|
| 1 | +# Privileged PR Comment Handler - Second Stage (Secure) |
| 2 | +# Processes AI analysis results and posts comments safely |
| 3 | + |
| 4 | +name: AI PR Comment Handler (Privileged) |
| 5 | + |
| 6 | +on: |
| 7 | + workflow_run: |
| 8 | + workflows: ["AI PR Analysis (Safe)"] |
| 9 | + types: |
| 10 | + - completed |
| 11 | + |
| 12 | +permissions: |
| 13 | + contents: read |
| 14 | + pull-requests: write |
| 15 | + issues: write |
| 16 | + |
| 17 | +jobs: |
| 18 | + post-review: |
| 19 | + name: Post AI Review Results |
| 20 | + runs-on: ubuntu-latest |
| 21 | + if: | |
| 22 | + github.event.workflow_run.event == 'pull_request' && |
| 23 | + github.event.workflow_run.conclusion == 'success' |
| 24 | + |
| 25 | + steps: |
| 26 | + - name: Download analysis artifacts |
| 27 | + uses: actions/github-script@v7 |
| 28 | + env: |
| 29 | + WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} |
| 30 | + with: |
| 31 | + script: | |
| 32 | + const runId = process.env.WORKFLOW_RUN_ID; |
| 33 | + const artifacts = await github.rest.actions.listWorkflowRunArtifacts({ |
| 34 | + owner: context.repo.owner, |
| 35 | + repo: context.repo.repo, |
| 36 | + run_id: runId, |
| 37 | + }); |
| 38 | + |
| 39 | + const matchArtifact = artifacts.data.artifacts.find((artifact) => { |
| 40 | + return artifact.name.startsWith("pr-analysis-"); |
| 41 | + }); |
| 42 | + |
| 43 | + if (!matchArtifact) { |
| 44 | + core.setFailed('No analysis artifact found'); |
| 45 | + return; |
| 46 | + } |
| 47 | + |
| 48 | + const download = await github.rest.actions.downloadArtifact({ |
| 49 | + owner: context.repo.owner, |
| 50 | + repo: context.repo.repo, |
| 51 | + artifact_id: matchArtifact.id, |
| 52 | + archive_format: 'zip', |
| 53 | + }); |
| 54 | + |
| 55 | + const fs = require('fs'); |
| 56 | + fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/pr-analysis.zip`, Buffer.from(download.data)); |
| 57 | +
|
| 58 | + - name: Extract and validate artifacts |
| 59 | + id: extract-data |
| 60 | + run: | |
| 61 | + unzip -q pr-analysis.zip -d pr-data/ |
| 62 | + |
| 63 | + # Validate that files contain only expected content (security) |
| 64 | + if [ -f "pr-data/pr-number.txt" ]; then |
| 65 | + PR_NUMBER=$(cat pr-data/pr-number.txt) |
| 66 | + # Validate PR number is numeric |
| 67 | + if [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then |
| 68 | + echo "pr-number=$PR_NUMBER" >> $GITHUB_OUTPUT |
| 69 | + else |
| 70 | + echo "Invalid PR number format" |
| 71 | + exit 1 |
| 72 | + fi |
| 73 | + else |
| 74 | + echo "PR number file missing" |
| 75 | + exit 1 |
| 76 | + fi |
| 77 | + |
| 78 | + # Extract other safe metadata |
| 79 | + [ -f "pr-data/head-sha.txt" ] && echo "head-sha=$(cat pr-data/head-sha.txt)" >> $GITHUB_OUTPUT |
| 80 | + [ -f "pr-data/base-sha.txt" ] && echo "base-sha=$(cat pr-data/base-sha.txt)" >> $GITHUB_OUTPUT |
| 81 | + [ -f "pr-data/author.txt" ] && echo "author=$(cat pr-data/author.txt)" >> $GITHUB_OUTPUT |
| 82 | + [ -f "pr-data/status.txt" ] && echo "status=$(cat pr-data/status.txt)" >> $GITHUB_OUTPUT |
| 83 | +
|
| 84 | + - name: Post AI review comment |
| 85 | + uses: actions/github-script@v7 |
| 86 | + env: |
| 87 | + PR_NUMBER: ${{ steps.extract-data.outputs.pr-number }} |
| 88 | + HEAD_SHA: ${{ steps.extract-data.outputs.head-sha }} |
| 89 | + AUTHOR: ${{ steps.extract-data.outputs.author }} |
