a27f1fa7df
issue-comment.sh called the non-existent `tea issue comment` subcommand form; tea 0.11.1 silently no-ops and exits 0 instead of erroring, producing a false-success write. Switch to the top-level `tea comment <index> <body>` form and add fail-closed REST read-back verification so the wrapper no longer trusts tea's exit code alone. pr-review.sh's comment path was already fixed for this bug by #812/#835 (routes through a read-back-verified REST comment API instead of any tea comment subcommand); this change formalizes an explicit --login override flag there too and documents the after-detection last-wins --login ordering, consistent with issue-comment.sh. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Git provider wrappers
These scripts provide host-aware GitHub and Gitea issue, pull-request, milestone, and CI operations.
Durable review provenance
A successful provider write command—or a wrapper message based only on that command's exit code—is not durable review provenance. Review comments count as durable provenance only after the wrapper reads the created provider record back and verifies that it belongs to the intended repository and pull request and contains the exact submitted body (or verifies the provider-returned record ID).
pr-review.sh therefore fails closed when a Gitea comment cannot be written, its created comment ID cannot be identified, or provider read-back does not match. It reports comment success only after that read-back verification passes.
issue-comment.sh applies the same fail-closed read-back verification to issue comments: after posting via tea comment, it independently re-fetches the issue's comments via the Gitea REST API and confirms one matches the submitted body before reporting success.
tea invocation notes (Gitea)
- tea v0.11.1 has no
commentsubcommand undertea prortea issue. The correct invocation is the top-leveltea comment <index> <body> [--repo ...] [--login ...]. Thetea pr comment/tea issue commentforms don't error — tea silently falls through to a no-op and still exits 0, producing a false-success write (#865). Always use the top-level form. tea pr approveandtea pr rejecttake an optional review comment/reason as a trailing positional argument, not a--comment/-commentflag (that flag does not exist on those subcommands).pr-review.shavoids this positional form entirely for the approve/reject actions and instead posts any review comment through the same durable, read-back-verified comment API used for thecommentaction (see #835/#812) — the trailing-positional form remains available to callers who invoketeadirectly, but is not used by these wrappers.
--login passthrough
Both pr-review.sh and issue-comment.sh accept an optional --login <name> flag that overrides the automatically detected Gitea tea login for that single invocation. The override is appended to the tea command line after the detected default (get_gitea_repo_args() / get_gitea_login[_for_host]()), because tea honors only the last --login flag on its command line — an override placed before the default would be silently clobbered by it. Callers who need a different login than the host default should pass --login <reviewer-login> rather than relying on ordering tricks or re-invoking tea login globally.
As a durable successor to this mechanism, consider giving each reviewer/approver slot its own dedicated Gitea login credential, so that author≠reviewer holds at the credential level rather than relying on wrapper-level --login bookkeeping. This is a recommendation for future hardening, not something implemented by this flag.