feat(cli): rich PR review summary body with Why/Action/Evidence (v2.0.3) (#144)

When a finding's evidence line falls outside the PR diff, GitHub's inline-comment API rejects the anchor, so GauntletCI falls back to a top-level review body. Previously that fallback was a single bullet line per group, missing the rationale that makes a finding actionable.

BuildReviewBody now wraps each summary group in a collapsible <details> block whose body is the same Why/Action/Evidence/Confidence/Severity layout used by inline comments and the run-log report. Result: parity between what reviewers see in the PR conversation and what they see in the workflow run output.

Adds 4 new unit tests covering empty/inline-only/single-group/multi-group review bodies.

Co-authored-by: Eric Cogen <ericcogen@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: EricCogen

src/GauntletCI.Cli/GauntletCI.Cli.csproj

@@ -39,11 +39,11 @@
     <PackAsTool>true</PackAsTool>
     <ToolCommandName>gauntletci</ToolCommandName>
     <PackageId>GauntletCI</PackageId>
-    <Version>2.0.2</Version>
+    <Version>2.0.3</Version>
     <Authors>Eric Cogen</Authors>
     <Description>GauntletCI is a .NET pre-commit and PR integration gate that evaluates diffs against 42 behavioral-change rules — catching unvalidated changes, missing tests, async deadlock risk, security risks, and resource lifecycle violations before code is committed or merged. Optional local LLM enrichment via Ollama. Built-in MCP server for AI assistant integration. Fully offline — no data leaves your machine. Open source CodeRabbit alternative with deterministic, auditable findings.</Description>
     <PackageTags>pre-commit;code-review;llm;static-analysis;behavioral-analysis;diff-analysis;git-hooks;ci;dotnet;csharp;mcp;pr-review;risk-detection;behavioral-testing;security-risk;async-safety;ollama;ai-code-review</PackageTags>
-    <PackageReleaseNotes>v2.0.2: Findings sharing (RuleId, FilePath) are grouped into one console block / annotation / PR comment / check annotation. GitHub Checks output now populates a rich markdown summary; annotations include multi-line Why/Action; PR review comments use the run-log layout. Diagnostic logging on writer success. v2.0.1: New CLI flags (--github-pr-comments, --github-checks, --notify-slack, --notify-teams, --with-coverage, --with-ticket-context, --pr-comment-suggest, --no-baseline, --show-context, --severity, --verbose), config blocks (ci, notifications, output, ticketProvider), network license validation, Phi-4 Mini migration. v2.0.0: 42 built-in rules, local LLM expert distillery, MCP server, Ollama embedding engine, corpus pipeline, GitHub Actions annotations, full audit log.</PackageReleaseNotes>
+    <PackageReleaseNotes>v2.0.3: PR review summary body (the fallback used when finding evidence references lines outside the PR diff) now embeds the full Why/Action/Evidence/Confidence/Severity body in collapsible &lt;details&gt; sections, matching the inline-comment and run-log layouts. v2.0.2: Findings sharing (RuleId, FilePath) are grouped into one console block / annotation / PR comment / check annotation. GitHub Checks output now populates a rich markdown summary; annotations include multi-line Why/Action; PR review comments use the run-log layout. Diagnostic logging on writer success. v2.0.1: New CLI flags (--github-pr-comments, --github-checks, --notify-slack, --notify-teams, --with-coverage, --with-ticket-context, --pr-comment-suggest, --no-baseline, --show-context, --severity, --verbose), config blocks (ci, notifications, output, ticketProvider), network license validation, Phi-4 Mini migration. v2.0.0: 42 built-in rules, local LLM expert distillery, MCP server, Ollama embedding engine, corpus pipeline, GitHub Actions annotations, full audit log.</PackageReleaseNotes>
     <Copyright>Copyright © 2024 Eric Cogen</Copyright>
     <PackageProjectUrl>https://gauntletci.com</PackageProjectUrl>
     <PackageLicenseFile>LICENSE</PackageLicenseFile>

src/GauntletCI.Cli/Output/GitHubPrReviewWriter.cs

@@ -354,6 +354,8 @@ public static string BuildReviewBody(List<GroupedFinding> summaryGroups, bool ha
         var sb = new StringBuilder();
         sb.AppendLine("**GauntletCI** found the following issues:");
         sb.AppendLine();
+        sb.AppendLine("_These findings reference lines outside the PR diff, so they appear here instead of inline. Expand each entry for full evidence, rationale, and suggested action._");
+        sb.AppendLine();
 
