gemini-pr-review.yml

name: Gemini PR Review

on:
#   issue_comment:
#     types: [created]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR number to review'
        required: true
        type: number

jobs:
  review-pr:
    if: >
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'issue_comment' && 
       github.event.issue.pull_request && 
       contains(github.event.comment.body, '@gemini') &&
       (github.event.comment.author_association == 'OWNER' ||
        github.event.comment.author_association == 'MEMBER' ||
        github.event.comment.author_association == 'COLLABORATOR'))
    timeout-minutes: 15
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      pull-requests: write
      issues: write
    steps:
      - name: Generate GitHub App Token
        id: generate_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}

      - name: Determine checkout ref
        id: checkout_ref
        run: |
          if [ "${{ github.event_name }}" = "issue_comment" ]; then
            echo "ref=refs/pull/${{ github.event.issue.number }}/head" >> "$GITHUB_OUTPUT"
          else
            echo "ref=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout PR code
        uses: actions/checkout@v4
        with:
          persist-credentials: false
        with:
          persist-credentials: false
        with:
          token: ${{ steps.generate_token.outputs.token }}
          ref: ${{ steps.checkout_ref.outputs.ref }}
          fetch-depth: 0

      - name: Get PR details
        id: get_pr
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          # Pass user-controlled inputs via environment variables to prevent script injection (GHSL-2025-093)
          EVENT_NAME: ${{ github.event_name }}
          EVENT_INPUTS_PR_NUMBER: ${{ github.event.inputs.pr_number }}
          EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
          EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
          EVENT_COMMENT_BODY: ${{ github.event.comment.body }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            PR_NUMBER=$EVENT_INPUTS_PR_NUMBER
          elif [ "$EVENT_NAME" = "issue_comment" ]; then
            PR_NUMBER=$EVENT_ISSUE_NUMBER
          else
            PR_NUMBER=$EVENT_PR_NUMBER
          fi
          
          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
          
          # Extract additional instructions from comment (if triggered by comment)
          ADDITIONAL_INSTRUCTIONS=""
          if [ "$EVENT_NAME" = "issue_comment" ]; then
            COMMENT_BODY="$EVENT_COMMENT_BODY"
            ADDITIONAL_INSTRUCTIONS=$(echo "$COMMENT_BODY" | sed 's/.*@gemini//' | xargs)
          fi
          echo "additional_instructions=$ADDITIONAL_INSTRUCTIONS" >> "$GITHUB_OUTPUT"
          
          # Get PR details
          PR_DATA=$(gh pr view $PR_NUMBER --json title,body,additions,deletions,changedFiles,baseRefName,headRefName)
          echo "pr_data=$PR_DATA" >> "$GITHUB_OUTPUT"
          
          # Get file changes
          CHANGED_FILES=$(gh pr diff $PR_NUMBER --name-only)
          echo "changed_files<<EOF" >> "$GITHUB_OUTPUT"
          echo "$CHANGED_FILES" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Run Gemini PR Review
        uses: ./.github/actions/gemini
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          PR_NUMBER: ${{ steps.get_pr.outputs.pr_number }}
          PR_DATA: ${{ steps.get_pr.outputs.pr_data }}
          CHANGED_FILES: ${{ steps.get_pr.outputs.changed_files }}
          ADDITIONAL_INSTRUCTIONS: ${{ steps.get_pr.outputs.additional_instructions }}
          REPOSITORY: ${{ github.repository }}
        with:
          version: 0.1.8-rc.0
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          OTLP_GCP_WIF_PROVIDER: ${{ secrets.OTLP_GCP_WIF_PROVIDER }}
          OTLP_GOOGLE_CLOUD_PROJECT: ${{ secrets.OTLP_GOOGLE_CLOUD_PROJECT }}
          settings_json: |
            {
              "coreTools": [
                "run_shell_command(echo)",
                "run_shell_command(gh pr view)",
                "run_shell_command(gh pr diff)",
                "run_shell_command(gh pr comment)",
                "run_shell_command(gh pr list)",
                "run_shell_command(cat)",
                "run_shell_command(head)",
                "run_shell_command(tail)",
                "run_shell_command(grep)",
                "run_shell_command(find)",
                "run_shell_command(git checkout)",
                "run_shell_command(git add)",
                "run_shell_command(git commit)",
                "run_shell_command(git push)",
                "run_shell_command(git status)",
                "run_shell_command(git branch)",
                "run_shell_command(git fetch)",
                "list_directory",
                "read_file",
                "read_many_files",
                "write_file",
                "replace",
                "glob",
                "search_file_content",
                "web_fetch",
                "google_web_search",
                "save_memory"
              ],
              "telemetry": {
                "enabled": false,
                "target": "gcp"
              },
              "sandbox": false
            }
          prompt: |
            You are an expert code reviewer and AI assistant for Pull Requests. You can review code AND make modifications to improve the PR.

