fix: address P1 issues from code review

- Fix combine job to run when EITHER review ran (not both)
- Set run_security_review=false when skipping existing security review
- Validate DROID_COMMENT_ID is non-zero in generate-review-prompt

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: shashank-factory

.github/workflows/droid-review.yml

@@ -94,11 +94,11 @@ jobs:
 
   combine:
     needs: [prepare, code-review, security-review]
-    # Only run combine when BOTH code review AND security review were executed
+    # Run combine when EITHER code review OR security review was executed
     if: |
       always() &&
-      needs.prepare.outputs.run_code_review == 'true' &&
-      needs.prepare.outputs.run_security_review == 'true'
+      (needs.prepare.outputs.run_code_review == 'true' ||
+       needs.prepare.outputs.run_security_review == 'true')
     runs-on: ubuntu-latest
     permissions:
       contents: write

src/entrypoints/generate-review-prompt.ts

@@ -20,6 +20,10 @@ async function run() {
     const reviewType = process.env.REVIEW_TYPE || "code";
     const commentId = parseInt(process.env.DROID_COMMENT_ID || "0");
 
+    if (!commentId) {
+      throw new Error("DROID_COMMENT_ID is required and must be non-zero");
+    }
+
     const context = parseGitHubContext();
 
     if (!isEntityContext(context)) {

src/tag/index.ts

@@ -152,6 +152,8 @@ export async function prepareTagExecution({
     const hasExisting = await hasExistingSecurityReview(octokit, context);
     if (hasExisting) {
       console.log("Security review already exists on this PR, skipping");
+      core.setOutput("run_code_review", "false");
+      core.setOutput("run_security_review", "false");
       return {
         skipped: true,
         reason: "security_review_exists",