gh-aw AI Moderator: hide_comment 404 fails the safe_outputs job

[JacobPEvans]

Symptom

`AI Moderator` (gh-aw agentic workflow) fails in the `safe_outputs` job across the ansible-* repos:

```text
Failed to hide comment: Could not resolve to a node with the global id of 'IC_kwDON5ER6c6Gbxe2'
```

Failure counts (last 100 runs): ansible-proxmox 14x, ansible-splunk 13x, ansible-proxmox-apps 16x.

Root cause

The AI agent classifies an issue/PR comment as spam and emits a `hide_comment` safe-output. By the time the post-job `safe_outputs` step runs, the comment has already been deleted (Renovate force-push, the bot itself cleaning up, or human deletion). GitHub returns 404 GraphQL "node not found".

The current config `retry-exempt-status-codes: 400,401,403,404,422` means 404 does NOT retry — the job just fails. `hide_comment` on an already-gone comment should be a no-op success, not a fatal error.

Fix options

1. Upstream: file issue at `githubnext/agentics` requesting that `hide_comment` treat 404 / `NOT_FOUND` GraphQL errors as success.
2. Workaround in this repo's gh-aw `.md` source: disable `hide_comment` in `safe-outputs` frontmatter until upstream lands a fix. Keep `add_comment` and other safe-outputs working.
3. Per-repo override: if the affected repos' workflows pull from this repo, fix once here.

Affected repos

`ansible-proxmox`, `ansible-splunk`, `ansible-proxmox-apps` — likely others using the same AI Moderator workflow.

[JacobPEvans]

Investigation Update

Deep-dived into the gh-aw compiler and runtime to evaluate the proposed workaround.

Frontmatter override doesn't work

The proposed fix ("override `safe-outputs` in `ai-moderator.md` frontmatter to drop `hide_comment`") does not work with the current gh-aw compiler. The merge semantics in `MergeSafeOutputs` allow the main workflow to replace an imported safe-output type (e.g. override config values), but there is no mechanism to remove/suppress a safe-output type that the imported workflow defines. Setting `hide-comment: false` in the local frontmatter creates a default `HideCommentConfig{max:5}` (non-nil), which still includes the handler.

Actual root cause: runtime bug in hide_comment.cjs

The real fix belongs in `github/gh-aw-actions/setup/js/hide_comment.cjs`. When `minimizeComment` returns "Could not resolve to a node", the catch block returns `{success: false}`, causing the `safe_outputs` job to fail. The fix is to treat "node not found" errors as success:

} catch (error) {
  const errorMessage = getErrorMessage(error);
  // Comment no longer exists → goal achieved → success
  if (errorMessage.includes("Could not resolve to a node")) {
    core.warning(`Comment ${commentId} no longer exists. Treating as success.`);
    return { success: true, comment_id: commentId, is_hidden: true };
  }
  core.error(`Failed to hide comment: ${errorMessage}`);
  return { success: false, error: errorMessage };
}

This fix needs to land in `github/gh-aw` / `github/gh-aw-actions` (both internal repos — raise with the gh-aw team directly).

Status

• Cannot fix via frontmatter override
• Cannot create issue in `github/gh-aw` (access restricted)
• Failures are sporadic and benign (moderation goal achieved — comment no longer visible)
• Will auto-resolve once gh-aw team ships the runtime fix and we sync to the new action-tag