feat(checks): Improve GitHub output and check summary

[dcramer]

Improves GitHub output based on feedback in #36.

Changes

1. Remove standalone PR summary comments

Only post PR reviews with inline comments - skip standalone summary comments
that add noise without providing actionable inline feedback.

2. Track skill duration

Add durationMs tracking to runSkill() so the duration column shows values.

3. Redesign check summaries for actionability

• Shows up to 10 findings grouped by severity (Critical, High, etc.)
• Each finding is collapsible: title visible, description expands on click
• Removed emojis
• Simplified check titles: "X issues" or "No issues"
• Skills table in collapsible section, removed redundant Result column
• Readable stats footer

Example output

### Critical

<details>
<summary><strong>SQL injection vulnerability</strong> - `src/api/users.ts:45`</summary>

User input passed directly to query without sanitization

</details>

### High

<details>
<summary><strong>Missing auth check</strong> - `src/api/admin.ts:23`</summary>

Endpoint accessible without authentication

</details>

<details>
<summary>2 skills analyzed</summary>

| Skill | Findings | Duration | Cost |
|-------|----------|----------|------|
| security-review | 1 | 8.2s | $0.004 |
| code-style | 1 | 4.1s | $0.002 |

</details>

---
**Duration:** 12.3s · **Tokens:** 5.2k in / 1.2k out · **Cost:** $0.006

Fixes #36

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
warden	Ready	Preview, Comment	Jan 30, 2026 1:21am

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Missing actionable headline in core check summary

Medium Severity

The buildCoreSummary function doesn't add the actionable headline described in the PR. The PR documentation states the summary leads with "🔴 X issues require attention" or "✅ No issues found", but the implementation starts directly with severity sections (### High) or just "No issues found." without the expected headline with emoji and issue count.

 

[cursor]

Summary shows 10 findings instead of documented 5

Low Severity

The MAX_SUMMARY_FINDINGS constant is set to 10, but the PR description explicitly states the summary "Shows top 5 findings directly with title, location, and description." This mismatch means the implementation displays twice as many findings as the documented design intended, potentially reducing the actionability the redesign aims to achieve.

 

[cursor]

Duplicate formatLocation function reimplements existing utility

Low Severity

The new formatLocation function duplicates the core logic of the existing formatLocation in src/cli/output/formatters.ts. Both format path:startLine-endLine the same way. The only difference is the new version takes an object parameter and wraps output in backticks. This could reuse the existing utility by calling it and wrapping the result, rather than reimplementing the line-range formatting logic.

 

[cursor]

Findings-by-severity rendering logic duplicated across functions

Low Severity

The logic for sorting findings by severity, grouping them into a Map, iterating over severityOrder, capitalizing labels, and rendering each finding with <details> tags is nearly identical in both buildSkillSummary and buildCoreSummary. This ~25-line block is duplicated, including the same hardcoded severityOrder array. A helper function to render findings grouped by severity would eliminate this duplication.

Additional Locations (1)

• src/output/github-checks.ts#L366-L396