|
| 1 | +name: Code Review Runner |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_call: |
| 5 | + inputs: |
| 6 | + pr_number: |
| 7 | + required: true |
| 8 | + type: string |
| 9 | + head_sha: |
| 10 | + required: true |
| 11 | + type: string |
| 12 | + base_sha: |
| 13 | + required: true |
| 14 | + type: string |
| 15 | + |
| 16 | +permissions: |
| 17 | + pull-requests: write |
| 18 | + contents: read |
| 19 | + issues: write |
| 20 | + |
| 21 | +jobs: |
| 22 | + code-review: |
| 23 | + runs-on: ubuntu-latest |
| 24 | + timeout-minutes: 60 |
| 25 | + steps: |
| 26 | + - name: Checkout repository |
| 27 | + uses: actions/checkout@v4 |
| 28 | + with: |
| 29 | + ref: ${{ inputs.head_sha }} |
| 30 | + |
| 31 | + - name: Install ripgrep |
| 32 | + run: | |
| 33 | + sudo apt-get update |
| 34 | + sudo apt-get install -y ripgrep |
| 35 | +
|
| 36 | + - name: Install OpenCode |
| 37 | + run: | |
| 38 | + for attempt in 1 2 3; do |
| 39 | + if curl -fsSL https://opencode.ai/install | bash; then |
| 40 | + echo "$HOME/.opencode/bin" >> $GITHUB_PATH |
| 41 | + exit 0 |
| 42 | + fi |
| 43 | + echo "Install attempt $attempt failed, retrying in 10s..." |
| 44 | + sleep 10 |
| 45 | + done |
| 46 | + echo "All install attempts failed" |
| 47 | + exit 1 |
| 48 | +
|
| 49 | + - name: Configure OpenCode auth |
| 50 | + run: | |
| 51 | + mkdir -p ~/.local/share/opencode |
| 52 | + cat > ~/.local/share/opencode/auth.json <<EOF |
| 53 | + { |
| 54 | + "github-copilot": { |
| 55 | + "type": "oauth", |
| 56 | + "refresh": "${CODE_REVIEW_ZCLLL_COPILOT_OPENCODE_KEY}", |
| 57 | + "access": "${CODE_REVIEW_ZCLLL_COPILOT_OPENCODE_KEY}", |
| 58 | + "expires": 0 |
| 59 | + } |
| 60 | + } |
| 61 | + EOF |
| 62 | + env: |
| 63 | + CODE_REVIEW_ZCLLL_COPILOT_OPENCODE_KEY: ${{ secrets.CODE_REVIEW_ZCLLL_COPILOT_OPENCODE_KEY }} |
| 64 | + |
| 65 | + - name: Configure OpenCode permission |
| 66 | + run: | |
| 67 | + echo '{"permission":"allow"}' > opencode.json |
| 68 | +
|
| 69 | + - name: Prepare review prompt |
| 70 | + run: | |
| 71 | + cat > /tmp/review_prompt.txt <<'PROMPT' |
| 72 | + You are performing an automated code review inside a GitHub Actions runner. The gh CLI is available and authenticated via GH_TOKEN. You can comment on the pull request. |
| 73 | +
|
| 74 | + Context: |
| 75 | + - Repository: PLACEHOLDER_REPO |
| 76 | + - PR number: PLACEHOLDER_PR_NUMBER |
| 77 | + - PR Head SHA: PLACEHOLDER_HEAD_SHA |
| 78 | + - PR Base SHA: PLACEHOLDER_BASE_SHA |
| 79 | +
|
| 80 | + Before reviewing any code, you MUST read and follow the code review skill in this repository. During review, you must strictly follow those instructions. |
| 81 | + In addition, you can perform any desired review operations to observe suspicious code and details in order to identify issues as much as possible. |
| 82 | +
|
| 83 | + ## Final response format |
| 84 | + - After completing the review, you MUST provide a final summary opinion based on the rules defined in AGENTS.md and the code-review skill. The summary must include conclusions for each applicable critical checkpoint. |
| 85 | + - If the overall quality of PR is good and there are no critical blocking issues (even if there are some tolerable minor issues), submit an opinion on approval using: gh pr review PLACEHOLDER_PR_NUMBER --approve --body "<summary>" |
| 86 | + - If issues found, submit a review with inline comments plus a comprehensive summary body. Use GitHub Reviews API to ensure comments are inline: |
| 87 | + - Inline comment bodies may include GitHub suggested changes blocks when you can propose a precise patch. |
| 88 | + - Prefer suggested changes for small, self-contained fixes (for example typos, trivial refactors, or narrowly scoped code corrections). |
| 89 | + - Do not force suggested changes for broad, architectural, or multi-file issues; explain those normally. |
| 90 | + - Build a JSON array of comments like: [{ "path": "<file>", "position": <diff_position>, "body": "..." }] |
| 91 | + - Submit via: gh api repos/PLACEHOLDER_REPO/pulls/PLACEHOLDER_PR_NUMBER/reviews --input <json_file> |
| 92 | + - The JSON file should contain: {"event":"REQUEST_CHANGES","body":"<summary>","comments":[...]} |
| 93 | + - After publish your opinion, your final response MUST end with exactly one machine-readable result block in this format: |
| 94 | + RESULT_START |
| 95 | + { |
| 96 | + "decision": "APPROVE" | "REQUEST_CHANGES" |
| 97 | + } |