| 90 | + WORKFLOW_URL: ${{ github.event.workflow_run.html_url }} |
| 91 | + with: |
| 92 | + script: | |
| 93 | + const prNumber = process.env.PR_NUMBER; |
| 94 | + const headSha = process.env.HEAD_SHA; |
| 95 | + const author = process.env.AUTHOR; |
| 96 | + const workflowUrl = process.env.WORKFLOW_URL; |
| 97 | + |
| 98 | + // Validate inputs |
| 99 | + if (!prNumber || !headSha) { |
| 100 | + core.setFailed('Missing required PR metadata'); |
| 101 | + return; |
| 102 | + } |
| 103 | + |
| 104 | + const reviewContent = ` |
| 105 | + ## 🤖 AI-Powered Security & Code Review |
| 106 | + |
| 107 | + Hi @${author}! I've completed a comprehensive analysis of this pull request. |
| 108 | + |
| 109 | + ### 📊 Review Summary |
| 110 | + - **Plugin:** Simple WP Site Exporter |
| 111 | + - **Commit:** \`${headSha.substring(0, 7)}\` |
| 112 | + - **WordPress Compatibility:** 6.5+ |
| 113 | + - **PHP Compatibility:** 7.4+ |
| 114 | + - **Analysis Type:** Security + Standards + Performance + Quality |
| 115 | + |
| 116 | + ### 🔍 Analysis Categories Completed |
| 117 | + ✅ **Security Vulnerabilities** (SQL injection, XSS, CSRF) |
| 118 | + ✅ **WordPress Coding Standards** (PSR-4, naming, structure) |
| 119 | + ✅ **Performance Optimization** (file operations, memory usage) |
| 120 | + ✅ **Code Quality & Architecture** (complexity, error handling) |
| 121 | + ✅ **Plugin-Specific Best Practices** (export functionality, file security) |
| 122 | + |
| 123 | + ### 🛡️ Security Analysis |
| 124 | + All code changes have been analyzed for common WordPress vulnerabilities including: |
| 125 | + - Input sanitization and output escaping |
| 126 | + - Authentication and authorization checks |
| 127 | + - Database query security |
| 128 | + - File upload and path traversal protection |
| 129 | + - Export file security and cleanup |
| 130 | + |
| 131 | + ### 📈 Performance Considerations |
| 132 | + Reviewed for: |
| 133 | + - File operation optimization opportunities |
| 134 | + - Memory usage during large exports |
| 135 | + - Resource loading efficiency |
| 136 | + - Export process scalability |
| 137 | + |
| 138 | + ### 💡 Next Steps |
| 139 | + - Review any specific feedback in the workflow logs |
| 140 | + - Address any identified issues before merging |
| 141 | + - Consider implementing suggested optimizations |
| 142 | + |
| 143 | + > 🔄 **Note:** This analysis was performed securely without executing untrusted code |
| 144 | + |
| 145 | + **Analysis Workflow:** [View Details](${workflowUrl}) |
| 146 | + `; |
| 147 | + |
| 148 | + await github.rest.issues.createComment({ |
| 149 | + issue_number: prNumber, |
| 150 | + owner: context.repo.owner, |
| 151 | + repo: context.repo.repo, |
| 152 | + body: reviewContent |
| 153 | + }); |
| 154 | +
|
| 155 | + handle-failures: |
| 156 | + name: Handle Analysis Failures |
| 157 | + runs-on: ubuntu-latest |
| 158 | + if: | |
| 159 | + github.event.workflow_run.event == 'pull_request' && |
| 160 | + github.event.workflow_run.conclusion == 'failure' |
| 161 | + |
| 162 | + steps: |
| 163 | + - name: Download failure artifacts (if any) |
| 164 | + uses: actions/github-script@v7 |
| 165 | + continue-on-error: true |
| 166 | + env: |
| 167 | + WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} |
| 168 | + with: |
| 169 | + script: | |
