review-pr.yml

# Reusable workflow for AI-powered PR reviews
#
# Usage:
#   name: PR Review
#   on:
#     issue_comment: # Enables /review command in PR comments
#       types: [created]
#     pull_request_review_comment: # Captures feedback on review comments for learning
#       types: [created]
#     pull_request_target: # Triggers auto-review on PR open; uses base branch context so secrets work with forks
#       types: [ready_for_review, opened]
#
#   jobs:
#     review:
#       uses: docker/cagent-action/.github/workflows/review-pr.yml@latest
#       # Scoped to the job so other jobs in this workflow aren't over-permissioned
#       permissions:
#         contents: read       # Read repository files and PR diffs
#         pull-requests: write # Post review comments and approve/request changes
#         issues: write        # Create security incident issues if secrets are detected in output
#         checks: write        # (Optional) Show review progress as a check run on the PR
#       secrets:
#         ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
#         CAGENT_ORG_MEMBERSHIP_TOKEN: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }} # PAT with read:org scope; gates auto-reviews to org members only
#         CAGENT_REVIEWER_APP_ID: ${{ secrets.CAGENT_REVIEWER_APP_ID }} # GitHub App ID; reviews appear as your app instead of github-actions[bot]
#         CAGENT_REVIEWER_APP_PRIVATE_KEY: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }} # GitHub App private key; paired with App ID above

name: PR Review

on:
  workflow_call:
    inputs:
      pr-number:
        description: "Pull request number (auto-detected if not provided)"
        required: false
        type: string
        default: ""
      comment-id:
        description: "Comment ID for reactions (auto-detected if not provided)"
        required: false
        type: string
        default: ""
      additional-prompt:
        description: "Additional instructions for the review"
        required: false
        type: string
        default: ""
      model:
        description: "Model to use (e.g., anthropic/claude-sonnet-4-5)"
        required: false
        type: string
        default: ""
      add-prompt-files:
        description: "Comma-separated list of files to append to the prompt (e.g., 'AGENTS.md,CLAUDE.md')"
        required: false
        type: string
        default: ""
      auto-review-org:
        description: "Organization to check membership for auto-reviews"
        required: false
        type: string
        default: "docker"
    secrets:
      CAGENT_ORG_MEMBERSHIP_TOKEN:
        description: "PAT with read:org scope to check org membership for auto-reviews"
        required: false
      ANTHROPIC_API_KEY:
        description: "Anthropic API key (at least one API key required)"
        required: false
      OPENAI_API_KEY:
        description: "OpenAI API key (at least one API key required)"
        required: false
      GOOGLE_API_KEY:
        description: "Google API key (at least one API key required)"
        required: false
      AWS_BEARER_TOKEN_BEDROCK:
        description: "AWS Bearer token for Bedrock (at least one API key required)"
        required: false
      XAI_API_KEY:
        description: "xAI API key for Grok (at least one API key required)"
        required: false
      NEBIUS_API_KEY:
        description: "Nebius API key (at least one API key required)"
        required: false
      MISTRAL_API_KEY:
        description: "Mistral API key (at least one API key required)"
        required: false
      CAGENT_REVIEWER_APP_ID:
        description: "GitHub App ID for reviewer identity"
        required: false
      CAGENT_REVIEWER_APP_PRIVATE_KEY:
        description: "GitHub App private key"
        required: false
    outputs:
      exit-code:
        description: "Exit code from the review"
        value: ${{ jobs.auto-review.outputs.exit-code || jobs.manual-review.outputs.exit-code }}

permissions:
  contents: read
  pull-requests: write
  issues: write
  # checks: write is intentionally omitted — callers can grant it optionally
  # for the "PR Review" check run on the PR. The check creation steps use
  # continue-on-error so the review works fine without it.

jobs:
  # ==========================================================================
  # AUTOMATIC REVIEW FOR ORG MEMBERS
  # Triggers when a PR is marked ready for review or opened (non-draft)
  # Only runs for members of the configured org (supports fork-based workflow)
  # ==========================================================================
  auto-review:
    if: |
      github.event_name == 'pull_request_target' &&
      !github.event.pull_request.draft
    runs-on: ubuntu-latest
    env:
      HAS_APP_SECRETS: ${{ secrets.CAGENT_REVIEWER_APP_ID != '' }}
    outputs:
      exit-code: ${{ steps.run-review.outputs.exit-code }}

    steps:
      - name: Check if PR author is org member
        id: membership
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }}
          script: |
            const org = '${{ inputs.auto-review-org }}';
            const username = context.payload.pull_request.user.login;

