webhook events are created for unpublished comments

[shollander]

Description

action: "edited" and action: "deleted" webhooks events are published for comments that are pending (i.e. the review has not yet been submitted. This just started occurring after updating to 1.20.0.

How to reproduce:

1. Create a "Gitea" type webhook. (You can use a dummy url since you can the recent deliveries for evidence). Ensure that Pull Request Event -> Pull Request Comment is checked.
2. Start a review on a PR but do not submit it by commenting on a line and clicking "Start Review".
3. Edit the comment. Click Save.
4. Delete the comment

Check the recent deliveries of the webhook. You will see pull_request_comment events for the edit and delete of the comment.
This behavior is not correct. If the review was not published no one should be able to see the comment activity besides for the user that is working on the review.

Gitea Version

1.20.0

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

systemd

Database

None

[delvh]

Partial duplicate of #18846 (although my issue has an even broader scope and is basically two bugs at once)

[shollander]

I believe this is a serious issue since it affects users expectations of privacy.
This was closed as completed without any work being done, and the linked issue does not seem to have any plans for being worked.