            **PR Details:**
            - PR Number: #$PR_NUMBER
            - Repository: $REPOSITORY
            - Additional Instructions: $ADDITIONAL_INSTRUCTIONS

            **CRITICAL: When making code modifications, follow this EXACT workflow:**

            **STEP 1: Analyze the PR**
            - Use: `echo "$PR_DATA"` to get PR details (JSON format)
            - Use: `echo "$CHANGED_FILES"` to get changed files list
            - Use: `gh pr diff ${PR_NUMBER}` to see the full diff
            - Use: `gh pr view ${PR_NUMBER} --json title,body,headRefName` to get PR info
            - Analyze the code changes thoroughly

            **STEP 2: If Code Improvements Are Needed**
            MANDATORY FIRST STEP: Before writing any code, you MUST use `read_file` to carefully read "src/praisonai-agents/AGENTS.md". You must honor this repository's extremely specific Architecture, Protocol-First design rules, and Agent-Centric Philosophy!
            
            **IMPORTANT:** DO NOT create a new branch! Work on the EXISTING PR branch.
            - Use: `git fetch origin` to get latest changes
            - Get PR branch name: `gh pr view ${PR_NUMBER} --json headRefName`
            - Switch to PR branch: `git checkout BRANCH_NAME` (use actual branch name from PR)
            - Use: `git pull origin BRANCH_NAME` to get latest PR changes

            **STEP 3: Make Code Modifications**
            - Use `read_file` to examine existing code
            - Use `write_file` or `replace` to make improvements
            - Use `search_file_content` to find related code
            - Make focused, targeted improvements to the PR

            **STEP 4: Test Changes (if applicable)**
            - Run relevant tests if test files exist
            - Use `run_shell_command` to execute test commands

            **STEP 5: Commit and Push Changes to EXISTING PR Branch**
            - Use: `git add .` (or specific files)
            - Use: `git commit -m "Gemini: [PR #${PR_NUMBER}] Brief description of improvements"`
            - Use: `git push origin BRANCH_NAME` (push to EXISTING PR branch)

            **STEP 6: Review and Comment on PR**
            Write comprehensive review and post comment with your analysis and any improvements made.
            Use: `gh pr comment ${PR_NUMBER} -b "MESSAGE"`

            Review Guidelines:
            - Focus on code quality, security, performance, and maintainability
            - Check for common issues: potential bugs, security vulnerabilities, performance bottlenecks
            - Verify error handling and edge cases
            - Look for code style and best practices
            - Comment on architecture and design decisions if significant
            - Be constructive and specific in feedback
            - Highlight both issues and positive aspects
            - Suggest improvements with examples when possible
            
            Review Areas:
            - **Security**: Authentication, authorization, input validation, data sanitization
            - **Performance**: Algorithms, database queries, caching, resource usage
            - **Reliability**: Error handling, logging, testing coverage, edge cases
            - **Maintainability**: Code structure, documentation, naming conventions
            - **Functionality**: Logic correctness, requirements fulfillment
            
            Output Format:
            Structure your review using this exact format with markdown:

            ## 📋 Review Summary
            Provide a brief 2-3 sentence overview of the PR and overall assessment.

            ## 🔍 General Feedback
            - List general observations about code quality
            - Mention overall patterns or architectural decisions
            - Highlight positive aspects of the implementation
            - Note any recurring themes across files

            ## 🎯 Specific Feedback
            Only include sections below that have actual issues. If there are no issues in a priority category, omit that entire section.

            ### 🔴 Critical
            (Only include this section if there are critical issues)
            Issues that must be addressed before merging (security vulnerabilities, breaking changes, major bugs):
            - **File: `filename:line`** - Description of critical issue with specific recommendation

            ### 🟡 High
            (Only include this section if there are high priority issues)
            Important issues that should be addressed (performance problems, design flaws, significant bugs):
            - **File: `filename:line`** - Description of high priority issue with suggested fix

            ### 🟢 Medium
            (Only include this section if there are medium priority issues)
            Improvements that would enhance code quality (style issues, minor optimizations, better practices):
            - **File: `filename:line`** - Description of medium priority improvement

            ### 🔵 Low
            (Only include this section if there are suggestions)
            Nice-to-have improvements and suggestions (documentation, naming, minor refactoring):
            - **File: `filename:line`** - Description of suggestion or enhancement

            **Note**: If no specific issues are found in any category, simply state "No specific issues identified in this review."

            ## ✅ Highlights
            (Only include this section if there are positive aspects to highlight)
            - Mention specific good practices or implementations
            - Acknowledge well-written code sections
            - Note improvements from previous versions

            ---
            *Review completed by Gemini CLI*