copilot-review.yml

name: Request Copilot Review

on:
  pull_request_target:
    types: [opened, ready_for_review]

jobs:
  request-copilot-review:
    # Skip draft PRs; fork PRs are supported via pull_request_target (secrets available)
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    # Allow the job to pass even when steps fail, so it never blocks PR merge
    continue-on-error: true
    steps:
      - name: Validate COPILOT_USER_PAT secret
        env:
          TOKEN: ${{ secrets.COPILOT_USER_PAT }}
        run: |
          if [ -z "$TOKEN" ]; then
            echo "::error::COPILOT_USER_PAT secret is not set. Add a classic PAT with 'repo' and 'read:org' scopes from a Copilot-licensed user."
            exit 1
          fi
          # Validate that the token can access this repo/PR (not just that it is syntactically valid)
          response=$(curl -s -o /dev/null -w "%{http_code}" \
            -H "Authorization: Bearer $TOKEN" \
            -H "Accept: application/vnd.github+json" \
            "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}")
          if [ "$response" != "200" ]; then
            echo "::error::COPILOT_USER_PAT is invalid or expired (HTTP $response). Please regenerate the PAT and update the secret."
            exit 1
          fi
          echo "Token validated (HTTP $response)"

      - name: Request Copilot review
        env:
          GH_TOKEN: ${{ secrets.COPILOT_USER_PAT }}
        run: |
          set -euo pipefail
          # Wait briefly so any branch ruleset has time to add Copilot first
          sleep 10
          # Check pending review requests (login: "Copilot") — REST API, no read:org needed
          requested=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/requested_reviewers \
            --jq '[.users[].login] | map(ascii_downcase) | contains(["copilot"])')

          # Check already-completed reviews (author login: "copilot-pull-request-reviewer")
          reviewed=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/reviews?per_page=100 \
            --jq '[.[].user.login] | map(ascii_downcase) | contains(["copilot-pull-request-reviewer"])')

          if [ "$requested" = "true" ] || [ "$reviewed" = "true" ]; then
            echo "Copilot is already requested or has already reviewed — skipping to avoid duplicate."
            exit 0
          fi

          gh pr edit ${{ github.event.pull_request.number }} \
            --add-reviewer @copilot \
            --repo ${{ github.repository }}