submit-pull-request-review fails on issue_comment trigger when no inline comments are buffered

[theletterf]

Summary

When a workflow is triggered by an issue_comment event on a pull request and the agent emits submit_pull_request_review with a body and event: COMMENT but no preceding create_pull_request_review_comment items, the review is silently dropped with the warning:

No review context set - cannot submit review
✗ Failed to submit PR review: No review context available

The job ends in success, but nothing is posted to the PR.

Root cause

The asymmetry is between two handlers in actions/setup/js/:

• create_pr_review_comment.cjs:192-204 correctly handles issue_comment triggers on PRs by reading context.payload.issue.pull_request / context.payload.issue.number directly.
• submit_pr_review.cjs:130-138 routes through resolveTarget in safe_output_helpers.cjs. With supportsPR: false, supportsIssue: false, the "triggering" branch at lines 102-110 rejects whenever !isPRContext, and isPRContext covers only pull_request{,_target,_review,_review_comment} — not issue_comment. The fallback returns shouldFail: false so it doesn't even warn loudly, then submitReview() warns that there's no review context.

pr_review_buffer.cjs:218-220 explicitly documents that body-only reviews are supported ("Supports body-only reviews (no inline comments) when metadata is set"), so this is a real bug, not an intentional limitation. It only manifests when the agent decides not to leave any inline comments — common for bot reviewers on clean PRs.

Reproduction

1. Workflow with this safe-outputs config:

   safe-outputs:
     create-pull-request-review-comment:
       max: 20
     submit-pull-request-review:
       max: 1
       target: \"triggering\"
       allowed-events: [COMMENT]
   on:
     command:
       name: my-review

2. PR-menu/slash-command trigger fires an issue_comment event on the PR.

3. Agent finds no actionable inline issues and emits a single submit_pull_request_review with body + event: COMMENT.

4. Result: safe_outputs job succeeds, two warnings as above, no review posted.

A real run that hit this: https://github.com/elastic/docs-content/actions/runs/25541964378 (gh-aw v0.71.5, but the same code paths exist on main and on every 0.71.x / 0.72.x).

Proposed fix

Make submit_pr_review.cjs mirror create_pr_review_comment.cjs: when the trigger is issue_comment and context.payload.issue.pull_request is present, treat the comment's parent PR as the review context. Either:

1. Extend isPRContext in safe_output_helpers.cjs to include issue_comment events whose payload has issue.pull_request, or
2. Add the same issue.pull_request fallback in the body-only branch of submit_pr_review.cjs lines 130-190 before going through resolveTarget.

Either change would also let the autogenerated review fallback at the end of run ("buffered comments are still submitted as a COMMENT review automatically") work for issue_comment triggers when the buffer is empty but metadata was set.

Workaround

For now, downstream workflows can fall back to add-comment (which does correctly handle issue_comment on PRs in add_comment.cjs:495-502 via supportsPR: true) when the agent has no inline findings. That posts the summary as a regular PR comment instead of a review.