docs(qa-pr): self-check rewritten GitHub comments, not attach drafts

[Lykhoyda]

Summary

Codex P1 and Greptile P1 on merged #1041, plus Codex P1 on this PR: identity must never appear in the first public gh pr comment body (notifications and webhooks keep that body even after --edit-last).

• Codex on docs(qa-pr): redact local identity from GitHub comments #1041: docs(qa-pr): redact local identity from GitHub comments #1041 (comment)
• Greptile on docs(qa-pr): redact local identity from GitHub comments #1041: docs(qa-pr): redact local identity from GitHub comments #1041 (comment)
• Codex on this PR: docs(qa-pr): self-check rewritten GitHub comments, not attach drafts #1042 (comment)

Sanitize qa-pr-report.md before posting. Exempt only the exact Markdown image/video destinations --attach rewrites. Then self-check the rewritten GitHub body again. Hostname, UUID, /Users/, and .local never appear in the first public comment, alt text, PR bodies, or issue text.

Plugin screenshot width stays 720. No Ponytail in the plugin. Did not edit comments on #1027 or #1030. Did not take Greptile P2.

Test plan

• bash scripts/check-agent-package-sync.sh
• unit test packages/rn-dev-agent-core/test/unit/qa-pr-workflow.test.ts (Node 24)

  

Greptile Summary

This PR updates the /qa-pr reporting instructions so attachment-compatible local media paths remain in the pre-upload body while public-identity checks apply to the GitHub-rewritten comment.

• Mirrors the revised workflow across shared, Claude, and Codex agent and command documentation.
• Adds regression assertions for the pre-upload versus rewritten-body distinction.
• Adds a patch changeset for the shipped plugin documentation behavior.

Confidence Score: 5/5

The PR appears safe to merge, with the revised instructions consistently mirrored and no actionable regression identified.

The change preserves local paths only where GitHub CLI needs them for attachment rewriting while retaining public identity restrictions on the hosted body; synchronization and workflow assertions cover the updated documentation contract.

Important Files Changed

Filename	Overview
packages/shared-agent-knowledge/agents/rn-pr-qa.md	Revises the canonical reporting protocol to preserve local attachment paths before upload and validate the rewritten public body afterward.
packages/shared-agent-knowledge/commands/qa-pr.md	Updates the command summary to distinguish the attachment draft from the public GitHub body.
packages/rn-dev-agent-core/test/unit/qa-pr-workflow.test.ts	Adds contract assertions pinning the revised pre-upload and post-rewrite guidance.
.changeset/qa-pr-attach-self-check.md	Declares a patch release for the updated shipped workflow instructions.

Sequence Diagram

sequenceDiagram
    participant Agent
    participant Draft as qa-pr-report.md
    participant GH as GitHub CLI
    participant Comment as GitHub Comment

    Agent->>Draft: Write Markdown with local media paths
    Agent->>GH: gh pr comment --attach
    GH->>GH: Upload media and rewrite references
    GH->>Comment: Publish rewritten body
    Comment-->>Agent: Return issuecomment URL/id
    Agent->>Agent: Check rewritten public body
    Agent->>Comment: Edit widened/redacted body

Loading

_{Reviews (1): Last reviewed commit: "docs(qa-pr): self-check rewritten GitHub..." | Re-trigger Greptile}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T09:06:58.449891Z	8fede3d	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-15T09:12:28.612949Z	8fede3d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8fede3d5b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Sanitize private identity before creating the comment

When report prose contains a hostname, UUID, username, or local path outside an attachment destination, this instruction postpones redaction until after Step 9b has already published the comment. gh pr comment --help defines --edit-last as “Edit the last comment of the current user,” so the original sensitive body has already been publicly visible and may remain in notifications or webhook payloads even after the edit. Validate the pre-upload body before posting while exempting only the exact Markdown destinations corresponding to --attach, then validate the rewritten body again.

Useful? React with 👍 / 👎.

[cursor]

Fixed on this PR: sanitize qa-pr-report.md before gh pr comment --attach. Only the exact Markdown image/video destinations stay so --attach can rewrite them. Then self-check the rewritten GitHub body again. Hostname, UUID, /Users/, and .local never appear in the first public comment (notifications/webhooks keep that first body even after --edit-last).