pull-request-review.yml

name: CodeRabbit Review Enforcement (Reusable)

on:
  workflow_call:
  
  # Direct trigger for this repository
  pull_request_review:
    types: [submitted]
jobs:
  check-coderabbit-approval:
    name: Check CodeRabbit Approval
    runs-on: ubuntu-latest

    permissions:
      pull-requests: read

    steps:
      - name: Wait for review status propagation
        run: sleep 30s
        shell: bash

      - name: Check CodeRabbit approval
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { owner, repo } = context.repo;
            const pull_number = context.payload.pull_request.number;

            // Fetch all PR reviews
            const { data: reviews } = await github.rest.pulls.listReviews({
              owner,
              repo,
              pull_number
            });

            // Identify CodeRabbit reviews (case-insensitive) and ignore COMMENTED
            const codeRabbitReviews = reviews.filter(review =>
              review.user?.login &&
              (
                review.user.login.toLowerCase().includes('coderabbit') ||
                review.user.login.toLowerCase().includes('coderabbitai')
              ) &&
              review.state !== 'COMMENTED'
            );

            if (codeRabbitReviews.length === 0) {
              core.setFailed('ERROR: CodeRabbit has not reviewed this PR.');
              return;
            }

            // Sort newest → oldest
            codeRabbitReviews.sort(
              (a, b) => new Date(b.submitted_at) - new Date(a.submitted_at)
            );

            const latestReview = codeRabbitReviews[0];

            if (latestReview.state !== 'APPROVED') {
              core.setFailed(
                'ERROR: CodeRabbit approval is required before merging this PR.'
              );
            } else {
              console.log('Success: CodeRabbit has approved this PR.');
            }