Split AI review checkout by PR state (open vs closed)

Three rounds of review feedback have surfaced overlapping checkout
robustness concerns. Picking one approach and unifying behind it.

Closed/merged PR path (the audit-campaign use case):
  Use `refs/pull/<N>/head` from the base repo. GitHub keeps this
  mirror durably regardless of whether the original branch is
  deleted, the fork is removed, or the merge was rebase/squash.
  Replaces the prior `refs/pull/<N>/merge` checkout, which is
  garbage-collected on close.

Open PR path:
  Use `head_sha` from `head_repo_full_name`. For owner PRs the
  head repo equals github.repository so this is identical to a
  base-repo checkout. For fork PRs it avoids the documented race
  where the base repo has not yet mirrored a freshly API-created
  fork PR's head (.claude/commands/submit-pr.md:327-345).

base_sha lives on github.repository regardless of which checkout
path runs, so the prefetch step continues to add a `base` remote
explicitly. `git diff BASE_SHA HEAD_SHA` therefore finds both
trees locally in every covered scenario.

The PR state is sourced from `pulls.get` in the existing metadata
step (works for both `pull_request` and `issue_comment` events).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: igerber

.github/workflows/ai_pr_review.yml

@@ -83,29 +83,37 @@ jobs:
             core.setOutput("base_ref", pr.data.base.ref);
             core.setOutput("head_ref", pr.data.head.ref);
             core.setOutput("head_repo_full_name", headRepoFullName);
+            core.setOutput("state", pr.data.state);
 
+      # Closed/merged PR (e.g. `/ai-review` rerun on a merged PR):
+      # use the base-repo mirror of the PR head, which GitHub keeps
+      # durably even after the fork is deleted or branches removed.
+      # The previous workflow used `refs/pull/<N>/merge`, which is
+      # garbage-collected on closed PRs — this path replaces that.
       - uses: actions/checkout@v6
+        if: steps.pr.outputs.state != 'open'
+        with:
+          ref: refs/pull/${{ steps.pr.outputs.number }}/head
+
+      # Open PR: check out by head_sha from the head repo (= base repo
+      # for owner PRs, = the fork for fork PRs). This avoids the
+      # documented race where `refs/pull/<N>/head` on the base repo
+      # has not yet mirrored a freshly API-created PR's head
+      # (see .claude/commands/submit-pr.md:327-345). head_sha is
+      # guaranteed to exist on the head repo for an open PR.
+      - uses: actions/checkout@v6
+        if: steps.pr.outputs.state == 'open'
         with:
-          # Check out the PR head by SHA from the head repo (which equals
-          # github.repository for owner-created PRs and points at the fork
-          # for fork PRs). The previous workflow used `refs/pull/<N>/merge`,
-          # which GitHub garbage-collects on closed/merged PRs and breaks
-          # `/ai-review` reruns post-merge. Switching to head_sha avoids that,
-          # and pointing at the head repo also avoids the documented race
-          # where `refs/pull/<N>/head` on the base repo has not yet mirrored
-          # a fresh fork PR's head (see .claude/commands/submit-pr.md:327-345).
-          # The diff the reviewer sees is unchanged: it's computed from
-          # BASE_SHA/HEAD_SHA below, captured in the same metadata step.
           repository: ${{ steps.pr.outputs.head_repo_full_name }}
           ref: ${{ steps.pr.outputs.head_sha }}
 
       - name: Pre-fetch base SHA
         run: |
           set -euo pipefail
           # base_sha lives on the base repo (github.repository), which differs
-          # from origin when this is a fork PR. Add an explicit `base` remote
-          # so `git diff BASE_SHA HEAD_SHA` always finds the base-side tree,
-          # regardless of whether origin points at the fork or the base repo.
+          # from origin when this is an open fork PR. Add an explicit `base`
+          # remote so `git diff BASE_SHA HEAD_SHA` finds the base-side tree
+          # regardless of which checkout path ran.
           git remote add base "https://github.com/${{ github.repository }}.git"
           git fetch --no-tags --depth=1 base "${{ steps.pr.outputs.base_sha }}"