workaround: give review-responder bash tool for gh api graphql thread ID lookup

[microsasa]

What

Add a bash tool to the review-responder workflow allowing gh api graphql so the agent can query real PRRT_ thread node IDs instead of hallucinating them.

Why

The GitHub MCP server v0.32.0 (pinned by gh-aw) doesn't expose thread IDs to agents. The agent fabricates IDs that fail at the GraphQL API. Giving the agent shell access to gh api graphql lets it query real IDs directly.

How

Add to review-responder.md frontmatter:

tools:
  github:
    toolsets: [default]
  bash: ["gh api:*"]

Update instructions to tell the agent:

1. Use gh api graphql to query reviewThreads { nodes { id isResolved } } for the PR
2. Use the real PRRT_ IDs from the response in resolve calls

Security Consideration

This gives the agent shell access limited to gh api commands. The agent could potentially make other API calls. Evaluate whether this is acceptable or if a more restrictive pattern is needed.

Temporary Workaround

This is a workaround until gh-aw upgrades the pinned MCP server to v0.33.0+ (github/gh-aw#21130), which would let the agent resolve threads through the MCP tool directly.

Related

• tracking: upgrade gh-aw MCP server to get real thread IDs for review-responder #114 — Thread ID hallucination root cause
• Enhanced PR Rescue: resolve threads + request reviews + rebase behind-main #116 — Rescue workflow thread resolution (complementary approach)
• Upgrade pinned github-mcp-server from v0.32.0 to v0.33.0+ to fix thread resolution github/gh-aw#21130 — Upstream fix

[microsasa]

PR #130 added step 6 (GraphQL thread ID lookup) to review-responder.md, but the fix only applies to PRs whose head branch has the updated .md file. The lock file uses {{#runtime-import .github/workflows/review-responder.md}} — the prompt is loaded at runtime from the PR's head branch, not from main.

PR #113 was created before #130 merged, so its branch has the old instructions. The responder ran, replied to both threads, but still couldn't resolve them — same hallucinated thread IDs.

The instruction-only approach doesn't work for existing PRs. Options:

1. Rebase existing PRs onto main (picks up new .md)
2. The orchestrator resolves threads as a fallback (working — just triggered manually)
3. Revisit adding bash: ["gh:api:graphql"] to the tools config so it compiles into the lock file (but this breaks --allow-all-tools)

Reopening until we have a reliable fix that works for all PRs regardless of branch age.