codex-review-command.yml

# Managed downstream by codemod/codex-review-action.
# Make repository-specific changes in the source template, not in the generated copy.
name: Codex Review Command

on:
  issue_comment:
    types:
      - created

permissions: {}

concurrency:
  group: codex-review-${{ github.event.issue.number }}
  cancel-in-progress: false

jobs:
  resolve-pr:
    name: Resolve pull request
    if: >-
      github.event.issue.pull_request &&
      github.event.comment.body == '/codex-review'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write # Read PR metadata and react to PR conversation comments.
      issues: write # Acknowledge the command comment with a reaction.
    outputs:
      is_draft: ${{ steps.resolve.outputs.is_draft }}
      is_fork: ${{ steps.resolve.outputs.is_fork }}
    steps:
      - name: Authorize command
        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
        with:
          github-token: ${{ github.token }}
          retries: 3
          script: |
            const commandAuthor = context.payload.comment?.user?.login;
            if (!commandAuthor) {
              core.setFailed("Cannot verify the /codex-review comment author");
              return;
            }
            let permission;
            try {
              const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                username: commandAuthor,
              });
              permission = data.permission;
            } catch (error) {
              core.setFailed("Could not verify repository access for /codex-review; refusing to run");
              return;
            }
            if (!["write", "maintain", "admin"].includes(permission)) {
              core.setFailed("/codex-review requires write, maintain, or admin access to this repository");
              return;
            }

      - name: Acknowledge command
        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
        with:
          github-token: ${{ github.token }}
          retries: 3
          script: |
            try {
              await github.rest.reactions.createForIssueComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: context.payload.comment.id,
                content: "eyes",
              });
            } catch (error) {
              core.warning(`Could not acknowledge /codex-review: ${error.message}`);
            }

      - name: Resolve pull request trust level
        id: resolve
        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
        with:
          github-token: ${{ github.token }}
          retries: 3
          script: |
            const { data: pr } = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.payload.issue.number,
            });
            core.setOutput("is_draft", String(Boolean(pr.draft)));
            core.setOutput("is_fork", String(pr.head.repo?.full_name !== pr.base.repo?.full_name));

  same-repository-review:
    name: Review same-repository PR
    needs: resolve-pr
    if: ${{ needs.resolve-pr.outputs.is_draft == 'false' && needs.resolve-pr.outputs.is_fork == 'false' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write # Let the composite action post inline review comments.
      issues: write # Let the composite action upsert its summary comment.
    steps:
      # The sync workflow replaces @main; pin it manually when copying this template elsewhere.
      - uses: codemod/codex-review-action@cab4995d432f77fae403cedd972a77da57f5db49 # zizmor: ignore[unpinned-uses] -- sync-action-pins replaces this template ref with a full SHA.
        with:
          github_token: ${{ github.token }}
          pr_number: ${{ github.event.issue.number }}
          codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }}
          azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
          azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
          node_version: "20"
          # Read pnpm from the reviewed checkout's packageManager field.
          pnpm_version: ""
          install_command: pnpm install --frozen-lockfile
          working_directory: .
          codex_effort: high
          permission_profile: ":workspace"
          review_focus: |
            Focus on:
            - correctness bugs
            - behavioral regressions
            - missing tests or missing edge-case coverage
            - security issues
          extra_prompt: |
            Follow any repository-specific review guidance files when present.

  fork-review:
    name: Review fork PR
    needs: resolve-pr
    if: ${{ needs.resolve-pr.outputs.is_draft == 'false' && needs.resolve-pr.outputs.is_fork == 'true' }}
    permissions:
      contents: read
      pull-requests: write # Let only the called workflow's posting job write reviews.
      issues: write # Let only the called workflow's posting job upsert its summary.
    # The sync workflow replaces @main; pin it manually when copying this template elsewhere.
    uses: codemod/codex-review-action/.github/workflows/fork-review.yml@cab4995d432f77fae403cedd972a77da57f5db49 # zizmor: ignore[unpinned-uses] -- sync-action-pins replaces this template ref with a full SHA.
    with:
      pr_number: ${{ github.event.issue.number }}
      codex_model: ${{ vars.AZURE_OPENAI_CODEX_MODEL }}
      working_directory: .
      codex_effort: high
      review_focus: |
        Focus on:
        - correctness bugs
        - behavioral regressions
        - missing tests or missing edge-case coverage
        - security issues
      extra_prompt: |
        Follow repository-specific review guidance from the trusted base checkout when present.
    secrets:
      azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
      azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}