Update PR comment behavior for on-failure mode

[sgmurphy]

Summary

• Fixes PR comment behavior in on-failure mode to update existing comments when issues are resolved
• Adds comprehensive test coverage for comment-pr functionality
• Fixes Mark previous PR comment as outdated #628 and Update previous comment when failure is resolved #647

Changes

• Modified comment-pr.ts to handle success cases in on-failure mode by updating existing comments
• Added hasExistingComment helper function to check for existing dependency review comments
• Added comprehensive test suite covering all comment modes and scenarios

Test plan

• All existing tests pass
• New tests cover all comment modes (always, never, on-failure)
• Tests verify proper comment creation, updating, and skipping behavior
• Edge cases handled (non-PR context, multiple comments)

Demo

Live demonstration of the enhanced functionality:

Demo 1: Enhanced on-failure mode behavior

sgmurphy/fictional-garbanzo#1

• Demonstrates improved comment behavior in on-failure mode
• Shows comment creation when vulnerabilities are found
• Shows comment updating (not creating new ones) when vulnerabilities are resolved
• Prevents comment spam by reusing existing comments

Demo 2: never mode validation

sgmurphy/fictional-garbanzo#2

• Validates that comment-summary-in-pr: never properly suppresses all comments
• Even with vulnerabilities present, no PR comments are created
• Ensures "never" mode works correctly with the enhanced logic

[sgmurphy]

Hey @dangoor 👋 , any chance I could get a review 👀 on this?

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity for 180 days. You can: comment on the PR or remove the stale label to hold stalebot off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing, this pull request will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.

[niebloomj]

This is still very important to me!

[jsoref]

@niebloomj unfortunately this PR has merge conflicts (there's a dev planning to make a release soon, so if you rebase maybe they'd be able to merge...)

[niebloomj]

@sgmurphy I opened sgmurphy#3 in your fork to resolve the merge conflicts against current actions/main. If you merge it into update-pr-comment, this PR should become mergeable. All 198 tests pass locally including the 8 new comment-pr.test.ts ones.

[sgmurphy]

Thanks for the PR @niebloomj! I think this PR is ready for review again.

[jsoref]

@ahpook ?