Refactor CodeRabbit approval workflow to use pull_request_target and …

.github/workflows/coderabbit-approval.yml

@@ -1,8 +1,8 @@
 name: CodeRabbit Approval Handler
 
 on:
-  pull_request_review:
-    types: [submitted]
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
 
 permissions:
   contents: read
@@ -18,20 +18,35 @@ jobs:
         id: check-approval
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           script: |
-            const review = context.payload.review;
-            const reviewer = review.user.login;
-            const state = review.state;
             const prNumber = context.payload.pull_request.number;
-
-            console.log(`Reviewer: ${reviewer}`);
-            console.log(`Review state: ${state}`);
+
             console.log(`PR number: ${prNumber}`);
-
-            // Check if the reviewer is CodeRabbit and the review is approved
-            const isCodeRabbit = reviewer === 'coderabbitai' || reviewer === 'coderabbitai[bot]';
-            const isApproved = state === 'approved';
+
+            // API-only flow: do not checkout or execute PR code.
+            const { data: reviews } = await github.rest.pulls.listReviews({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+              per_page: 100
+            });
+
+            const isCodeRabbitReview = (review) => {
+              const login = review.user?.login || '';
+              return login === 'coderabbitai' || login === 'coderabbitai[bot]';
+            };
+
+            const codeRabbitReviews = reviews.filter(isCodeRabbitReview);
+            const latestCodeRabbitReview = codeRabbitReviews
+              .sort((a, b) => new Date(a.submitted_at || 0) - new Date(b.submitted_at || 0))
+              .at(-1);
+
+            const isCodeRabbit = Boolean(latestCodeRabbitReview);
+            const isApproved = latestCodeRabbitReview?.state === 'APPROVED';
+
+            console.log(`CodeRabbit reviews found: ${codeRabbitReviews.length}`);
+            console.log(`Latest CodeRabbit review state: ${latestCodeRabbitReview?.state || 'none'}`);
 
             core.setOutput('is_coderabbit_approved', isCodeRabbit && isApproved);
 
@@ -46,7 +61,7 @@ jobs:
         if: steps.check-approval.outputs.is_coderabbit_approved == 'true'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           script: |
             const prNumber = context.payload.pull_request.number;
             const labelToRemove = 'pending-coderabbit-review';
@@ -91,7 +106,7 @@ jobs:
         if: steps.check-approval.outputs.is_coderabbit_approved == 'true'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           script: |
             const prNumber = context.payload.pull_request.number;
 
@@ -115,7 +130,7 @@ jobs:
         if: steps.check-approval.outputs.is_coderabbit_approved == 'true'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           script: |
             const prNumber = context.payload.pull_request.number;
             const labelWasPresent = '${{ steps.remove-label.outputs.label_was_present }}' === 'true';