fix(webhook): subscribe to inline review comments

[defangdevs]

Fixes #713

Motivation

Standing watches already match mentions in comment.body, including inline PR review comments, but the GitHub hook registration command omitted pull_request_review_comment. The initial review could arrive through pull_request_review; edits and replies to inline comments never reached the receiver.

Changes

• include pull_request_review_comment in the ready-made gh api hook registration command
• assert the event remains present in the webhook VM setup output
• regenerate the single-file module and golden webhook payload

Validation

• nix build -L --keep-going .#checks.aarch64-linux.module-generated-up-to-date .#checks.aarch64-linux.assemble-module-escaping .#checks.aarch64-linux.backend-parity .#checks.aarch64-linux.one-spec-both-backends .#checks.aarch64-linux.golden-snapshot
• python3 tests/test_agentbox.py (151 tests, 1 skipped)
• nix build -L --keep-going .#packages.aarch64-linux.ci-native
• x86 webhook test script evaluates to 112,891 bytes, below the 128 KiB kernel ceiling
• x86 webhook VM execution (CI; passed in 4m48s)

Review

• Correctness: the event name is GitHub’s repository-hook event and the existing created/edited + comment.body watch predicate handles its payload shape.
• Security: no trust boundary changes; the additional event uses the existing per-source HMAC verification and standing-watch sender/body predicates.
• Live verification: updated the defangdevs/local-channels hook and confirmed its returned event list contains pull_request_review_comment; the defangdevs/agent-box hook already contained it.

User-visible effect

Newly registered hooks receive inline PR review-comment creation, edit, and reply events. Existing hooks must add that GitHub event once; the live hooks for this box are already updated.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: cc1e33ce-e897-4e57-99ec-52d794ace230

📥 Commits

Reviewing files that changed from the base of the PR and between 295ca74 and 026339a.

📒 Files selected for processing (4)

• modules/agent-box.nix
• modules/src/webhook-cli.sh
• tests/golden/web/payloads/agent-box-webhook/bin/agent-box-webhook
• tests/webhook.nix

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The GitHub webhook registration now subscribes to pull_request_review_comment. The setup guidance and generated artifact include the event, and the VM test checks that the setup output contains it.

Changes

GitHub webhook event registration

Layer / File(s)	Summary
Update webhook registration sources modules/agent-box.nix, modules/src/webhook-cli.sh	The webhook event list now includes pull_request_review_comment alongside pull_request_review and issue_comment.
Regenerate and validate setup output tests/golden/web/payloads/agent-box-webhook/bin/agent-box-webhook, tests/webhook.nix	The committed setup artifact includes the new event, and the VM test asserts that the setup output contains it.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: lionello

Merge Risk: ⚪ Minimal · up to 02633

No concrete current-head risk remains for this webhook registration change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Issue #713 requires GitHub standing-watch registration for pull_request_review_comment, regression coverage, and regenerated artifacts. The PR summary shows this event in both `modules/agent-box.nix…
Out of Scope Changes check	✅ Passed	The reported changes are limited to webhook event registration, the corresponding generated golden artifact, and regression coverage. Each change directly supports issue #713. No unrelated change is i…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Title check	✅ Passed	The title clearly and concisely describes the main change: adding subscription support for inline review comments.
Description check	✅ Passed	The description directly explains the motivation, implementation, tests, security review, and user-visible effect of the webhook change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/713-review-comment-hooks

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}