            try {
              await github.rest.orgs.checkMembershipForUser({
                org: org,
                username: username
              });
              core.setOutput('is_member', 'true');
              console.log(`✅ ${username} is a ${org} org member - proceeding with auto-review`);
            } catch (error) {
              if (error.status === 404 || error.status === 302) {
                core.setOutput('is_member', 'false');
                console.log(`⏭️ ${username} is not a ${org} org member - skipping auto-review`);
              } else if (error.status === 401) {
                core.setFailed(
                  '❌ CAGENT_ORG_MEMBERSHIP_TOKEN secret is missing or invalid.\n\n' +
                  `This secret is required to check ${org} org membership for auto-reviews.\n\n` +
                  'To fix this:\n' +
                  '1. Create a classic PAT with read:org scope at https://github.com/settings/tokens/new\n' +
                  '2. Add it as an org secret named CAGENT_ORG_MEMBERSHIP_TOKEN'
                );
              } else {
                core.setFailed(`Failed to check org membership: ${error.message}`);
              }
            }

      # Safe to checkout PR head because review-pr only READS files (no code execution)
      - name: Checkout PR head
        if: steps.membership.outputs.is_member == 'true'
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          ref: refs/pull/${{ github.event.pull_request.number }}/head

      # Generate GitHub App token for custom app identity (optional - falls back to github.token)
      - name: Generate GitHub App token
        if: steps.membership.outputs.is_member == 'true' && env.HAS_APP_SECRETS == 'true'
        id: app-token
        continue-on-error: true # Don't fail workflow if token generation fails
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
          private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}

      - name: Run PR Review
        if: steps.membership.outputs.is_member == 'true'
        id: run-review
        continue-on-error: true # Don't fail the calling workflow if the review errors
        uses: docker/cagent-action/review-pr@latest
        with:
          pr-number: ${{ inputs.pr-number || github.event.pull_request.number }}
          additional-prompt: ${{ inputs.additional-prompt }}
          add-prompt-files: ${{ inputs.add-prompt-files }}
          model: ${{ inputs.model }}
          github-token: ${{ steps.app-token.outputs.token || github.token }}
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          google-api-key: ${{ secrets.GOOGLE_API_KEY }}
          aws-bearer-token-bedrock: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
          xai-api-key: ${{ secrets.XAI_API_KEY }}
          nebius-api-key: ${{ secrets.NEBIUS_API_KEY }}
          mistral-api-key: ${{ secrets.MISTRAL_API_KEY }}

  # ==========================================================================
  # MANUAL REVIEW PIPELINE
  # Triggers when someone comments /review on a PR
  # ==========================================================================
  manual-review:
    if: |
      github.event.issue.pull_request &&
      startsWith(github.event.comment.body, '/review') &&
      (github.event.comment.user.type != 'Bot' || github.event.comment.user.login == 'docker-agent[bot]')
    runs-on: ubuntu-latest
    env:
      HAS_APP_SECRETS: ${{ secrets.CAGENT_REVIEWER_APP_ID != '' }}
    outputs:
      exit-code: ${{ steps.run-review.outputs.exit-code }}

    steps:
      - name: Create check run
        id: create-check
        continue-on-error: true # Don't fail if caller didn't grant checks: write
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        env:
          PR_NUMBER: ${{ inputs.pr-number || github.event.issue.number }}
        with:
          script: |
            const prNumber = parseInt(process.env.PR_NUMBER, 10);
            const { data: pr } = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: prNumber
            });
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            const { data: check } = await github.rest.checks.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'PR Review',
              head_sha: pr.head.sha,
              status: 'in_progress',
              started_at: new Date().toISOString(),
              details_url: runUrl
            });
            core.setOutput('check-id', check.id);

      # Checkout PR head (not default branch)
      # Note: Authorization is handled by the composite action's built-in check
      - name: Checkout PR head
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          ref: refs/pull/${{ github.event.issue.number }}/head

      # Generate GitHub App token for custom app identity (optional - falls back to github.token)
      - name: Generate GitHub App token
        if: env.HAS_APP_SECRETS == 'true'
        id: app-token
        continue-on-error: true # Don't fail workflow if token generation fails
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
          private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}

