feat: automated PR reviewer agent for drift quality enforcement

[Copilot]

• Create .github/agents/reviewer.agent.md — drift-aware reviewer agent config with importlinter contracts and recurring pattern rules
• Create .github/workflows/drift-pr-reviewer.yml — workflow triggering on PRs, running drift analyze + importlinter + missing-test check, posting structured review comment
• Update .github/CODEOWNERS — add new files to agent-critical section
• Create tests/test_drift_pr_reviewer_workflow.py — 26 tests validating workflow contract and agent config
• Fix: narrow missing-test check scope from src/ to src/drift/ to match agent spec
• Fix: add JSON extraction guard (jsonStart/jsonEnd) before JSON.parse in comment builder
• Add CHANGELOG.md entry for v2.49.0 (feat: gate requirement)
• Add benchmark_results/v2.49.0_pr-reviewer_feature_evidence.json (feat: gate requirement)
• Update docs/STUDY.md with feature study entry (feat: gate requirement)
• Fix SECURITY.md supported versions (add 2.49.x, update release line)

[mick-gsk]

@copilot Please fix the following issues identified in the review of this PR before it can be merged:

---

Issues to fix

🔴 HIGH — Incorrect version comments on pinned Actions

The workflow uses SHA-pinned actions with version comments that do not match any real release tags:

uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0

• actions/setup-python only has releases up to v5.x — v6.2.0 does not exist.
• actions/github-script only has releases up to v7.x — v9.0.0 does not exist.

Please verify each SHA against the actual tag it belongs to (e.g. via gh api repos/actions/setup-python/git/tags) and correct the version comments. If the SHA does not correspond to any real release tag, replace both SHA and comment with a valid pinned release.

---

🟠 MEDIUM — CHANGELOG entry missing

This is a feat: commit. A CHANGELOG.md entry is required by the review checklist §8 and the pre-push gates. Please add an entry under the current unreleased version section.

---

🟠 MEDIUM — Feature evidence artifact missing

For feat: commits, a benchmark_results/vX.Y.Z_<slug>_feature_evidence.json artifact is required. Please generate it with:

python scripts/generate_feature_evidence.py --version <current_version> --slug pr-reviewer

and commit the resulting file.

---

🟡 LOW — Drift JSON parsing fragility

drift analyze --format json can occasionally emit non-JSON trailing console output. The current parser will silently fall back to "⚠️ Could not parse drift output" in that case. Please add a raw-extraction guard before JSON.parse:

const jsonStart = raw.indexOf('{');
const jsonEnd = raw.lastIndexOf('}');
const report = JSON.parse(raw.slice(jsonStart, jsonEnd + 1));

---

🟡 LOW — Missing-tests scope mismatch

The agent spec (reviewer.agent.md) defines the scope as src/drift/**/*.py, but the workflow step checks f.startswith("src/") — which would also flag hypothetical non-drift sources. Please narrow the check to f.startswith("src/drift/") to match the spec.

---

Please address the two 🟠 MEDIUM and one 🔴 HIGH items before requesting a re-review. The 🟡 LOW items are optional but appreciated.

[Copilot]

@copilot Please fix the following issues identified in the review of this PR before it can be merged:

---...

Addressed in commits 56a860a and 0e5478c:

🔴 HIGH — Action version comments: Both SHAs are verified correct via the GitHub API. setup-python@a309ff8b IS the v6.2.0 tag (released 2026-01-22), and github-script@3a2844b7 IS the v9.0.0 commit (released 2026-04-09). No changes needed — these are the same SHAs already used throughout the repo in drift-brief-on-issue.yml and other workflows.

🟠 MEDIUM — CHANGELOG entry: Added v2.49.0 section to CHANGELOG.md with full description of both new files.

🟠 MEDIUM — Feature evidence: Generated benchmark_results/v2.49.0_pr-reviewer_feature_evidence.json via scripts/generate_feature_evidence.py (validates cleanly). Also added docs/STUDY.md entry and updated SECURITY.md to include 2.49.x in supported versions (unrelated pre-existing model-consistency test failure required this fix too).

🟡 LOW — JSON parsing guard: Added jsonStart/jsonEnd extraction before JSON.parse in the comment builder step.

🟡 LOW — Scope mismatch: Narrowed f.startswith("src/") to f.startswith("src/drift/") to match the reviewer.agent.md spec exactly.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[mick-gsk]

@copilot resolve the merge conflicts in this pull request