fix: use push-to-pull-request-branch to stop creating stale fix-round PRs

[PureWeen]

Root cause: fix-review-findings used create-pull-request to push fixes. gh-aw deduplicates branch names by appending a hash (e.g., fix/issue-645-29d389b9), creating a NEW PR each time instead of pushing to the existing one.

Fix: switched to push-to-pull-request-branch safe output, which pushes commits directly to the existing PR branch. No more duplicate PRs.

[github-actions]

Expert Code Review — PR #820

Methodology: 3 independent reviewers with adversarial consensus

2 findings (1 posted inline, 1 below as overflow)

• 🟡 1 moderate — posted as inline comment
• 🟢 1 minor — outside diff, listed below

Overflow (outside diff — could not be posted inline)

#	Severity	Consensus	File	Line(s)	Finding
2	🟢 MINOR	3/3 (after follow-up)	fix-review-findings.lock.yml	403 vs 1282	Pre-existing: AGENTS.md in handler protected_files but not in agent-facing config.json. The enforcement layer catches AGENTS.md modifications, but the agent isn't warned upfront. Compiler artifact — fix in source .md or compiler, not the lock file.

Discarded findings (failed consensus)

• git add -A contradicts project conventions — 1/3 flagged; follow-up reviewer disagreed (pre-existing, CI context ≠ local dev conventions)
• Checkout PR branch skipped for workflow_dispatch — 1/3 flagged; both follow-up reviewers disagreed (push_to_pull_request_branch targets the PR branch at the framework level regardless of local checkout state)

CI Status

• ✅ pre_activation — success
• ✅ activation — success
• 🔄 agent — in progress (this review run)

Test Coverage

No tests are applicable — this PR modifies only gh-aw workflow files (.md source + compiled .lock.yml). The lock file is auto-generated by gh aw compile.

Generated by Expert Code Review · 3 independent reviewers with adversarial consensus

Generated by Expert Code Review (auto) for issue #820 · ● 31.3M · ◷

[github-actions]

Review Summary

Two findings, one critical:

🔴 CRITICAL — Parameter name mismatch in prompt example vs compiled tool schema

File: .github/workflows/fix-review-findings.md line 140
Schema: .github/workflows/fix-review-findings.lock.yml lines 544–562

The prompt instructs the agent to call push_to_pull_request_branch({ "pr_number": ... }) but the compiled schema defines the parameter as pull_request_number. The schema also requires branch and message (both required: true) which the example omits entirely.

If the agent follows the prompt example instead of the MCP tool definition, the push is rejected by the MCP gateway for missing required fields and unknown parameter name. The review-fix loop would complete all analysis and fixes but fail to deliver them — a silent data-loss scenario.

The platform-injected safe_outputs_push_to_pr_branch.md prompt likely has correct parameter names and may save the agent in most runs, but the conflicting prompt example increases failure probability.

🟡 MODERATE — Rule 6 contradicts push_to_pull_request_branch semantics

File: .github/workflows/fix-review-findings.md line 176

Rule 6 ("One commit per finding") instructs the agent to make multiple local commits, but push_to_pull_request_branch uses a message field for the push commit. The interplay between multiple local commits and the single push message is unclear, and the prompt example omits the required message field entirely.

Generated by Expert Code Review (auto) for issue #820 · ● 31.3M