fix: Post status updates for tracked review findings

[JuliusWallblom]

Summary

• Allows body-only COMMENT reviews when the handler has a status update body to submit.
• Builds status updates from tracked unresolved/new findings so duplicate-suppressed historical issues still appear after autofix.
• Keeps legacy already-mentioned fingerprints from forcing new status updates when they are not stored historical findings.

Validation

• bun test apps/review-agent/src/webhook/handler.test.ts
• bun run --cwd apps/review-agent typecheck
• bunx biome check apps/review-agent/src/webhook/handler.ts apps/review-agent/src/webhook/handler.test.ts

[opendiff-agent]

OpenDiff Summary

This PR changes apps/review-agent/src/webhook/handler.ts so the webhook can submit body-only COMMENT reviews when there is a status update to post, instead of skipping GitHub review creation whenever inline comments are absent.

• shouldSubmitReview() now considers a non-empty review body, which enables status-only review submissions for COMMENT events.
• The handler now builds status updates from tracked history by converting StoredIssueRecord entries back into CodeIssue objects via storedIssueToCodeIssue().
• The status-update path distinguishes unresolved historical findings from genuinely new findings with statusUpdateNewIssues, so duplicate-suppressed legacy fingerprints do not force fresh status updates.
• formatReviewBody() is now fed a historical/open-issue view when appropriate, while the living summary comment still comes from formatHistoricalSummaryBody() and is upserted as before.
• apps/review-agent/src/webhook/handler.test.ts adds coverage for repeated historical issues, addressed historical issues, and the new expectation that a body-only status update produces a submitted COMMENT review with a review id.

Safe to merge. I checked the new review-submission path, the historical-issue reconstruction logic, and the interaction with existing duplicate-suppression and summary-comment flows. The body-only COMMENT review behavior is consistent with the existing GitHub client contract, the historical status update logic preserves unresolved and addressed tracked findings without reintroducing duplicate inline comments, and I did not find a blocking security, correctness, or performance regression in the changed paths. Residual risk is limited to integration behavior with GitHub's review API for body-only comments, but the code and tests are aligned with that intended flow.

Findings

OpenDiff found no issues that require changes in this review.

---

Rating: 97/100
Confidence: 94/100

Reviewed by opendiff

[github-actions]

Preview Deployment

Service	URL
Website	https://pr-160.opendiff.dev
App	https://pr-160-app.opendiff.dev
API	https://pr-160-api.opendiff.dev
Agent	https://pr-160-agent.opendiff.dev

Updated: 2026-06-25 12:54:15 UTC