Allow PR review just with suggestions without requesting to change or approving

[Alexolut]

With option like format-review I can enable posting suggestion by bot what and how should be changed, i.e. diff to be applied to satisfy the review. At the same time this option adds review result in terms of "needs work/approved". More over for dismissing the results of previous "needs work" additional permissions should be set for a bot.

I just want to see the suggestions (like normal comments) without "approve" or "request changes".

[2bndy5]

Interesting idea. Technically speaking, we could change the posted review to be a COMMENT (GitHub REST API doc ref - see event parameter).

I think this could be controlled via a new input option with a boolean value. Off the top of my head, I think the name passive-reviews would be fitting. The default value false would incite the current behavior, but a true value would post all reviews as comments (not approving nor demanding changes).

[2bndy5]

[...] additional permissions should be set for a bot.

This cannot be avoided when posting reviews as comments too. The REST API endpoint that Github offers (to post PR reviews) requires extra permission to be set. There is a security concern about posting comments. To be clear, we cannot work around the required permission as that is mandated by github.

FWIW, posting thread comments on a PR (not as a PR review) poses the same permission obstacle. Posting comments in a PR that originates from a fork is practically impossible.

[Alexolut]

I'm not very familiar with permission restrictions on GH, but I can day that I faced with the situation that posting comments with format-review works fine, but it is not possible to dismiss the previously set "changes requested" set by bot. So merging such PR became impossible even after addressing the issue with code formatting. Hence from that point of view permissions needed to post comments are differ from that to dissmiss last PR review results.

[2bndy5]

You should be able to dismiss an entire review if your account has the permission to do so for the repo in question.

I wrote a doc about some of the PR review feature's caveats. Maybe that could help in some way.

impossible even after addressing the issue with code formatting

If the bot did not dismiss the outdated review, then I would suggest you look at the CI triggers (the on: [...] part of the yaml). If the CI only triggers cpp-linter-action on a PR open event, then any PR sync events will not be triggered. A PR sync event is needed for cpp-linter-action to:

1. understand that the event is specific to a PR.
2. fetch a list of PR reviews and dismiss any outdated review that cpp-linter-action had previously posted.

As for the comments posted within the diff, GH allows these diff comments to be deleted or collapsed (marked as "resolved") provided the user has the right permission.

[Alexolut]

In my case bot is trying to dismiss but ends with an error:

ERROR:CPP Linter:response returned 403 from PUT
https://github.com/api/.../dismissals
with message: {"message":"Branch protections do not permit dismissing this review","documentation_url":"
https://docs.github.com/rest/pulls/reviews#dismiss-a-review-for-a-pull-request
"}

I can workaround this by disabling "Restrict who can dismiss pull request reviews" option in branch protection rules, but this is not what I would like to change.

[2bndy5]

Ah, I forgot about the branch protection rules... Well, posting reviews as a comment will still yield the same dismissal problem.

Why each PR event posts a new review

It would be a nightmare to track which comments are outdated and which comments need updating/deleting. And thread comments can be collapsed when resolved, but there is no way to do that via GitHub REST API. Furthermore, altering an existing review via the REST API is not intuitive at all.