fix: address PR review feedback on stale thread resolution

- Check GraphQL response JSON for `.errors` field (HTTP 200 can still
  contain errors) on both the query and mutation calls
- Add error handling around jq parsing/merging of thread data
- Replace world-writable /tmp with mktemp + trap cleanup
- Validate mutation success before incrementing resolved count

Author: derekmisler

review-pr/action.yml

@@ -182,6 +182,9 @@ runs:
           exit 0
         fi
 
+        DIFF_LINES_FILE=$(mktemp)
+        trap "rm -f '$DIFF_LINES_FILE'" EXIT
+
         awk '
           /^\+\+\+ b\// {
             # Extract file path from "+++ b/foo" (unambiguous, unlike diff --git header)
@@ -202,9 +205,9 @@ runs:
           }
           /^ / { line++ }
           /^-/ { next }
-        ' pr.diff | sort -u > /tmp/diff_lines.txt
+        ' pr.diff | sort -u > $DIFF_LINES_FILE
 
-        DIFF_LINE_COUNT=$(wc -l < /tmp/diff_lines.txt | tr -d ' ')
+        DIFF_LINE_COUNT=$(wc -l < $DIFF_LINES_FILE | tr -d ' ')
         echo "📄 Found $DIFF_LINE_COUNT unique file:line pairs in diff"
 
         # B. Fetch all review threads via GraphQL (paginated)
@@ -248,8 +251,20 @@ runs:
             exit 0
           }
 
-          THREADS=$(echo "$RESULT" | jq '.data.repository.pullRequest.reviewThreads.nodes // []')
-          ALL_THREADS=$(echo "$ALL_THREADS" "$THREADS" | jq -s '.[0] + .[1]')
+          # Check for GraphQL errors in response (HTTP 200 can still contain errors)
+          if echo "$RESULT" | jq -e '.errors' > /dev/null 2>&1; then
+            echo "::warning::GraphQL returned errors: $(echo "$RESULT" | jq -c '.errors')"
+            exit 0
+          fi
+
+          THREADS=$(echo "$RESULT" | jq '.data.repository.pullRequest.reviewThreads.nodes // []') || {
+            echo "::warning::Failed to parse threads on page $PAGE"
+            break
+          }
+          ALL_THREADS=$(echo "$ALL_THREADS" "$THREADS" | jq -s '.[0] + .[1]') || {
+            echo "::warning::Failed to merge threads on page $PAGE"
+            break
+          }
 
           HAS_NEXT=$(echo "$RESULT" | jq -r '.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage')
           if [ "$HAS_NEXT" != "true" ]; then
@@ -296,21 +311,27 @@ runs:
 
           FILE_LINE="${THREAD_PATH}:${THREAD_LINE}"
 
-          if grep -qF "$FILE_LINE" /tmp/diff_lines.txt; then
+          if grep -qF "$FILE_LINE" $DIFF_LINES_FILE; then
             echo "  ⏭️  Keeping open: $FILE_LINE (still in diff)"
             KEPT=$((KEPT + 1))
           else
-            echo "  ✅ Resolving: $FILE_LINE (no longer in diff)"
-            gh api graphql -f query='
+            MUTATION_RESULT=$(gh api graphql -f query='
               mutation($threadId: ID!) {
                 resolveReviewThread(input: { threadId: $threadId }) {
                   thread { id isResolved }
                 }
               }
-            ' -f threadId="$THREAD_ID" > /dev/null 2>&1 || {
-              echo "  ⚠️  Failed to resolve thread $THREAD_ID"
+            ' -f threadId="$THREAD_ID" 2>&1) || {
+              echo "  ⚠️  Failed to resolve thread $THREAD_ID (API error)"
               continue
             }
+
+            if echo "$MUTATION_RESULT" | jq -e '.errors' > /dev/null 2>&1; then
+              echo "  ⚠️  Failed to resolve thread $THREAD_ID: $(echo "$MUTATION_RESULT" | jq -c '.errors')"
+              continue
+            fi
+
+            echo "  ✅ Resolved: $FILE_LINE (no longer in diff)"
             RESOLVED=$((RESOLVED + 1))
           fi
         done