      - name: Run PR Review
        id: run-review
        continue-on-error: true # Don't fail the calling workflow if the review errors
        uses: docker/cagent-action/review-pr@latest
        with:
          pr-number: ${{ inputs.pr-number || github.event.issue.number }}
          comment-id: ${{ inputs.comment-id || github.event.comment.id }}
          additional-prompt: ${{ inputs.additional-prompt }}
          add-prompt-files: ${{ inputs.add-prompt-files }}
          model: ${{ inputs.model }}
          github-token: ${{ steps.app-token.outputs.token || github.token }}
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          google-api-key: ${{ secrets.GOOGLE_API_KEY }}
          aws-bearer-token-bedrock: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
          xai-api-key: ${{ secrets.XAI_API_KEY }}
          nebius-api-key: ${{ secrets.NEBIUS_API_KEY }}
          mistral-api-key: ${{ secrets.MISTRAL_API_KEY }}

      - name: Update check run
        if: always() && steps.create-check.outputs.check-id != ''
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        env:
          CHECK_ID: ${{ steps.create-check.outputs.check-id }}
          JOB_STATUS: ${{ job.status }}
        with:
          script: |
            const conclusion = process.env.JOB_STATUS === 'cancelled' ? 'cancelled' : process.env.JOB_STATUS === 'success' ? 'success' : 'failure';
            try {
              await github.rest.checks.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                check_run_id: parseInt(process.env.CHECK_ID, 10),
                status: 'completed',
                conclusion: conclusion,
                completed_at: new Date().toISOString()
              });
            } catch (error) {
              core.warning(`Failed to update check run: ${error.message}`);
            }

  # ==========================================================================
  # CAPTURE FEEDBACK
  # Saves feedback data as an artifact for lazy processing. This job
  # intentionally avoids using secrets so it works for fork PRs in public
  # repos. The actual AI processing happens during the next review run,
  # which has full secret access via pull_request_target or issue_comment.
  # ==========================================================================
  capture-feedback:
    if: github.event_name == 'pull_request_review_comment' && github.event.comment.in_reply_to_id
    runs-on: ubuntu-latest

    steps:
      - name: Check if reply is to agent comment
        id: check
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          PARENT_ID: ${{ github.event.comment.in_reply_to_id }}
        run: |
          if [ -z "$PARENT_ID" ]; then
            echo "is_agent=false" >> $GITHUB_OUTPUT
            echo "⏭️ Not a reply comment, skipping"
            exit 0
          fi

          parent=$(gh api repos/${{ github.repository }}/pulls/comments/$PARENT_ID 2>/dev/null || echo "{}")
          if echo "$parent" | jq -r '.body // ""' | grep -q "<!-- cagent-review -->"; then
            echo "is_agent=true" >> $GITHUB_OUTPUT
            echo "✅ Reply is to an agent review comment"
          else
            echo "is_agent=false" >> $GITHUB_OUTPUT
            echo "⏭️ Not a reply to agent comment, skipping"
          fi

      - name: Save feedback data
        if: steps.check.outputs.is_agent == 'true'
        shell: bash
        env:
          COMMENT_JSON: ${{ toJSON(github.event.comment) }}
        run: |
          mkdir -p feedback
          echo "$COMMENT_JSON" > feedback/feedback.json
          echo "📦 Saved feedback data for async processing"

      - name: Upload feedback artifact
        if: steps.check.outputs.is_agent == 'true'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: pr-review-feedback
          path: feedback/
          retention-days: 90

  # ==========================================================================
  # REPLY TO FEEDBACK
  # Responds directly in the PR review thread when a user replies to an agent
  # comment. Runs in parallel with capture-feedback — this job handles the
  # synchronous conversational reply, while capture-feedback saves the artifact
  # for async learning on the next review run (resilient fallback).
  # ==========================================================================
  reply-to-feedback:
    if: |
      github.event_name == 'pull_request_review_comment' &&
      github.event.comment.in_reply_to_id &&
      github.event.comment.user.type != 'Bot'
    runs-on: ubuntu-latest
    env:
      HAS_APP_SECRETS: ${{ secrets.CAGENT_REVIEWER_APP_ID != '' }}

    steps:
      - name: Check if reply is to agent comment
        id: check
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          PARENT_ID: ${{ github.event.comment.in_reply_to_id }}
          REPO: ${{ github.repository }}
        run: |
          if [ -z "$PARENT_ID" ]; then
            echo "is_agent=false" >> $GITHUB_OUTPUT
            echo "⏭️ Not a reply comment, skipping"
            exit 0
          fi

          parent=$(gh api "repos/$REPO/pulls/comments/$PARENT_ID") || {
            echo "::warning::Failed to fetch parent comment $PARENT_ID" >&2
            echo "is_agent=false" >> $GITHUB_OUTPUT
            exit 0
          }
          # Validate required fields exist before extracting
          if ! echo "$parent" | jq -e '.user.type and .body' > /dev/null 2>&1; then
            echo "::warning::Parent comment has unexpected structure" >&2
            echo "is_agent=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          body=$(echo "$parent" | jq -r '.body')
          parent_user_type=$(echo "$parent" | jq -r '.user.type')

