pull_request_review trigger fails activation: ERR_VALIDATION in add_workflow_run_comment.cjs (regression from #30354)

[matiloti]

Summary

PR #30354 widened the compile-time if: for the activation job's "Add comment with workflow run link" step to include pull_request_review, but the runtime script actions/setup/js/add_workflow_run_comment.cjs was not updated to handle that event type. Workflows that fire on pull_request_review AND have status-comment: true now fail the activation job, which skips agent and safe_outputs entirely.

This is a regression: before #30354 the step was silently skipped; now it fails loudly.

Repro

Minimal workflow:

```yaml
on:
pull_request_review:
types: [submitted]
status-comment: true
```

Submit a PR review → the activation job's "Add comment with workflow run link" step exits with:

```
##[error]ERR_VALIDATION: Unsupported event type: pull_request_review
```

Activation fails → `agent` / `detection` / `safe_outputs` all skipped.

Root cause analysis

Compile-time (works correctly): `pkg/workflow/expression_builder.go:107-119` builds the term for `pull_request_review` and the compiled lock-file `if:` correctly lets the step run.

Runtime (broken): `actions/setup/js/add_workflow_run_comment.cjs` switch statement (lines ~95-110) only handles `issues`/`issue_comment`, `pull_request`/`pull_request_review_comment`, and `discussion`/`discussion_comment`. There is no `case "pull_request_review"`, so the script falls through to `default → core.setFailed(...)`.

Verified absent on v0.71.5, v0.71.6, v0.72.0, and `main` at time of this report.

Implementation Plan

1. Update runtime script (`actions/setup/js/add_workflow_run_comment.cjs`):

   • Add `pull_request_review` to the existing `case "pull_request": case "pull_request_review_comment":` block — PR-number extraction logic (`payload.pull_request.number`) is identical for all three event types.
   • Add the entry to the `eventDescriptions` lookup map at the top of the file:
     ```js
     pull_request_review: "pull request review",
     ```

2. Add tests (`actions/setup/js/add_workflow_run_comment.test.cjs`):

   • Mirror the existing `describe("main() - pull_request_review_comment event", ...)` block for `pull_request_review`:
     • Happy path: posts a status comment with the correct PR number
     • Error path: fails when `payload.pull_request.number` is missing

3. No frontmatter / schema / compile-time test changes needed. The widening landed correctly in fix: include pull_request_review in reaction/status-comment conditions #30354 and `expression_builder_test.go` already covers the gating logic.

References

• Originating PR: fix: include pull_request_review in reaction/status-comment conditions #30354 (landed 2026-05-05, included in v0.71.5+).
• Affected versions: v0.71.5, v0.71.6, v0.72.0, current `main`.

Workaround for affected users

Set `status-comment: false` (or omit) in the `on:` block. The agent + safe_outputs work resumes; only the cosmetic "🤖 workflow started" comment is lost.