reviewrouter-reusable.yml

name: ReviewRouter Reusable

on:
  workflow_call:
    inputs:
      runtime_ref:
        description: 'ReviewRouter runtime ref: main, v1, v1.x.x, or a 40-char commit SHA'
        required: false
        type: string
        default: main
      api_url:
        description: 'ReviewRouter API URL used for OIDC runtime config and App comment tokens'
        required: false
        type: string
        default: https://api.reviewrouter.site
      runtime_config_mode:
        description: 'Runtime config mode: oidc or static'
        required: false
        type: string
        default: oidc
      static_runtime_env_json:
        description: 'JSON object with non-secret static fallback env values'
        required: false
        type: string
        default: '{}'
      pr_number:
        description: 'Pull request number for workflow_dispatch callers'
        required: false
        type: string
        default: ''
      review_head_sha:
        description: 'Expected pull request head for durable workflow_dispatch review requests'
        required: false
        type: string
        default: ''
      review_app_client_id:
        description: 'Optional user-owned GitHub App client ID for static-mode bot comments'
        required: false
        type: string
        default: ''
      review_app_repository:
        description: 'Repository name used when minting a static-mode user-owned GitHub App token'
        required: false
        type: string
        default: ''
      review_action_v2_mode:
        description: 'Review Action protocol lane: disabled or t0'
        required: false
        type: string
        default: disabled
      provider_instance_id:
        description: 'Server-registered provider instance used by the T0 lane'
        required: false
        type: string
        default: ''
      workflow_schema_version:
        description: 'Server-registered hosted workflow schema version'
        required: false
        type: number
        default: 1
      review_drafts:
        description: 'Run review for same-repository draft pull requests'
        required: false
        type: boolean
        default: false
      review_timeout_minutes:
        description: 'Maximum execution time for the review job'
        required: false
        type: number
        default: 60
      max_changed_lines:
        description: 'Skip review when additions plus deletions exceed this value; zero disables the limit'
        required: false
        type: string
        default: '0'
    secrets:
      REVIEW_ROUTER_LEDGER_KEY:
        required: false
      REVIEW_THREAD_LIFECYCLE_RESOLVE_TOKEN:
        required: false
      REVIEW_APP_PRIVATE_KEY:
        required: false
      CODEX_AUTH_JSON:
        required: false
      CODEX_CONFIG_TOML:
        required: false
      CLAUDE_CODE_OAUTH_TOKEN:
        required: false
      OPENAI_API_KEY:
        required: false
      OPENROUTER_API_KEY:
        required: false

jobs:
  validate-mode:
    name: validate mode
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Validate Review Action protocol lane
        shell: bash
        env:
          REVIEW_ACTION_V2_MODE: ${{ inputs.review_action_v2_mode }}
          PROVIDER_INSTANCE_ID: ${{ inputs.provider_instance_id }}
          REVIEW_HEAD_SHA: ${{ inputs.review_head_sha }}
          WORKFLOW_SCHEMA_VERSION: ${{ inputs.workflow_schema_version }}
          RUNTIME_CONFIG_MODE: ${{ inputs.runtime_config_mode }}
        run: |
          set -euo pipefail
          case "$REVIEW_ACTION_V2_MODE" in
            disabled|t0) ;;
            *)
              echo "::error::Invalid review_action_v2_mode. Use disabled or t0."
              exit 1
              ;;
          esac
          if [ "$REVIEW_ACTION_V2_MODE" = "t0" ]; then
            if [ -z "$PROVIDER_INSTANCE_ID" ]; then
              echo "::error::provider_instance_id is required for the t0 lane."
              exit 1
            fi
            if ! [[ "$REVIEW_HEAD_SHA" =~ ^[a-fA-F0-9]{40}$ ]]; then
              echo "::error::review_head_sha must be a 40-character commit SHA for the t0 lane."
              exit 1
            fi
            if ! [[ "$WORKFLOW_SCHEMA_VERSION" =~ ^[1-9][0-9]*$ ]]; then
              echo "::error::workflow_schema_version must be a positive integer."
              exit 1
            fi
            if [ "$RUNTIME_CONFIG_MODE" != "oidc" ]; then
              echo "::error::The t0 lane requires runtime_config_mode=oidc."
              exit 1
            fi
          fi

  review-t0:
    name: review
    needs: validate-mode
    permissions:
      contents: read
      pull-requests: read
      id-token: write
    if: ${{ needs.validate-mode.result == 'success' && inputs.review_action_v2_mode == 't0' && (github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' || github.event.pull_request.draft == false || inputs.review_drafts) }}
    uses: ./.github/workflows/reviewrouter-execution-reusable.yml
    with:
      review_action_lane: t0
      runtime_ref: ${{ inputs.runtime_ref }}
      api_url: ${{ inputs.api_url }}
      runtime_config_mode: ${{ inputs.runtime_config_mode }}
      static_runtime_env_json: ${{ inputs.static_runtime_env_json }}
      pr_number: ${{ inputs.pr_number }}
      review_head_sha: ${{ inputs.review_head_sha }}
      review_app_client_id: ''
      review_app_repository: ''
      provider_instance_id: ${{ inputs.provider_instance_id }}
      workflow_schema_version: ${{ inputs.workflow_schema_version }}
      review_timeout_minutes: ${{ inputs.review_timeout_minutes }}
      max_changed_lines: ${{ inputs.max_changed_lines }}
    secrets:
      REVIEW_ROUTER_LEDGER_KEY: ${{ secrets.REVIEW_ROUTER_LEDGER_KEY }}
      CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
      CODEX_CONFIG_TOML: ${{ secrets.CODEX_CONFIG_TOML }}
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}

  review-legacy:
    name: review
    needs: validate-mode
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write
    if: ${{ needs.validate-mode.result == 'success' && inputs.review_action_v2_mode == 'disabled' && (github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' || github.event.pull_request.draft == false || inputs.review_drafts) }}
    uses: ./.github/workflows/reviewrouter-execution-reusable.yml
    with:
      review_action_lane: legacy
      runtime_ref: ${{ inputs.runtime_ref }}
      api_url: ${{ inputs.api_url }}
      runtime_config_mode: ${{ inputs.runtime_config_mode }}
      static_runtime_env_json: ${{ inputs.static_runtime_env_json }}
      pr_number: ${{ inputs.pr_number }}
      review_head_sha: ''
      review_app_client_id: ${{ inputs.review_app_client_id }}
      review_app_repository: ${{ inputs.review_app_repository }}
      provider_instance_id: ''
      workflow_schema_version: ${{ inputs.workflow_schema_version }}
      review_timeout_minutes: ${{ inputs.review_timeout_minutes }}
      max_changed_lines: ${{ inputs.max_changed_lines }}
    secrets:
      REVIEW_ROUTER_LEDGER_KEY: ${{ secrets.REVIEW_ROUTER_LEDGER_KEY }}
      REVIEW_THREAD_LIFECYCLE_RESOLVE_TOKEN: ${{ secrets.REVIEW_THREAD_LIFECYCLE_RESOLVE_TOKEN }}
      REVIEW_APP_PRIVATE_KEY: ${{ secrets.REVIEW_APP_PRIVATE_KEY }}
      CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
      CODEX_CONFIG_TOML: ${{ secrets.CODEX_CONFIG_TOML }}
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}