          # Defense-in-depth: verify the root comment was posted by a Bot (agent) AND
          # contains the review marker but NOT the reply marker (substring overlap).
          # The user.type check prevents matching human comments that happen to contain
          # the marker text (e.g., in discussions about the review system).
          if [ "$parent_user_type" = "Bot" ] && \
             echo "$body" | grep -q "<!-- cagent-review -->" && \
             ! echo "$body" | grep -q "<!-- cagent-review-reply -->"; then
            echo "is_agent=true" >> $GITHUB_OUTPUT
            echo "root_comment_id=$PARENT_ID" >> $GITHUB_OUTPUT

            # Extract file path and line from the root comment for context
            echo "file_path=$(echo "$parent" | jq -r '.path // ""')" >> $GITHUB_OUTPUT
            echo "line=$(echo "$parent" | jq -r '.line // .original_line // ""')" >> $GITHUB_OUTPUT
            echo "✅ Reply is to an agent review comment"
          else
            echo "is_agent=false" >> $GITHUB_OUTPUT
            echo "⏭️ Not a reply to agent comment, skipping"
          fi

      - name: Check authorization
        if: steps.check.outputs.is_agent == 'true'
        id: auth
        shell: bash
        run: |
          AUTHOR_ASSOCIATION=$(jq -r '.comment.author_association // empty' "$GITHUB_EVENT_PATH")
          if [ -z "$AUTHOR_ASSOCIATION" ]; then
            echo "::warning::Could not read author_association from event payload"
            echo "authorized=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          case "$AUTHOR_ASSOCIATION" in
            OWNER|MEMBER|COLLABORATOR)
              echo "authorized=true" >> $GITHUB_OUTPUT
              echo "✅ Author is $AUTHOR_ASSOCIATION — authorized to trigger reply"
              ;;
            *)
              echo "authorized=false" >> $GITHUB_OUTPUT
              echo "⏭️ Author is $AUTHOR_ASSOCIATION — not authorized for reply"
              ;;
          esac

      - name: Notify unauthorized user
        if: steps.check.outputs.is_agent == 'true' && steps.auth.outputs.authorized == 'false'
        continue-on-error: true
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          ROOT_COMMENT_ID: ${{ steps.check.outputs.root_comment_id }}
          AUTHOR: ${{ github.event.comment.user.login }}
        run: |
          jq -n \
            --arg body "Sorry @$AUTHOR, conversational replies are currently available to repository collaborators only. Your feedback has still been captured and will be used to improve future reviews.

          <!-- cagent-review-reply -->" \
            --argjson reply_to "$ROOT_COMMENT_ID" \
            '{body: $body, in_reply_to_id: $reply_to}' | \
          gh api "repos/$REPO/pulls/$PR_NUMBER/comments" --input -

      - name: Build thread context
        if: steps.check.outputs.is_agent == 'true' && steps.auth.outputs.authorized == 'true'
        id: thread
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          ROOT_ID: ${{ steps.check.outputs.root_comment_id }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
          FILE_PATH: ${{ steps.check.outputs.file_path }}
          LINE: ${{ steps.check.outputs.line }}
          # The triggering comment from the webhook payload — guaranteed fresh,
          # unlike the API which may have eventual consistency lag.
          TRIGGER_COMMENT_BODY: ${{ github.event.comment.body }}
          TRIGGER_COMMENT_AUTHOR: ${{ github.event.comment.user.login }}
          TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
        run: |
          # Fetch the root comment (fail early if the API call errors)
          root=$(gh api "repos/$REPO/pulls/comments/$ROOT_ID") || {
            echo "::error::Failed to fetch root comment $ROOT_ID" >&2
            exit 1
          }
          root_body=$(echo "$root" | jq -r '.body // ""')

          # Fetch all review comments on this PR and filter to this thread.
          # Uses --paginate to handle PRs with >100 review comments.
          # Each page is processed by jq independently, then merged with jq -s.
          # Note: the triggering comment may not appear here due to eventual
          # consistency, so we append it from the webhook payload below.
          all_comments=$(gh api --paginate "repos/$REPO/pulls/$PR_NUMBER/comments" | \
            jq -s --arg root_id "$ROOT_ID" \
            '[.[][] | select((.in_reply_to_id | tostring) == $root_id)] | sort_by(.created_at)') || {
            echo "::error::Failed to fetch thread comments for PR $PR_NUMBER" >&2
            exit 1
          }

