[polewskm]

Stacked on #81; GitHub retargets this to main when #81 merges.

Adds .github/workflows/monthly-report.yml (1st of the month at 06:00 UTC, plus workflow_dispatch with optional month and repositories inputs; issues: write, contents: read, GITHUB_TOKEN only; actions pinned by SHA) and tools/report.ts. The script lists the pull requests closed in the month, reads the outcomes marker and the summary comments' review markers from the bot's comments only, and opens or updates the issue "Review report YYYY-MM". The issue shows precision per reviewer and per repository (fixed ÷ (fixed + dismissed), with acknowledged and ignored shown apart), findings per PR, cost split by provider, cost per fixed finding, and the month-over-month change from the previous report's hidden <!-- ncode-review:report {...} --> marker. It uses an injectable fetch, and hermetic tests in test/report.test.ts cover the month window, aggregation, the issue body, forged markers and issues, and idempotent re-runs. README and CHANGELOG are updated.

Decisions

• Which repositories: GITHUB_TOKEN can't list the app's installations, so the script scans the owner's public, non-fork repositories (GET /orgs/NCodeGroup/repos) and keeps the ones with .github/workflows/code-review.yml. The repositories input replaces the scan with an explicit list. A repository whose check fails for any reason other than a 404 is left out and named under "Notes".
• Finding report issues: report issues get the review-report label (GitHub creates it on first use). The script only trusts issues opened by github-actions[bot] with the exact title, so a squatted or forged issue is ignored. A re-run patches that month's issue, and only when its body changed.
• Cost per fixed finding = cost of the PRs with outcomes recorded ÷ their fixed findings. Findings per PR counts only the PRs with outcomes. The total cost covers every reviewed PR closed in the month, including collapsed summaries. A summary from before the review marker existed falls back to its visible $X.XX on … line. A collapsed pre-marker summary is counted as a review with unknown cost.
• A finding raised by several reviewers counts toward each of them. A finding whose marker names no reviewer is listed as (unattributed).
• The month input accepts the current month (for the acceptance run) but rejects a month that hasn't started.

Testing

• npm run typecheck; npm test: 213 tests, all pass (after merging the updated issue-47).
• Read-only dry run against live GitHub (REPORT_DRY_RUN=1, REPORT_MONTH=2026-10): it found 12 repositories and 59 reviewed PRs, with $16.71 of cost taken from the visible cost lines. No PR has outcomes yet because Record each finding's outcome when a pull request closes #81 isn't deployed.

Remaining

• The acceptance check can't run from here. After Record each finding's outcome when a pull request closes #81 and this PR merge and some PRs close with outcomes, dispatch the workflow for the current month and compare the issue's totals with a hand count on two PRs.

Closes #48

[ncode-review]

🤖 NCode Review at 4dacc6c: 9 new findings on the changed lines.

Not on a changed line:

• 🟠 F10 Should fix: The 'Couldn't list closed pull requests' path has no test test/report.test.ts:559. runReport catches a failure from listClosedPulls and records a note, then continues with the other repositories (report.ts:557-563). The only failure test injects a 502 on a comments page, which goes through readPull's error path instead. A failing pulls listing is never triggered. Fix: Add a test where one repository's /pulls endpoint returns 500 and another repository is healthy; assert the report contains the healthy repository's pulls and a Notes line naming the failed one.
• 🟡 F11 Nit: Duplicate report issues by the workflow for the same month are not tested test/report.test.ts:514. findReports keeps the oldest of two workflow-authored issues with the same title (report.ts:514). The squatting test only covers duplicates by a different author, so the 'older one is kept' rule is untested. Fix: Add two issues with the same title by github-actions[bot] and assert the older one is updated.

[ncode-review]

🤖 Review complete

Verdict: 💬 Comment — This PR adds tools/report.ts and a scheduled Monthly report workflow. Together they open or update a "Review report YYYY-MM" issue with precision per reviewer and per repository, cost by provider and cost per fixed finding, read only from the bot's own outcomes and review markers. The design holds together: inputs are validated, only trusted authors are read, re-runs are idempotent and API calls are bounded. The main risk is that it depends on the exact wording of text owned elsewhere (an HTTP error message, the summary's cost sentence, the issue title format), so a change there would break it without any error. Several new branches also have no tests.

8 reviewers run — 9 findings (run details)

Reviewer	Model	Findings	Top
synthesis	opus-5-5	9	🟠
architecture	sonnet-5-5	0	🟢
completeness	sonnet-5-5	0	🟢
conventions	sonnet-5-5	1	🟡
correctness	sonnet-5-5	0	🟢
hygiene	haiku-5-5	1	🟡
rule-check	sonnet-5-5	5	🟠
security	sonnet-5-5	0	🟢
tests	haiku-5-5	3	🟡

Skipped: api-compat, data-model, infrastructure, intent, performance

Findings

• 🟠 F1 tools/report.ts:121: Repository discovery tells a 404 apart by matching error message text
• 🟠 F2 CHANGELOG.md:14: PR completes issue Monthly report of precision per reviewer and repository, and cost per fixed finding #48 but has no Closes #48
• 🟡 F3 tools/report.ts:171: Cost-line regex copies the summary sentence from src/results.ts
• 🟡 F4 tools/report.ts:518: Report title format is repeated as a literal regex
• 🟡 F5 tools/report.ts:585: No test for a previous report whose marker names another month
• 🟡 F6 tools/report.ts:198: No test for repeated reviewer names in one finding
• 🟡 F7 tools/report.ts:618: The command-line entry point's environment variables are untested
• 🟡 F8 tools/report.ts:104: Helpers take four parameters and append to the caller's notes
• 🟡 F9 .github/workflows/monthly-report.yml:41: Node major version is hard-coded in the workflow

_{Trial: findings are posted as review threads and in the check run. $0.77 on Amazon Bedrock, 104s, at fe612c9. (how to interact)}

[polewskm]

Autopilot: answering #83 (review) and #83 (comment). The findings on changed lines (F1 to F9) are answered in their threads.

• F10 (the "Couldn't list closed pull requests" path has no test): fixed in fe612c9. A new test fails one repository's /pulls listing with HTTP 500 and leaves another healthy. It asserts the Notes line and the warning, and that the healthy repository is still counted. This is the same finding as F3.
• F11 (two workflow-authored report issues for the same month): fixed in fe612c9. A new test asserts that the older issue is updated and the newer one is left alone. This is the same finding as F5.

[polewskm]

/review

[ncode-review]

🤖 NCode Review at fe612c9: 6 new findings on the changed lines.
3 more were already posted on this pull request.

[polewskm]

Autopilot: Round 2 answered. No blocker or should-fix is left open. F1 repeats a round-1 finding that was declined because tokenApi belongs to #81. F2 is already met: the description has Closes #48, which GitHub links once this PR is retargeted to main. The remaining threads are nits, answered above. Recommend merging once you've resolved them.