fix(github): resolve the PR head SHA for file comments

github_comment sent commit_id as undefined for every file comment: the
param was hidden with no subBlock and no mapper write, so GitHub — which
marks commit_id required on POST /pulls/{n}/comments — answered 422 on a
path the commentType dropdown exposes.

When commitId is absent the tool now fetches the pull request first and
uses head.sha, mirroring how Jira resolves cloudId from domain.

Also removes the position param, which GitHub marks deprecated ("Use
line instead"); line is already a real subBlock.

Author: waleedlatif1

apps/sim/tools/generated/tool-metadata.ts

@@ -0,0 +1,133 @@
+/**
+ * @vitest-environment node
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { commentTool, commentV2Tool } from '@/tools/github/comment'
+import type { CreateCommentParams } from '@/tools/github/types'
+
+const HEAD_SHA = 'a'.repeat(40)
+
+const FILE_COMMENT_PARAMS: CreateCommentParams = {
+  owner: 'octo',
+  repo: 'demo',
+  pullNumber: 7,
+  body: 'Looks good',
+  path: 'src/main.ts',
+  line: 42,
+  commentType: 'file_comment',
+  apiKey: 'ghp_test',
+}
+
+function pullRequestResponse(): Response {
+  return Response.json({ number: 7, head: { sha: HEAD_SHA, ref: 'feature' } })
+}
+
+function createdCommentResponse(): Response {
+  return Response.json({
+    id: 99,
+    body: 'Looks good',
+    html_url: 'https://github.com/octo/demo/pull/7#discussion_r99',
+    path: 'src/main.ts',
+    line: 42,
+    side: 'RIGHT',
+    commit_id: HEAD_SHA,
+    created_at: '2026-01-01T00:00:00Z',
+    updated_at: '2026-01-01T00:00:00Z',
+  })
+}
+
+describe('github_comment file comments', () => {
+  const fetchMock = vi.fn()
+
+  beforeEach(() => {
+    fetchMock.mockReset()
+    vi.stubGlobal('fetch', fetchMock)
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('looks the pull request up when no commitId is supplied', () => {
+    const url = commentTool.request.url as (params: CreateCommentParams) => string
+    const method = commentTool.request.method as (params: CreateCommentParams) => string
+
+    expect(url(FILE_COMMENT_PARAMS)).toBe('https://api.github.com/repos/octo/demo/pulls/7')
+    expect(method(FILE_COMMENT_PARAMS)).toBe('GET')
+    expect(commentTool.request.body?.(FILE_COMMENT_PARAMS)).toBeUndefined()
+  })
+
+  it('posts the resolved head SHA as commit_id', async () => {
+    fetchMock.mockResolvedValueOnce(createdCommentResponse())
+
+    const result = await commentTool.transformResponse!(pullRequestResponse(), FILE_COMMENT_PARAMS)
+
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    const [requestUrl, init] = fetchMock.mock.calls[0]
+    expect(requestUrl).toBe('https://api.github.com/repos/octo/demo/pulls/7/comments')
+    expect(init.method).toBe('POST')
+    expect(JSON.parse(init.body)).toEqual({
+      body: 'Looks good',
+      commit_id: HEAD_SHA,
+      path: 'src/main.ts',
+      line: 42,
+      side: 'RIGHT',
+    })
+    expect(result.success).toBe(true)
+    expect(result.output.metadata.commit_id).toBe(HEAD_SHA)
+  })
+
+  it('resolves the head SHA for the v2 tool as well', async () => {
+    fetchMock.mockResolvedValueOnce(createdCommentResponse())
+
+    const result = await commentV2Tool.transformResponse!(
+      pullRequestResponse(),
+      FILE_COMMENT_PARAMS
+    )
+
+    expect(JSON.parse(fetchMock.mock.calls[0][1].body).commit_id).toBe(HEAD_SHA)
+    expect(result.output.commit_id).toBe(HEAD_SHA)
+  })
+
+  it('posts directly when commitId is supplied', () => {
+    const params = { ...FILE_COMMENT_PARAMS, commitId: 'b'.repeat(40) }
+    const url = commentTool.request.url as (params: CreateCommentParams) => string
+    const method = commentTool.request.method as (params: CreateCommentParams) => string
+
+    expect(url(params)).toBe('https://api.github.com/repos/octo/demo/pulls/7/comments')
+    expect(method(params)).toBe('POST')
+    expect(commentTool.request.body?.(params)).toEqual({
+      body: 'Looks good',
+      commit_id: 'b'.repeat(40),
+      path: 'src/main.ts',
+      line: 42,
+      side: 'RIGHT',
+    })
+  })
+
+  it('fails with an actionable error when the pull request has no head SHA', async () => {
+    await expect(
+      commentTool.transformResponse!(Response.json({ number: 7 }), FILE_COMMENT_PARAMS)
+    ).rejects.toThrow(/no head commit SHA for pull request octo\/demo#7/)
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('leaves general PR comments on the reviews endpoint', () => {
+    const params: CreateCommentParams = {
+      owner: 'octo',
+      repo: 'demo',
+      pullNumber: 7,
+      body: 'Nice',
+      commentType: 'pr_comment',
+      apiKey: 'ghp_test',
+    }
+    const url = commentTool.request.url as (params: CreateCommentParams) => string
+
+    expect(url(params)).toBe('https://api.github.com/repos/octo/demo/pulls/7/reviews')
+    expect(commentTool.request.body?.(params)).toEqual({ body: 'Nice', event: 'COMMENT' })
+  })
+
+  it('no longer exposes the deprecated position parameter', () => {
+    expect(commentTool.params.position).toBeUndefined()
+  })
+})

