improv: make it readonly and allow to summon by comment from members only

Author: tomasz-stefaniak

.github/pull_request_template.md

@@ -4,8 +4,8 @@
 
 ## AI Code Review
 
-- **Team members**: AI review will run automatically when PR is opened or marked ready for review
-- **Community contributors**: Request AI review by commenting `@continue-review` on your PR
+- **Team members only**: AI review runs automatically when PR is opened or marked ready for review
+- Team members can also trigger a review by commenting `@continue-review`
 
 ## Checklist
 

.github/workflows/continue-review.yaml

@@ -18,15 +18,18 @@ jobs:
     timeout-minutes: 10
     # Only run if:
     # - It's a PR event from a team member (with write/admin permissions)
-    # - OR it's a comment with @continue-review on a PR (from anyone)
+    # - OR it's a comment with @continue-review on a PR from a team member
     if: |
       (github.event_name == 'pull_request' && 
        (github.event.pull_request.author_association == 'OWNER' || 
         github.event.pull_request.author_association == 'MEMBER' || 
         github.event.pull_request.author_association == 'COLLABORATOR')) ||
       (github.event_name == 'issue_comment' && 
        github.event.issue.pull_request && 
-       contains(github.event.comment.body, '@continue-review'))
+       contains(github.event.comment.body, '@continue-review') &&
+       (github.event.comment.author_association == 'OWNER' || 
+        github.event.comment.author_association == 'MEMBER' || 
+        github.event.comment.author_association == 'COLLABORATOR'))
 
     steps:
       - name: Checkout Repository
@@ -108,7 +111,7 @@ jobs:
           echo ""
 
           # Run the CLI with hardcoded assistant and pipe output to code_review.md
-          cat review_prompt.txt | cn --auto --org continuedev --config continuedev/review-bot -p > code_review.md
+          cat review_prompt.txt | cn --readonly --org continuedev --config continuedev/review-bot -p > code_review.md
         env:
           CONTINUE_API_KEY: ${{ secrets.CONTINUE_API_KEY }}