Add address-pr-feedback workflow

.github/workflows/gh-aw-address-pr-feedback.md

@@ -0,0 +1,158 @@
+---
+inlined-imports: true
+name: "Address PR Feedback"
+description: "Auto-address PR review feedback — fix code, resolve threads, and push changes"
+imports:
+  - gh-aw-fragments/elastic-tools.md
+  - gh-aw-fragments/runtime-setup.md
+  - gh-aw-fragments/formatting.md
+  - gh-aw-fragments/rigor.md
+  - gh-aw-fragments/mcp-pagination.md
+  - gh-aw-fragments/workflow-edit-guardrails.md
+  - gh-aw-fragments/messages-footer.md
+  - gh-aw-fragments/safe-output-add-comment.md
+  - gh-aw-fragments/safe-output-push-to-pr.md
+  - gh-aw-fragments/safe-output-resolve-thread.md
+  - gh-aw-fragments/safe-output-reply-to-review-comment.md
+engine:
+  id: copilot
+  model: ${{ inputs.model }}
+  concurrency:
+    group: "gh-aw-copilot-address-pr-feedback-${{ github.event.pull_request.number }}"
+on:
+  workflow_call:
+    inputs:
+      model:
+        description: "AI model to use"
+        type: string
+        required: false
+        default: "gpt-5.3-codex"
+      additional-instructions:
+        description: "Repo-specific instructions appended to the agent prompt"
+        type: string
+        required: false
+        default: ""
+      setup-commands:
+        description: "Shell commands to run before the agent starts (dependency install, build, etc.)"
+        type: string
+        required: false
+        default: ""
+      allowed-bot-users:
+        description: "Allowlisted bot actor usernames (comma-separated)"
+        type: string
+        required: false
+        default: "github-actions[bot]"
+      messages-footer:
+        description: "Footer appended to all agent comments and reviews"
+        type: string
+        required: false
+        default: ""
+    secrets:
+      COPILOT_GITHUB_TOKEN:
+        required: true
+  roles: [admin, maintainer, write]
+  bots:
+    - "${{ inputs.allowed-bot-users }}"
+concurrency:
+  group: address-pr-feedback-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+tools:
+  github:
+    toolsets: [repos, issues, pull_requests, search]
+  bash: true
+  web-fetch:
+network:
+  allowed:
+    - defaults
+    - github
+    - go
+    - node
+    - python
+    - ruby
+strict: false
+timeout-minutes: 60
+steps:
+  - name: Ensure origin refs for PR patch generation
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      SERVER_URL: ${{ github.server_url }}
+      REPO_NAME: ${{ github.repository }}
+    run: |
+      SERVER_URL_STRIPPED="${SERVER_URL#https://}"
+      git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+      git fetch --no-tags --prune origin '+refs/heads/*:refs/remotes/origin/*'
+  - name: Repo-specific setup
+    if: ${{ inputs.setup-commands != '' }}
+    env:
+      SETUP_COMMANDS: ${{ inputs.setup-commands }}
+    run: eval "$SETUP_COMMANDS"
+---
+
+# Address PR Feedback
+
+Automatically address review feedback on pull requests in ${{ github.repository }} — fix code issues, resolve review threads, and push changes.
+
+## Context
+
+- **Repository**: ${{ github.repository }}
+- **PR**: #${{ github.event.pull_request.number }} — ${{ github.event.pull_request.title }}
+- **Review ID**: ${{ github.event.review.id }}
+
+## Constraints
+
+- **CAN**: Read files, search code, modify files locally, run tests and commands, reply to review comments, push to the PR branch (same-repo only), resolve review threads
+- **CANNOT**: Push to fork PR branches, merge PRs, delete branches, modify `.github/workflows/` files
+
+When pushing changes, the workspace already has the PR branch checked out. Make your changes, commit them locally, then use `push_to_pull_request_branch`.
+
+## Instructions
+
+Address the review feedback surgically — make only the minimum changes needed.
+
+### Step 1: Gather Context
+
+1. Call `generate_agents_md` to get the repository's coding guidelines and conventions. If this fails, continue without it.
+2. Call `pull_request_read` with method `get` on PR #${{ github.event.pull_request.number }} to get the full PR details (author, description, branches). Check whether this is a fork PR — if the head repo differs from the base repo, you cannot push changes.
+3. If the PR description references issues (e.g., "Fixes #123"), call `issue_read` with method `get` on each linked issue to understand the motivation and requirements.
+4. Call `pull_request_read` with method `get_review_comments` to get all review threads. Identify which threads are unresolved and need attention.
+5. Call `pull_request_read` with method `get_diff` to understand the current state of changes.
+
+### Step 2: Address Each Review Thread
+
+For each unresolved review thread:
+
+1. **Read and understand** the reviewer's feedback carefully.
+2. **Decide**: Is the feedback actionable? Use your judgment — don't blindly accept every suggestion.
+   - **If actionable**: Make the code change. Be surgical — change only what's needed to address the specific feedback.
+   - **If you disagree or it's unclear**: Call `reply_to_pull_request_review_comment` on the specific review comment to explain your reasoning inline. Do NOT resolve the thread — let the reviewer decide.
+3. **Track** which threads you addressed with code changes vs. which you replied to.
+
+### Step 3: Validate and Push
+
+1. Run required repo commands (lint/build/test) from README, CONTRIBUTING, DEVELOPING, Makefile, or CI config relevant to the changes and include results. If required commands cannot be run, explain why and do not push changes.
+2. Commit your changes locally with a descriptive message, then use `push_to_pull_request_branch` to push them.
+3. **Fork PRs**: If this is a fork PR, you cannot push. Reply explaining that you do not have permission to push to fork branches and suggest that the PR author apply the changes themselves. This is a GitHub security limitation.
+
+### Step 4: Resolve Addressed Threads
+
+After pushing, resolve each review thread you addressed with code changes by calling `resolve_pull_request_review_thread` with the thread's node ID (the `id` field from `get_review_comments`, e.g., `PRRT_kwDO...`). Only resolve threads you have actually addressed — do not resolve threads you skipped or disagreed with.
+
+### Step 5: Respond
+
+Call `add_comment` on the PR with a brief summary of:
+- Which review threads were addressed with code changes
+- Which threads you replied to instead of fixing
+- Tests run and their results
+
+Do NOT duplicate thread-specific explanations in the summary comment — those belong in the inline replies you already posted via `reply_to_pull_request_review_comment`.
+
+**Additional tools:**
+- `push_to_pull_request_branch` — push committed changes to the PR branch (same-repo PRs only)
+- `resolve_pull_request_review_thread` — resolve a review thread after addressing the feedback (pass the thread's node ID)
+- `reply_to_pull_request_review_comment` — reply inline to a specific review comment thread to explain your reasoning
+
+${{ inputs.additional-instructions }}