apps/sim/tools/github/comment.test.ts

@@ -1,7 +1,82 @@
+import { isRecordLike } from '@sim/utils/object'
+import { readGitHubErrorMessage } from '@/tools/github/response-parsers'
 import type { CreateCommentParams, CreateCommentResponse } from '@/tools/github/types'
 import { COMMENT_OUTPUT_PROPERTIES, USER_OUTPUT } from '@/tools/github/types'
 import type { ToolConfig } from '@/tools/types'
 
+const GITHUB_API_BASE = 'https://api.github.com'
+
+function githubHeaders(apiKey: string): Record<string, string> {
+  return {
+    Accept: 'application/vnd.github.v3+json',
+    Authorization: `Bearer ${apiKey}`,
+    'X-GitHub-Api-Version': '2022-11-28',
+  }
+}
+
+function pullRequestUrl(params: CreateCommentParams): string {
+  return `${GITHUB_API_BASE}/repos/${params.owner}/${params.repo}/pulls/${params.pullNumber}`
+}
+
+/**
+ * GitHub requires `commit_id` on a pull request review comment. When the caller did
+ * not supply one, the pull request is fetched first so its head SHA can be used —
+ * mirroring how Jira resolves a missing `cloudId` from `domain`.
+ */
+function needsCommitLookup(params: CreateCommentParams): boolean {
+  return params.commentType === 'file_comment' && !params.commitId
+}
+
+function fileCommentBody(params: CreateCommentParams, commitId: string): Record<string, any> {
+  return {
+    body: params.body,
+    commit_id: commitId,
+    path: params.path,
+    line: params.line,
+    side: params.side || 'RIGHT',
+  }
+}
+
+function readHeadSha(pullRequest: unknown): string | undefined {
+  if (!isRecordLike(pullRequest) || !isRecordLike(pullRequest.head)) return undefined
+  const sha = pullRequest.head.sha
+  return typeof sha === 'string' && sha ? sha : undefined
+}
+
+/**
+ * Returns the raw GitHub comment payload. For a file comment created without an
+ * explicit `commitId`, `response` holds the pull request lookup instead: its head
+ * SHA is read and the comment is posted in a follow-up request.
+ */
+async function readCommentPayload(
+  response: Response,
+  params?: CreateCommentParams
+): Promise<Record<string, any>> {
+  if (!params || !needsCommitLookup(params)) return response.json()
+
+  const commitId = readHeadSha(await response.json())
+  if (!commitId) {
+    throw new Error(
+      `GitHub returned no head commit SHA for pull request ${params.owner}/${params.repo}#${params.pullNumber}. Set commitId to comment on a specific commit.`
+    )
+  }
+
+  const commentResponse = await fetch(`${pullRequestUrl(params)}/comments`, {
+    method: 'POST',
+    headers: { ...githubHeaders(params.apiKey), 'Content-Type': 'application/json' },
+    body: JSON.stringify(fileCommentBody(params, commitId)),
+  })
+
+  if (!commentResponse.ok) {
+    throw new Error(
+      (await readGitHubErrorMessage(commentResponse)) ??
+        `Failed to create file comment (HTTP ${commentResponse.status})`
+    )
+  }
+
+  return commentResponse.json()
+}
+
 export const commentTool: ToolConfig<CreateCommentParams, CreateCommentResponse> = {
   id: 'github_comment',
   name: 'GitHub PR Commenter',
@@ -39,12 +114,6 @@ export const commentTool: ToolConfig<CreateCommentParams, CreateCommentResponse>
       visibility: 'user-or-llm',
       description: 'File path for review comment',
     },
-    position: {
-      type: 'number',
-      required: false,
-      visibility: 'hidden',
-      description: 'Line number for review comment',
-    },
     commentType: {
       type: 'string',
       required: false,
@@ -68,7 +137,7 @@ export const commentTool: ToolConfig<CreateCommentParams, CreateCommentResponse>
       type: 'string',
       required: false,
       visibility: 'hidden',
-      description: 'The SHA of the commit to comment on',
+      description: 'The SHA of the commit to comment on. Defaults to the pull request head commit.',
     },
     apiKey: {
       type: 'string',
@@ -80,26 +149,22 @@ export const commentTool: ToolConfig<CreateCommentParams, CreateCommentResponse>
 
