feat: simplify review workflow and output in GHA warning format

Rename workflow to automated-code-review.yml, revert to pull_request trigger for now (with TODO), and simplify maintainer checks. Update the review-pr skill to output warnings in GHA warning format targeting exact lines.

Author: rickeylev

.github/workflows/antigravity-review.yml …thub/workflows/automated-code-review.yml.github/workflows/antigravity-review.yml renamed to .github/workflows/automated-code-review.yml .github/workflows/antigravity-review.yml renamed to .github/workflows/automated-code-review.yml

@@ -1,7 +1,11 @@
-name: Antigravity Code Review
+name: automated code review
 
+# TODO: Eventually, use pull_request_target instead of pull_request.
+# pull_request_target runs in the base branch context and has access
+# to secrets (like GEMINI_API_KEY) even for fork PRs.
+# Using pull_request for now during setup/testing.
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
   pull_request_review_comment:
     types: [created]
@@ -14,21 +18,21 @@ jobs:
   review:
     runs-on: ubuntu-latest
     # Trigger only if:
-    # 1. It is a pull_request_target event, it is NOT a draft, and the author is a maintainer
+    # 1. It is a pull_request event, it is NOT a draft, and the author is a maintainer
     #    (OWNER, MEMBER, or COLLABORATOR).
-    # 2. OR it is an pull_request_review_comment event, the comment body has a line starting with "/review",
+    # 2. OR it is a pull_request_review_comment event, the comment body has a line starting with "/review",
     #    and the commenter is a maintainer.
     if: >
-      (github.event_name == 'pull_request_target' && !github.event.pull_request.draft &&
-       (github.event.pull_request.author_association == 'OWNER' || github.event.pull_request.author_association == 'MEMBER' || github.event.pull_request.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request' && !github.event.pull_request.draft &&
+       contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)) ||
       (github.event_name == 'pull_request_review_comment' &&
        (startsWith(github.event.comment.body, '/review') || contains(github.event.comment.body, '\n/review')) &&
-       (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR'))
+       contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association))
     steps:
-      - name: Checkout PR Branch (Untrusted)
+      - name: Checkout PR Branch
         uses: actions/checkout@v7
         with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
 
       - name: Checkout Reviewbot (Base Branch)

tools/private/reviewbot/skills/review-pr/SKILL.md

@@ -11,6 +11,21 @@ correctness, concurrency safety, system architecture, performance bottlenecks,
 and resource management. Do not comment on style nits or formatting issues
 that an automated formatter can handle. Be constructive and concise.
 
+For every issue or improvement you identify, you MUST output the finding in the
+GitHub Actions workflow command warning format. Specify the exact file path
+and line number that the comment applies to.
+
+Format each finding exactly as a single line to stdout matching this template:
+`::warning file={file_path},line={line_number},title={category}::{comment_body}`
+
+Where:
+*   `file_path` is the relative file path from the repository root.
+*   `line_number` is the starting line number in the file where the comment applies.
+*   `category` is a short tag for the type of issue (e.g., "Error Handling", "Correctness", "Performance").
+*   `comment_body` is your constructive and concise feedback.
+
+Do not write any markdown commentary outside of these GHA command formatted lines.
+
 Follow these checklists during your review:
 
 ### General Quality & Architecture Checklist