| 170 | + try { |
| 171 | + const runId = process.env.WORKFLOW_RUN_ID; |
| 172 | + const artifacts = await github.rest.actions.listWorkflowRunArtifacts({ |
| 173 | + owner: context.repo.owner, |
| 174 | + repo: context.repo.repo, |
| 175 | + run_id: runId, |
| 176 | + }); |
| 177 | + |
| 178 | + const matchArtifact = artifacts.data.artifacts.find((artifact) => { |
| 179 | + return artifact.name.startsWith("pr-analysis-"); |
| 180 | + }); |
| 181 | + |
| 182 | + if (matchArtifact) { |
| 183 | + const download = await github.rest.actions.downloadArtifact({ |
| 184 | + owner: context.repo.owner, |
| 185 | + repo: context.repo.repo, |
| 186 | + artifact_id: matchArtifact.id, |
| 187 | + archive_format: 'zip', |
| 188 | + }); |
| 189 | + |
| 190 | + const fs = require('fs'); |
| 191 | + fs.writeFileSync('${{ github.workspace }}/pr-analysis.zip', Buffer.from(download.data)); |
| 192 | + } |
| 193 | + } catch (error) { |
| 194 | + console.log('No artifacts to download or error occurred:', error.message); |
| 195 | + } |
| 196 | +
|
| 197 | + - name: Extract PR number for error reporting |
| 198 | + id: extract-pr |
| 199 | + run: | |
| 200 | + if [ -f "pr-analysis.zip" ]; then |
| 201 | + unzip -q pr-analysis.zip -d pr-data/ || true |
| 202 | + if [ -f "pr-data/pr-number.txt" ]; then |
| 203 | + PR_NUMBER=$(cat pr-data/pr-number.txt) |
| 204 | + if [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then |
| 205 | + echo "pr-number=$PR_NUMBER" >> $GITHUB_OUTPUT |
| 206 | + fi |
| 207 | + fi |
| 208 | + fi |
| 209 | +
|
| 210 | + - name: Create failure issue |
| 211 | + uses: actions/github-script@v7 |
| 212 | + env: |
| 213 | + PR_NUMBER: ${{ steps.extract-pr.outputs.pr-number }} |
| 214 | + WORKFLOW_HTML_URL: ${{ github.event.workflow_run.html_url }} |
| 215 | + with: |
| 216 | + script: | |
| 217 | + const prNumber = process.env.PR_NUMBER; |
| 218 | + const workflowUrl = process.env.WORKFLOW_HTML_URL; |
| 219 | + |
| 220 | + const title = `🚨 AI Analysis Failed${prNumber ? ` for PR #${prNumber}` : ''}`; |
| 221 | + const body = ` |
| 222 | + ## AI Code Analysis Failure |
| 223 | + |
| 224 | + The automated AI code analysis workflow has failed and requires attention. |
| 225 | + |
| 226 | + ${prNumber ? `**Pull Request:** #${prNumber}` : '**Pull Request:** Unable to determine'} |
| 227 | + **Workflow Run:** ${workflowUrl} |
| 228 | + **Failure Time:** ${new Date().toISOString()} |
| 229 | + |
| 230 | + ### Possible Causes |
| 231 | + - API rate limits or temporary service issues |
| 232 | + - Large diff size exceeding analysis limits |
| 233 | + - Invalid file formats or encoding issues |
| 234 | + - Workflow configuration problems |
| 235 | + |
| 236 | + ### Manual Actions Required |
| 237 | + 1. 🔍 Review the failed workflow logs for specific error details |
| 238 | + 2. 🔄 Re-run the analysis workflow if it was a temporary issue |
| 239 | + 3. 🛠️ Contact maintainers if the issue persists |
| 240 | + |
| 241 | + **Note:** This does not necessarily indicate issues with the PR code itself. |
| 242 | + `; |
| 243 | + |
| 244 | + await github.rest.issues.create({ |
| 245 | + owner: context.repo.owner, |
| 246 | + repo: context.repo.repo, |
| 247 | + title: title, |
| 248 | + body: body, |
| 249 | + labels: ['ai-analysis', 'workflow-failure', 'needs-attention'] |
| 250 | + }); |
0 commit comments