ff-sec-actions/.github/workflows/manual-ai-code-review.yml at main · filecoin-project/ff-sec-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Manual test harness for the ai-code-review action.
# Run from the Actions tab (workflow_dispatch) against any PR number.
#
# ⚠️ THIS FILE IS FOR THE ff-sec-actions REPO ONLY — do NOT copy it into a
# consumer repo (the `uses: ./actions/...` local path only exists here).
# Consumers wanting a manual run should copy
# examples/consumer-manual-ai-code-review.yml instead.
#
# This checks out THIS repo at the ref you dispatch from and runs the LOCAL
# action (./actions/ai-code-review), so you can test branch changes before
# tagging a release. The reusable workflow resolves the action from an immutable
# repository commit.
#
# Notes:
# - Requires the ANTHROPIC_API_KEY secret on this repo (or via the org).
# - `repo` defaults to this repository. To review a PR in ANOTHER repo, the
#   default github.token won't have access — add a GH_PAT secret (fine-grained
#   PAT with Pull requests read/write on the target repo) and it is used
#   automatically when present.
# - post-comment defaults to "false" for safe testing: results go to the job
#   summary only. Flip to "true" to exercise the sticky-comment path.
name: AI Code Review (manual)

on:
  workflow_dispatch:
    inputs:
      pr-number:
        description: PR number to review
        required: true
      repo:
        description: owner/repo containing the PR (blank = this repo)
        required: false
        default: ""
      domain:
        description: Domain prompt (prompts/<domain>.md)
        required: false
        default: filecoin
      model:
        description: Claude model ID
        required: false
        default: claude-opus-4-8
      effort:
        description: "Effort: low | medium | high | max"
        required: false
        default: high
      fail-on-severity:
        description: "Fail job at/above: none | critical | high | medium | low"
        required: false
        default: none
      post-comment:
        description: Post the sticky PR comment (job summary always written)
        required: false
        type: choice
        options: ["false", "true"]
        default: "false"

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout this repo (the action + prompts under test)
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: AI code review
        id: ai
        uses: ./actions/ai-code-review
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          github-token: ${{ secrets.GH_PAT || github.token }}
          pr-number: ${{ inputs.pr-number }}
          repo: ${{ inputs.repo }}
          domain: ${{ inputs.domain }}
          model: ${{ inputs.model }}
          effort: ${{ inputs.effort }}
          fail-on-severity: ${{ inputs.fail-on-severity }}
          post-comment: ${{ inputs.post-comment }}

      - name: Report outputs
        if: always()
        run: |
          echo "findings-count:    ${{ steps.ai.outputs.findings-count }}"
          echo "highest-severity:  ${{ steps.ai.outputs.highest-severity }}"
          echo "findings-json:     ${{ steps.ai.outputs.findings-json }}"
          echo "completion-status: ${{ steps.ai.outputs.completion-status }}"
          echo "evaluation-result: ${{ steps.ai.outputs.evaluation-result }}"

      - name: Publish machine-readable review evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: evaluation-result-ai-code-review
          path: |
            ${{ steps.ai.outputs.evaluation-result }}
            ${{ steps.ai.outputs.findings-json }}
          if-no-files-found: warn