| 98 | + RESULT_END |
| 99 | + PROMPT |
| 100 | + sed -i "s|PLACEHOLDER_REPO|${REPO}|g" /tmp/review_prompt.txt |
| 101 | + sed -i "s|PLACEHOLDER_PR_NUMBER|${PR_NUMBER}|g" /tmp/review_prompt.txt |
| 102 | + sed -i "s|PLACEHOLDER_HEAD_SHA|${HEAD_SHA}|g" /tmp/review_prompt.txt |
| 103 | + sed -i "s|PLACEHOLDER_BASE_SHA|${BASE_SHA}|g" /tmp/review_prompt.txt |
| 104 | + env: |
| 105 | + REPO: ${{ github.repository }} |
| 106 | + PR_NUMBER: ${{ inputs.pr_number }} |
| 107 | + HEAD_SHA: ${{ inputs.head_sha }} |
| 108 | + BASE_SHA: ${{ inputs.base_sha }} |
| 109 | + |
| 110 | + - name: Run automated code review |
| 111 | + id: review |
| 112 | + timeout-minutes: 55 |
| 113 | + continue-on-error: true |
| 114 | + env: |
| 115 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 116 | + run: | |
| 117 | + PROMPT=$(cat /tmp/review_prompt.txt) |
| 118 | +
|
| 119 | + set +e |
| 120 | + opencode run "$PROMPT" -m "github-copilot/gpt-5.4" 2>&1 | tee /tmp/opencode-review.log |
| 121 | + status=${PIPESTATUS[0]} |
| 122 | + set -e |
| 123 | +
|
| 124 | + last_log_line=$(awk 'NF { line = $0 } END { print line }' /tmp/opencode-review.log) |
| 125 | +
|
| 126 | + failure_reason="" |
| 127 | + if printf '%s\n' "$last_log_line" | rg -q -i '^Error:|SSE read timed out'; then |
| 128 | + failure_reason="$last_log_line" |
| 129 | + elif [ "$status" -ne 0 ]; then |
| 130 | + failure_reason="OpenCode exited with status $status" |
| 131 | + fi |
| 132 | +
|
| 133 | + result_json=$(awk ' |
| 134 | + /^RESULT_START$/ {capture=1; current=""; next} |
| 135 | + /^RESULT_END$/ {capture=0; result=current; found=1; next} |
| 136 | + capture {current = current $0 ORS} |
| 137 | + END { |
| 138 | + if (found) { |
| 139 | + printf "%s", result |
| 140 | + } |
| 141 | + } |
| 142 | + ' /tmp/opencode-review.log) |
| 143 | +
|
| 144 | + if [ -z "$failure_reason" ] && [ -z "$result_json" ]; then |
| 145 | + failure_reason="OpenCode did not emit a RESULT_START/RESULT_END result block" |
| 146 | + fi |
| 147 | +
|
| 148 | + if [ -z "$failure_reason" ] && ! printf '%s' "$result_json" > /tmp/opencode-review-result.json; then |
| 149 | + failure_reason="Failed to persist OpenCode review result" |
| 150 | + fi |
| 151 | +
|
| 152 | + if [ -z "$failure_reason" ] && ! jq -e '.decision == "APPROVE" or .decision == "REQUEST_CHANGES"' /tmp/opencode-review-result.json > /dev/null; then |
| 153 | + failure_reason="OpenCode emitted an invalid review decision" |
| 154 | + fi |
| 155 | +
|
| 156 | + if [ -n "$failure_reason" ]; then |
| 157 | + { |
| 158 | + echo "failure_reason<<EOF" |
| 159 | + printf '%s\n' "$failure_reason" |
| 160 | + echo "EOF" |
| 161 | + } >> "$GITHUB_OUTPUT" |
| 162 | + exit 1 |
| 163 | + fi |
| 164 | +
|
| 165 | + decision=$(jq -r '.decision' /tmp/opencode-review-result.json) |
| 166 | + echo "decision=$decision" >> "$GITHUB_OUTPUT" |
| 167 | +
|
| 168 | + if [ "$decision" == "REQUEST_CHANGES" ]; then |
| 169 | + exit 1 |
| 170 | + fi |
| 171 | +
|
| 172 | + - name: Comment PR on review failure |
| 173 | + if: ${{ always() && steps.review.outcome != 'success' && steps.review.outputs.decision != 'REQUEST_CHANGES' }} |
| 174 | + env: |
| 175 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 176 | + REVIEW_FAILURE_REASON: ${{ steps.review.outputs.failure_reason }} |
| 177 | + REVIEW_OUTCOME: ${{ steps.review.outcome }} |
| 178 | + RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} |
| 179 | + run: | |
| 180 | + error_msg="${REVIEW_FAILURE_REASON:-Review step was $REVIEW_OUTCOME (possibly timeout or cancelled)}" |
| 181 | + gh pr comment "${{ inputs.pr_number }}" --body "$(cat <<EOF |
| 182 | + OpenCode automated review failed and did not complete. |
| 183 | +
|
| 184 | + Error: ${error_msg} |
| 185 | + Workflow run: ${RUN_URL} |
| 186 | +
|
| 187 | + Please inspect the workflow logs and rerun the review after the underlying issue is resolved. |
| 188 | + EOF |
| 189 | + )" |
| 190 | +
|
| 191 | + - name: Fail workflow if review failed |
| 192 | + if: ${{ always() && steps.review.outcome != 'success' }} |
| 193 | + env: |
| 194 | + REVIEW_FAILURE_REASON: ${{ steps.review.outputs.failure_reason }} |
| 195 | + REVIEW_OUTCOME: ${{ steps.review.outcome }} |
| 196 | + run: | |
| 197 | + error_msg="${REVIEW_FAILURE_REASON:-Review step was $REVIEW_OUTCOME (possibly timeout or cancelled)}" |
| 198 | + echo "OpenCode automated review failed: ${error_msg}" |
| 199 | + exit 1 |
0 commit comments