review-router/.github/workflows/reviewrouter-conflict-reusable.yml at main · 777genius/review-router · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
name: ReviewRouter Conflict Runtime

on:
  workflow_call:
    inputs:
      runtime_ref:
        required: true
        type: string
      api_url:
        required: true
        type: string
      control_plane_url:
        required: false
        type: string
        default: ''
      runtime_config_mode:
        required: true
        type: string
      static_runtime_env_json:
        required: false
        type: string
        default: '{}'
      pr_number:
        required: true
        type: string
      review_kind:
        required: true
        type: string
      conflict_repository_id:
        required: true
        type: string
      conflict_dispatch_event_type:
        required: true
        type: string
      conflict_dispatch_id:
        required: true
        type: string
      conflict_dispatch_nonce:
        required: true
        type: string
      conflict_head_sha:
        required: true
        type: string
      conflict_base_ref:
        required: true
        type: string
      conflict_base_sha:
        required: true
        type: string
    secrets:
      CODEX_AUTH_JSON:
        required: false
      CODEX_CONFIG_TOML:
        required: false
      OPENAI_API_KEY:
        required: false

permissions: {}

jobs:
  conflict-review:
    name: conflict review
    if: ${{ inputs.review_kind == 'conflict-head' && inputs.runtime_config_mode == 'oidc' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
    env:
      REVIEWROUTER_API_URL: ${{ inputs.control_plane_url || inputs.api_url }}
      REVIEWROUTER_CONTROL_PLANE_URL: ${{ inputs.control_plane_url || inputs.api_url }}
      REVIEWROUTER_ACTION_VERSION: ${{ inputs.runtime_ref }}
      REVIEWROUTER_OIDC_AUDIENCE: reviewrouter
      REVIEW_ROUTER_TARGET_WORKSPACE: ${{ github.workspace }}/reviewrouter-target
      INPUT_STATIC_RUNTIME_ENV_JSON: ${{ inputs.static_runtime_env_json }}
      INPUT_PR_NUMBER: ${{ inputs.pr_number }}
      INPUT_CONFLICT_REPOSITORY_ID: ${{ inputs.conflict_repository_id }}
      INPUT_CONFLICT_DISPATCH_EVENT_TYPE: ${{ inputs.conflict_dispatch_event_type }}
      INPUT_CONFLICT_DISPATCH_ID: ${{ inputs.conflict_dispatch_id }}
      INPUT_CONFLICT_DISPATCH_NONCE: ${{ inputs.conflict_dispatch_nonce }}
      INPUT_CONFLICT_HEAD_SHA: ${{ inputs.conflict_head_sha }}
      INPUT_CONFLICT_BASE_REF: ${{ inputs.conflict_base_ref }}
      INPUT_CONFLICT_BASE_SHA: ${{ inputs.conflict_base_sha }}
      CODEX_AUTH_JSON_PRESENT: ${{ secrets.CODEX_AUTH_JSON != '' && '1' || '0' }}
      OPENAI_API_KEY_PRESENT: ${{ secrets.OPENAI_API_KEY != '' && '1' || '0' }}
    steps:
      - name: Validate conflict runtime ref
        shell: bash
        env:
          REVIEWROUTER_RUNTIME_REF: ${{ inputs.runtime_ref }}
        run: |
          set -euo pipefail
          if [[ ! "$REVIEWROUTER_RUNTIME_REF" =~ ^(v1(\.[0-9]+\.[0-9]+)?|[a-fA-F0-9]{40})$ ]]; then
            echo "::error::runtime_ref must be a v1 release tag or full commit SHA for conflict runtime"
            exit 1
          fi

      - name: Checkout trusted ReviewRouter runtime
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: 777genius/review-router-saas
          ref: ${{ inputs.runtime_ref }}
          path: .reviewrouter-runtime
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'

      - name: Build conflict runtime
        shell: bash
        working-directory: .reviewrouter-runtime
        run: |
          set -euo pipefail
          corepack enable
          pnpm install --frozen-lockfile
          pnpm --filter @reviewrouter/platform-db db:generate
          pnpm --filter @reviewrouter/features-conflict-runtime... build
          node scripts/rewrite-dist-esm-imports.mjs

      - name: Preflight conflict runtime before PR checkout
        shell: bash
        working-directory: .reviewrouter-runtime
        env:
          REVIEW_ROUTER_CONFLICT_SESSION_FILE: ${{ runner.temp }}/reviewrouter-conflict/session.json
        run: |
          set -euo pipefail
          node --conditions=production packages/features/conflict-runtime/dist/interface/cli/reviewrouter-conflict-runtime.js preflight

      - name: Checkout exact conflict head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ inputs.conflict_head_sha }}
          fetch-depth: 0
          path: reviewrouter-target
          persist-credentials: false

      - name: Install Codex CLI
        if: ${{ env.CODEX_AUTH_JSON_PRESENT == '1' || env.OPENAI_API_KEY_PRESENT == '1' }}
        shell: bash
        run: npm install -g @openai/codex@0.147.0

      - name: Run conflict review runtime
        shell: bash
        working-directory: .reviewrouter-runtime
        env:
          REVIEW_ROUTER_CONFLICT_SESSION_FILE: ${{ runner.temp }}/reviewrouter-conflict/session.json
          CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
          CODEX_CONFIG_TOML: ${{ secrets.CODEX_CONFIG_TOML }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          set -euo pipefail
          node --conditions=production packages/features/conflict-runtime/dist/interface/cli/reviewrouter-conflict-runtime.js run