha-review-payload/cli.d.mts

@@ -0,0 +1 @@
+export declare function runStageReviewPayloadCli(args: readonly string[]): number;

package/dist/gha-review-payload/cli.mjs

@@ -0,0 +1,24 @@
+import { fileURLToPath } from 'node:url';
+import { ReviewPayloadError } from './payload.mjs';
+import { stageReviewPayload, writeStagedOutput } from './file.mjs';
+export function runStageReviewPayloadCli(args) {
+    try {
+        const [requirement, source, destination] = args;
+        if (requirement !== 'optional' && requirement !== 'required') {
+            throw new ReviewPayloadError('payload requirement must be optional or required.');
+        }
+        if (!source || !destination || args.length !== 3) {
+            throw new ReviewPayloadError('Usage: vouchington stage-review-payload optional|required <source> <destination>');
+        }
+        writeStagedOutput('staged', stageReviewPayload(source, destination, requirement) ? 'true' : 'false');
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
+/* v8 ignore next 3 */
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    process.exitCode = runStageReviewPayloadCli(process.argv.slice(2));
+}

package/dist/index.d.mts

@@ -33,6 +33,8 @@ export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mts'
 export type { AstGrepRuleInvocation, RunAstGrepRuleOptions } from './ast-grep-rule/index.mts';
 export { bodyOnlyReviewFallback, indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mts';
 export type { CommentableIndex, CommentableLine, LineKind, PayloadRequirement, ReviewComment, ReviewFile, ReviewSide, SanitizedReview, } from './gha-review-payload/index.mts';
+export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, PostReviewError, requireEnv, resolveReviewPostToken, revokeClaudeAppToken, runPostReview, runPostReviewCli, withClaudeAppToken, } from './gha-post-review/index.mts';
+export type { ClaudeTokenIo, PostResult, PostReviewIo, PullFile, ReviewPostToken, } from './gha-post-review/index.mts';
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mts';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mts';
 export type { ExpectedTransportIdentity, ObjectSigner, PresignIdentity, TransportControl, } from './coverage-transport/index.mts';

package/dist/index.mjs

@@ -19,6 +19,7 @@ export { escapeSpreadsheetFormula, parseCsvRows, streamCsvRows, stripCsvBom } fr
 export { MissingResponseBodyError, readResponseBody, readResponseBodyAsBuffer, ResponseBodyTooLargeError, } from './http-body/index.mjs';
 export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mjs';
 export { bodyOnlyReviewFallback, indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mjs';
+export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, PostReviewError, requireEnv, resolveReviewPostToken, revokeClaudeAppToken, runPostReview, runPostReviewCli, withClaudeAppToken, } from './gha-post-review/index.mjs';
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mjs';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mjs';
 export { EPOCH_PRUNED_AT, normalizeDeployedLayer, pruneDeployedRuntimeDeps, restoreDeployedWorkspacePackages, } from './pnpm-deploy/index.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.0.17",
+  "version": "0.0.19",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -125,6 +125,11 @@
       "import": "./dist/gha-review-payload/index.mjs",
       "default": "./dist/gha-review-payload/index.mjs"
     },
+    "./gha-post-review": {
+      "types": "./dist/gha-post-review/index.d.mts",
+      "import": "./dist/gha-post-review/index.mjs",
+      "default": "./dist/gha-post-review/index.mjs"
+    },
     "./http-link-pagination": {
       "types": "./dist/http-link-pagination/index.d.mts",
       "import": "./dist/http-link-pagination/index.mjs",