   request: {
     url: (params) => {
+      if (needsCommitLookup(params)) {
+        return pullRequestUrl(params)
+      }
       if (params.path) {
-        return `https://api.github.com/repos/${params.owner}/${params.repo}/pulls/${params.pullNumber}/comments`
+        return `${pullRequestUrl(params)}/comments`
       }
-      return `https://api.github.com/repos/${params.owner}/${params.repo}/pulls/${params.pullNumber}/reviews`
+      return `${pullRequestUrl(params)}/reviews`
     },
-    method: 'POST',
-    headers: (params) => ({
-      Accept: 'application/vnd.github.v3+json',
-      Authorization: `Bearer ${params.apiKey}`,
-      'X-GitHub-Api-Version': '2022-11-28',
-    }),
+    method: (params) => (needsCommitLookup(params) ? 'GET' : 'POST'),
+    headers: (params) => githubHeaders(params.apiKey),
     body: (params) => {
+      if (needsCommitLookup(params)) {
+        return undefined
+      }
       if (params.commentType === 'file_comment') {
-        return {
-          body: params.body,
-          commit_id: params.commitId,
-          path: params.path,
-          line: params.line || params.position,
-          side: params.side || 'RIGHT',
-        }
+        return fileCommentBody(params, params.commitId as string)
       }
       return {
         body: params.body,
@@ -108,8 +173,8 @@ export const commentTool: ToolConfig<CreateCommentParams, CreateCommentResponse>
     },
   },
 
-  transformResponse: async (response) => {
-    const data = await response.json()
+  transformResponse: async (response, params) => {
+    const data = await readCommentPayload(response, params)
 
     // Create a human-readable content string
     const content = `Comment created: "${data.body}"`
@@ -141,15 +206,15 @@ export const commentTool: ToolConfig<CreateCommentParams, CreateCommentResponse>
   },
 }
 
-export const commentV2Tool: ToolConfig = {
+export const commentV2Tool: ToolConfig<CreateCommentParams> = {
   id: 'github_comment_v2',
   name: commentTool.name,
   description: commentTool.description,
   version: '2.0.0',
   params: commentTool.params,
   request: commentTool.request,
-  transformResponse: async (response: Response) => {
-    const data = await response.json()
+  transformResponse: async (response: Response, params?: CreateCommentParams) => {
+    const data = await readCommentPayload(response, params)
     return {
       success: true,
       output: {

apps/sim/tools/github/comment.ts

@@ -866,7 +866,6 @@ export interface PRV2OperationParams extends PROperationParams {
 export interface CreateCommentParams extends PROperationParams {
   body: string
   path?: string
-  position?: number
   line?: number
   side?: string
   commitId?: string