ff-sec-actions/examples/consumer-manual-ai-code-review.yml at main · filecoin-project/ff-sec-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# Manual (on-demand) AI review for a CONSUMER repo.
# Drop this into the consumer repo as .github/workflows/ai-review-manual.yml,
# then: Actions tab -> "AI Code Review (manual)" -> Run workflow -> enter a PR number.
# Or from the CLI:  gh workflow run "AI Code Review (manual)" -f pr-number=123
#
# Requirements in the consumer repo:
# - ANTHROPIC_API_KEY secret visible to this repo (org secret recommended)
# - If ff-sec-actions is private: it must allow org repo access
#   (ff-sec-actions Settings -> Actions -> General -> Access)
# - This file must be on the default branch before it appears in the Actions tab
#
# Pilot ref: immutable reviewed commit. Replace only after reviewing a newer
# release; no v1 release exists yet.
name: AI Code Review (manual)

on:
  workflow_dispatch:
    inputs:
      pr-number:
        description: PR number in THIS repo to review
        required: true
      domain:
        description: Domain prompt (prompts/<domain>.md in ff-sec-actions)
        required: false
        default: filecoin
      post-comment:
        description: Post the sticky PR comment (job summary always written)
        required: false
        type: choice
        options: ["true", "false"]
        default: "true"

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      # No checkout needed: the action fetches the PR diff via the GitHub API.
      - uses: filecoin-project/ff-sec-actions/actions/ai-code-review@6c57a546abf8cce8e32599009941bf6019e9a354
        id: ai
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          pr-number: ${{ inputs.pr-number }}
          domain: ${{ inputs.domain }}
          post-comment: ${{ inputs.post-comment }}

      - if: always()
        run: |
          echo "findings-count:   ${{ steps.ai.outputs.findings-count }}"
          echo "highest-severity: ${{ steps.ai.outputs.highest-severity }}"

      - name: Publish machine-readable review evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: evaluation-result-ai-code-review
          path: |
            ${{ steps.ai.outputs.evaluation-result }}
            ${{ steps.ai.outputs.findings-json }}
          if-no-files-found: warn