.github/workflows/gh-aw-fragments/safe-output-reply-to-review-comment.md

@@ -0,0 +1,12 @@
+---
+safe-outputs:
+  reply-to-pull-request-review-comment:
+    max: 10
+---
+
+## reply-to-pull-request-review-comment Limitations
+
+- **Required field**: `comment_id` — the ID of the review comment to reply to. This is the numeric REST comment ID from `get_review_comments`.
+- **Body**: Max 65,536 characters. Keep well under this limit.
+- **Purpose**: Reply directly to a specific review comment thread to explain your reasoning when you disagree with or skip feedback. Do NOT use `add_comment` for this — use this tool to keep replies in context.
+- **Max per run**: 10 replies per workflow run.

.github/workflows/trigger-address-pr-feedback.yml

@@ -0,0 +1,22 @@
+# This file is auto-generated by scripts/dogfood.sh. Do not edit directly.
+# Edit gh-agent-workflows/address-pr-feedback/example.yml and run 'make compile' to regenerate.
+name: Trigger Address PR Feedback
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  actions: read
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    if: >-
+      (github.event.review.state == 'changes_requested' || github.event.review.state == 'commented') &&
+      !github.event.pull_request.draft &&
+      !contains(github.event.pull_request.labels.*.name, 'skip-auto-address-pr-feedback')
+    uses: ./.github/workflows/gh-aw-address-pr-feedback.lock.yml
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

gh-agent-workflows/address-pr-feedback/README.md

@@ -0,0 +1,38 @@
+# Address PR Feedback
+
+Auto-address PR review feedback — fix code, resolve threads, and push changes.
+
+## How it works
+
+Triggered when a pull request review is submitted with `changes_requested` or `commented` state. Reads the open review threads, makes targeted code fixes, runs tests, pushes changes to the PR branch, and resolves addressed threads. Uses judgment to decide whether to fix or explain — does not blindly accept every suggestion.
+
+## Quick Install
+
+```bash
+mkdir -p .github/workflows && curl -sL \
+  https://raw.githubusercontent.com/elastic/ai-github-actions/v0/gh-agent-workflows/address-pr-feedback/example.yml \
+  -o .github/workflows/address-pr-feedback.yml
+```
+
+See [example.yml](example.yml) for the full workflow file.
+
+## Trigger
+
+| Event | Types | Condition |
+| --- | --- | --- |
+| `pull_request_review` | `submitted` | Review state is `changes_requested` or `commented`; PR is not draft; label `skip-auto-address-pr-feedback` is not present |
+
+## Inputs
+
+| Input | Description | Required | Default |
+| --- | --- | --- | --- |
+| `additional-instructions` | Repo-specific instructions appended to the agent prompt | No | `""` |
+| `setup-commands` | Shell commands run before the agent starts | No | `""` |
+| `allowed-bot-users` | Allowlisted bot actor usernames (comma-separated) | No | `github-actions[bot]` |
+
+## Safe Outputs
+
+- `add-comment` — reply to the PR conversation
+- `push-to-pull-request-branch` — push code changes to the PR branch
+- `resolve-pull-request-review-thread` — resolve review threads after addressing feedback
+- `reply-to-pull-request-review-comment` — reply inline to specific review comment threads

gh-agent-workflows/address-pr-feedback/example.yml

@@ -0,0 +1,20 @@
+name: Address PR Feedback
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  actions: read
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    if: >-
+      (github.event.review.state == 'changes_requested' || github.event.review.state == 'commented') &&
+      !github.event.pull_request.draft &&
+      !contains(github.event.pull_request.labels.*.name, 'skip-auto-address-pr-feedback')
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-address-pr-feedback.lock.yml@v0
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}