         foreach (var g in summaryGroups)
         {
@@ -364,12 +366,18 @@ public static string BuildReviewBody(List<GroupedFinding> summaryGroups, bool ha
                         ? $" (`{g.FilePath}:{g.PrimaryLine}`)"
                         : $" (`{g.FilePath}`)")
                 : string.Empty;
-            sb.AppendLine($"- **{g.RuleId} — {g.RuleName}**{location}: {g.Summary}");
+
+            sb.AppendLine("<details>");
+            sb.AppendLine($"<summary><strong>{g.RuleId} — {g.RuleName}</strong>{location}: {g.Summary}</summary>");
+            sb.AppendLine();
+            sb.AppendLine(BuildCommentBody(g));
+            sb.AppendLine();
+            sb.AppendLine("</details>");
+            sb.AppendLine();
         }
 
         if (hasInlineComments)
         {
-            sb.AppendLine();
             sb.Append("Additional findings are posted as inline comments on the diff.");
         }
 

src/GauntletCI.Tests/GitHubPrReviewWriterTests.cs

@@ -183,6 +183,91 @@ public void BuildCommentBody_WithCoverageNote_IncludesCoverageSection()
         Assert.Contains("No test coverage", body);
     }
 
+    // --- BuildReviewBody ---
+
+    private static GroupedFinding MakeGroup(
+        string ruleId           = "GCI0016",
+        string ruleName         = "Concurrency Rule",
+        string summary          = "Static mutable field detected",
+        string filePath         = "src/Foo.cs",
+        int    primaryLine      = 12,
+        string whyItMatters     = "Mutable static fields are shared across threads.",
+        string suggestedAction  = "Use Interlocked or readonly.",
+        string evidence         = "Line 12: private static long _count;") => new()
+    {
+        RuleId          = ruleId,
+        RuleName        = ruleName,
+        Summary         = summary,
+        FilePath        = filePath,
+        PrimaryLine     = primaryLine,
+        Lines           = new[] { primaryLine },
+        Evidence        = new[] { evidence },
+        WhyItMatters    = whyItMatters,
+        SuggestedAction = suggestedAction,
+        Confidence      = Confidence.Medium,
+        Severity        = RuleSeverity.Warn,
+        Count           = 1,
+    };
+
+    [Fact]
+    public void BuildReviewBody_NoSummaryGroups_NoInline_ReturnsEmpty()
+    {
+        var body = GitHubPrReviewWriter.BuildReviewBody(new(), hasInlineComments: false);
+        Assert.Equal(string.Empty, body);
+    }
+
+    [Fact]
+    public void BuildReviewBody_NoSummaryGroups_HasInline_ReturnsPointerNote()
+    {
+        var body = GitHubPrReviewWriter.BuildReviewBody(new(), hasInlineComments: true);
+        Assert.Contains("inline comments", body);
+    }
+
+    [Fact]
+    public void BuildReviewBody_SummaryGroup_EmbedsRichDetailsBlock()
+    {
+        var groups = new List<GroupedFinding> { MakeGroup() };
+        var body   = GitHubPrReviewWriter.BuildReviewBody(groups, hasInlineComments: false);
+
+        // Top-level header preserved
+        Assert.Contains("**GauntletCI** found the following issues:", body);
+        // Details/summary scaffolding present
+        Assert.Contains("<details>", body);
+        Assert.Contains("</details>", body);
+        Assert.Contains("<summary>", body);
+        // Rich body: rule id, evidence, why, action, confidence/severity all present (matches inline format)
+        Assert.Contains("GCI0016", body);
+        Assert.Contains("**Evidence:**", body);
+        Assert.Contains("Why it matters", body);
+        Assert.Contains("Suggested action", body);
+        Assert.Contains("Confidence:", body);
+        Assert.Contains("Severity:", body);
+    }
+
+    [Fact]
+    public void BuildReviewBody_MultipleSummaryGroups_EmitsOneDetailsPerGroup()
+    {
+        var groups = new List<GroupedFinding>
+        {
+            MakeGroup(ruleId: "GCI0010", ruleName: "Hardcoding", summary: "Hardcoded conn string"),
+            MakeGroup(ruleId: "GCI0042", ruleName: "TODO Detection", summary: "TODO in payment flow"),
+        };
+        var body = GitHubPrReviewWriter.BuildReviewBody(groups, hasInlineComments: false);
+
+        var detailsCount = System.Text.RegularExpressions.Regex.Matches(body, "<details>").Count;
+        Assert.Equal(2, detailsCount);
+        Assert.Contains("GCI0010", body);
+        Assert.Contains("GCI0042", body);
+    }
+
+    [Fact]
+    public void BuildReviewBody_HasInlineAndSummary_AppendsInlinePointer()
+    {
+        var groups = new List<GroupedFinding> { MakeGroup() };
+        var body   = GitHubPrReviewWriter.BuildReviewBody(groups, hasInlineComments: true);
+        Assert.Contains("inline comments on the diff", body);
+    }
+
     // --- ResolvePrNumber ---
 
     [Fact]