          # Build the thread context and save as step output.
          # Use a randomized delimiter to prevent comment body content from
          # colliding with the GITHUB_OUTPUT heredoc terminator.
          DELIM="THREAD_CONTEXT_$(openssl rand -hex 8)"

          {
            echo "prompt<<$DELIM"
            echo "A developer replied to your review comment. Read the thread context below and respond"
            echo "in the same thread."
            echo ""
            echo "---"
            echo "REPO=$REPO"
            echo "PR_NUMBER=$PR_NUMBER"
            echo "ROOT_COMMENT_ID=$ROOT_ID"
            echo "FILE_PATH=$FILE_PATH"
            echo "LINE=$LINE"
            echo ""
            echo "[ORIGINAL REVIEW COMMENT]"
            echo "$root_body"
            echo ""

            # Add earlier replies from the API (excludes the triggering comment
            # to avoid duplication if the API already has it)
            reply_count=$(echo "$all_comments" | jq 'length')
            if [ "$reply_count" -gt 0 ]; then
              for i in $(seq 0 $((reply_count - 1))); do
                comment_id=$(echo "$all_comments" | jq -r ".[$i].id") || continue
                # Skip the triggering comment — we append it from the payload below
                if [ "$comment_id" = "$TRIGGER_COMMENT_ID" ]; then
                  continue
                fi
                user_type=$(echo "$all_comments" | jq -r ".[$i].user.type") || continue
                author=$(echo "$all_comments" | jq -r ".[$i].user.login") || continue
                body=$(echo "$all_comments" | jq -r ".[$i].body") || continue
                if [ "$user_type" = "Bot" ]; then
                  echo "[YOUR PREVIOUS REPLY by @$author]"
                else
                  echo "[REPLY by @$author]"
                fi
                echo "$body"
                echo ""
              done
            fi

            # Always append the triggering comment last — sourced directly from
            # the webhook payload so it's guaranteed to be present.
            echo "[REPLY by @$TRIGGER_COMMENT_AUTHOR] ← this is the reply you are responding to"
            echo "$TRIGGER_COMMENT_BODY"
            echo ""
            echo "$DELIM"
          } >> $GITHUB_OUTPUT

          echo "✅ Built thread context with replies (triggering comment from webhook payload)"

      # Safe to checkout PR head because the reply agent only READS files (no code execution)
      - name: Checkout PR head
        if: steps.check.outputs.is_agent == 'true' && steps.auth.outputs.authorized == 'true'
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          ref: refs/pull/${{ github.event.pull_request.number }}/head

      # Generate GitHub App token for custom app identity (optional - falls back to github.token)
      - name: Generate GitHub App token
        if: steps.check.outputs.is_agent == 'true' && steps.auth.outputs.authorized == 'true' && env.HAS_APP_SECRETS == 'true'
        id: app-token
        continue-on-error: true
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
          private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}

      - name: Run reply
        if: steps.check.outputs.is_agent == 'true' && steps.auth.outputs.authorized == 'true'
        continue-on-error: true
        uses: docker/cagent-action/review-pr/reply@latest
        with:
          thread-context: ${{ steps.thread.outputs.prompt }}
          comment-id: ${{ github.event.comment.id }}
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          google-api-key: ${{ secrets.GOOGLE_API_KEY }}
          aws-bearer-token-bedrock: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
          xai-api-key: ${{ secrets.XAI_API_KEY }}
          nebius-api-key: ${{ secrets.NEBIUS_API_KEY }}
          mistral-api-key: ${{ secrets.MISTRAL_API_KEY }}
          github-token: ${{ steps.app-token.outputs.token || github.token }}

      - name: React on thread-build failure
        if: >-
          always() &&
          steps.check.outputs.is_agent == 'true' &&
          steps.auth.outputs.authorized == 'true' &&
          steps.thread.outcome == 'failure'
        continue-on-error: true
        shell: bash
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
          REPO: ${{ github.repository }}
          COMMENT_ID: ${{ github.event.comment.id }}
        run: |
          gh api "repos/$REPO/pulls/comments/$COMMENT_ID/reactions" \
            -f content="confused" --silent || true
          echo "😕 Thread context build failed — added confused reaction"