Split author and reviewer tokens

action.yml

@@ -5,8 +5,15 @@ inputs:
   bot-type:
     description: Which bot to run, either `codex` or `claude`
     required: true
-  gitea-token:
+  author-token:
-    description: Gitea access token for API calls and pushes
+    description: >-
+      Gitea token of the account that commits, pushes, and opens pull requests.
+      The agent sees it as `GITEA_TOKEN`.
+    required: true
+  reviewer-token:
+    description: >-
+      Gitea token of the bot account that posts comments and pull request
+      reviews. Never exposed to the agent, so it must differ from the author.
     required: true
   bot-token:
     description: API key or token for the selected bot
@@ -29,7 +36,8 @@ runs:
         ACTION_PATH: ${{ gitea.action_path }}
         GITEA_API_URL: ${{ gitea.api_url }}
         GITEA_REPOSITORY: ${{ gitea.repository }}
-        GITEA_TOKEN: ${{ inputs.gitea-token }}
+        GITEA_TOKEN: ${{ inputs.author-token }}
+        REVIEWER_TOKEN: ${{ inputs.reviewer-token }}
         BOT_TOKEN: ${{ inputs.bot-token }}
         EVENT_NAME: ${{ gitea.event_name }}
         ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}

scripts/lib.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Shared by the run-*.sh scripts. Everything the scripts post goes through the
+# reviewer token, so it appears as the bot account. The agent only ever sees the
+# author token as GITEA_TOKEN, which is what pushes and opens pull requests.
+
+ISSUE_URL="${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/issues/${ISSUE_INDEX}"
+PULL_URL="${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/pulls/${ISSUE_INDEX}"
+COMMENT_FILE="$(mktemp)"
+
+gitea_api() {
+  curl --fail-with-body --silent --show-error \
+    -H "Authorization: token ${1}" \
+    -H "Content-Type: application/json" \
+    "${@:2}"
+}
+
+# Commits are made by the author account so the pull request and its commits
+# belong to the same person.
+configure_git_author() {
+  AUTHOR="$(gitea_api "${GITEA_TOKEN}" "${GITEA_API_URL}/user")"
+  git config --global user.name "$(jq -r '.login' <<< "${AUTHOR}")"
+  git config --global user.email \
+    "$(jq -r '.email // empty' <<< "${AUTHOR}")"
+}
+
+post_comment() {
+  gitea_api "${REVIEWER_TOKEN}" -X POST \
+    --data "$(jq -n --rawfile body "${COMMENT_FILE}" '{body: $body}')" \
+    "${ISSUE_URL}/comments"
+}
+
+# A pull request event is a review request, so the response becomes a review
+# rather than a comment: it requests changes when the agent asked @bot to fix
+# something, only comments when the run failed, and approves otherwise.
+post_result() {
+  if [ "${EVENT_NAME}" != pull_request ]; then
+    post_comment
+    return
+  fi
+  local event=APPROVED
+  if grep -q '@bot' "${COMMENT_FILE}"; then
+    event=REQUEST_CHANGES
+  elif grep -q '^Bot failed:' "${COMMENT_FILE}"; then
+    event=COMMENT
+  fi
+  gitea_api "${REVIEWER_TOKEN}" -X POST \
+    --data "$(jq -n --rawfile body "${COMMENT_FILE}" --arg event "${event}" \
+      '{body: $body, event: $event}')" \
+    "${PULL_URL}/reviews"
+}
+
+render_prompt() {
+  export ISSUE_COMMENTS="$(
+    gitea_api "${REVIEWER_TOKEN}" "${ISSUE_URL}/comments?limit=100" \
+      | jq -r '.[] | "## " + .user.login + " at " + .created_at + "\n\n" + .body + "\n"'
+  )"
+  envsubst < "${ACTION_PATH}/scripts/prompt.md"
+}

scripts/prompt.md

@@ -13,11 +13,13 @@ response ends, so background monitors, scheduled wake-ups, and queued tasks
 never resume. Never promise future action and never claim to be waiting on a
 notification.
 
-For a `pull_request` event, review the newly opened PR without changing code. If
+For a `pull_request` event, review the PR without changing code. Your final
-changes are needed, include `@bot` in the final response with instructions to
+response is posted as a pull request review from the bot account: it requests
-fix the findings. Otherwise, do not mention `@bot`. For UI changes, check that
+changes when it mentions `@bot` and approves otherwise. So include `@bot` with
-the result is aligned, clean, and pixel-perfect, and that included screenshots
+instructions to fix the findings exactly when changes are needed, and never
-prove the intended result was achieved.
+mention `@bot` when the PR is ready. For UI changes, check that the result is
+aligned, clean, and pixel-perfect, and that included screenshots prove the
+intended result was achieved.
 
 For an `issue_comment` or `pull_request_review_comment` event, treat the `body`
 in the triggering comment payload below as the user's exact instruction.
@@ -65,4 +67,6 @@ ${ISSUE_COMMENTS}
 - API URL: `${GITEA_API_URL}`
 - Repository: `${GITEA_REPOSITORY}`
 - Issue index: `${ISSUE_INDEX}`
-- Use the `GITEA_TOKEN` environment variable for authenticated Gitea API calls.
+- Use the `GITEA_TOKEN` environment variable for authenticated Gitea API calls
+  and pushes. It belongs to the author account, so never approve, reject, or
+  review a pull request with it; reviews are posted for you.

scripts/run-claude.sh

@@ -1,20 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-git config --global user.name bot
+. "${ACTION_PATH}/scripts/lib.sh"
-git config --global user.email noreply@capsulizers.com
 
-COMMENT_FILE="$(mktemp)"
+configure_git_author
-
-post_comment() {
-  COMMENT_JSON="$(jq -n --rawfile body "${COMMENT_FILE}" '{body: $body}')"
-  curl --fail-with-body --silent --show-error \
-    -X POST \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    -H "Content-Type: application/json" \
-    --data "${COMMENT_JSON}" \
-    "${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/issues/${ISSUE_INDEX}/comments"
-}
 
 if [ -z "${BOT_TOKEN:-}" ]; then
   echo 'Run `claude setup-token` locally and set the `bot-token` action input.' > "${COMMENT_FILE}"
@@ -23,14 +12,7 @@ if [ -z "${BOT_TOKEN:-}" ]; then
 fi
 export CLAUDE_CODE_OAUTH_TOKEN="${BOT_TOKEN}"
 
-export ISSUE_COMMENTS="$(
+FINAL_PROMPT="$(render_prompt)"
-  curl --fail-with-body --silent --show-error \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    "${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/issues/${ISSUE_INDEX}/comments?limit=100" \
-    | jq -r '.[] | "## " + .user.login + " at " + .created_at + "\n\n" + .body + "\n"'
-)"
-
-FINAL_PROMPT="$(envsubst < "${ACTION_PATH}/scripts/prompt.md")"
 
 # Claude refuses --dangerously-skip-permissions as root outside a sandbox.
 export IS_SANDBOX=1
@@ -38,6 +20,8 @@ export IS_SANDBOX=1
 # Stream events so the runner sees output and does not kill the job as a zombie.
 STREAM_FILE="$(mktemp)"
 
+# The reviewer token is unset so the agent cannot approve as the bot.
+env -u REVIEWER_TOKEN \
   claude --print --dangerously-skip-permissions --model claude-fable-5 \
   --output-format stream-json --verbose "${FINAL_PROMPT}" \
   | tee "${STREAM_FILE}" \
@@ -46,4 +30,4 @@ claude --print --dangerously-skip-permissions --model claude-fable-5 \
 jq -r 'select(.type == "result") | .result // ("Bot failed: " + .subtype)' "${STREAM_FILE}" \
   | ansifilter > "${COMMENT_FILE}"
 
-post_comment
+post_result

scripts/run-codex.sh

@@ -1,20 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-git config --global user.name bot
+. "${ACTION_PATH}/scripts/lib.sh"
-git config --global user.email noreply@capsulizers.com
 
-COMMENT_FILE="$(mktemp)"
+configure_git_author
-
-post_comment() {
-  COMMENT_JSON="$(jq -n --rawfile body "${COMMENT_FILE}" '{body: $body}')"
-  curl --fail-with-body --silent --show-error \
-    -X POST \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    -H "Content-Type: application/json" \
-    --data "${COMMENT_JSON}" \
-    "${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/issues/${ISSUE_INDEX}/comments"
-}
 
 if ! codex login status > /dev/null 2>&1; then
   codex login --device-auth 2>&1 | ansifilter > "${COMMENT_FILE}" &
@@ -26,18 +15,13 @@ if ! codex login status > /dev/null 2>&1; then
   post_comment
 fi
 
-export ISSUE_COMMENTS="$(
+FINAL_PROMPT="$(render_prompt)"
-  curl --fail-with-body --silent --show-error \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    "${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/issues/${ISSUE_INDEX}/comments?limit=100" \
-    | jq -r '.[] | "## " + .user.login + " at " + .created_at + "\n\n" + .body + "\n"'
-)"
-
-FINAL_PROMPT="$(envsubst < "${ACTION_PATH}/scripts/prompt.md")"
 
+# The reviewer token is unset so the agent cannot approve as the bot.
+env -u REVIEWER_TOKEN \
   codex exec --model gpt-5.5 \
   --dangerously-bypass-approvals-and-sandbox \
   --output-last-message "${COMMENT_FILE}" \
   "${FINAL_PROMPT}"
 
-post_comment
+post_result