adjusted workflows an and naming

Author: relotnek

.github/workflows/ai-code-review.yml

@@ -1,5 +1,5 @@
 # Reusable workflow: AI code review.
-# Consumers call this via `uses: your-org/ff-sec-action/.github/workflows/ai-code-review.yml@v1`.
+# Consumers call this via `uses: filecoin-project/ff-sec-actions/.github/workflows/ai-code-review.yml@v1`.
 # NOTE: the `uses:` ref on the action step below must be kept in sync with release tags
 # (reusable workflows cannot reference sibling actions by relative path without a checkout).
 name: AI Code Review (reusable)
@@ -62,7 +62,7 @@ jobs:
       # never executes PR code.
       - name: AI code review
         id: ai-review
-        uses: your-org/ff-sec-action/actions/ai-code-review@v1
+        uses: filecoin-project/ff-sec-actions/actions/ai-code-review@v1
         with:
           anthropic-api-key: ${{ secrets.anthropic-api-key }}
           model: ${{ inputs.model }}

.github/workflows/manual-ai-code-review.yml

@@ -0,0 +1,80 @@
+# Manual test harness for the ai-code-review action.
+# Run from the Actions tab (workflow_dispatch) against any PR number.
+#
+# This checks out THIS repo at the ref you dispatch from and runs the LOCAL
+# action (./actions/ai-code-review), so you can test branch changes before
+# tagging a release — unlike the reusable workflow, which uses the pinned @v1.
+#
+# Notes:
+# - Requires the ANTHROPIC_API_KEY secret on this repo (or via the org).
+# - `repo` defaults to this repository. To review a PR in ANOTHER repo, the
+#   default github.token won't have access — add a GH_PAT secret (fine-grained
+#   PAT with Pull requests read/write on the target repo) and it is used
+#   automatically when present.
+# - post-comment defaults to "false" for safe testing: results go to the job
+#   summary only. Flip to "true" to exercise the sticky-comment path.
+name: AI Code Review (manual)
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr-number:
+        description: PR number to review
+        required: true
+      repo:
+        description: owner/repo containing the PR (blank = this repo)
+        required: false
+        default: ""
+      domain:
+        description: Domain prompt (prompts/<domain>.md)
+        required: false
+        default: filecoin
+      model:
+        description: Claude model ID
+        required: false
+        default: claude-opus-4-8
+      effort:
+        description: "Effort: low | medium | high | max"
+        required: false
+        default: high
+      fail-on-severity:
+        description: "Fail job at/above: none | critical | high | medium | low"
+        required: false
+        default: none
+      post-comment:
+        description: Post the sticky PR comment (job summary always written)
+        required: false
+        type: choice
+        options: ["false", "true"]
+        default: "false"
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout this repo (the action + prompts under test)
+        uses: actions/checkout@v4
+
+      - name: AI code review
+        id: ai
+        uses: ./actions/ai-code-review
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github-token: ${{ secrets.GH_PAT || github.token }}
+          pr-number: ${{ inputs.pr-number }}
+          repo: ${{ inputs.repo }}
+          domain: ${{ inputs.domain }}
+          model: ${{ inputs.model }}
+          effort: ${{ inputs.effort }}
+          fail-on-severity: ${{ inputs.fail-on-severity }}
+          post-comment: ${{ inputs.post-comment }}
+
+      - name: Report outputs
+        if: always()
+        run: |
+          echo "findings-count:    ${{ steps.ai.outputs.findings-count }}"
+          echo "highest-severity:  ${{ steps.ai.outputs.highest-severity }}"
+          echo "findings-json:     ${{ steps.ai.outputs.findings-json }}"

README.md

@@ -9,7 +9,7 @@ Consumer repositories reference this repo for **composite actions**, **reusable
 workflows**, and **standalone scripts**, so review logic, prompts, and policy
 live in one place and roll out to every repo by bumping a tag.
 
-Replace `your-org` throughout with the GitHub organization this repo lives in.
+Replace `filecoin-project` throughout with the GitHub organization this repo lives in.
 
 ## Repository layout
 
@@ -22,7 +22,8 @@ ff-sec-action/
 │           ├── review.sh
 │           └── schema.json
 ├── .github/workflows/            # Reusable workflows (whole job, workflow_call)
-│   └── ai-code-review.yml
+│   ├── ai-code-review.yml
+│   └── manual-ai-code-review.yml # workflow_dispatch test harness (runs the local action)
 ├── scripts/                      # Standalone scripts runnable outside any action
 ├── prompts/                      # Domain knowledge as data, not code
 │   ├── base-reviewer.md          # Always included: review behavior + output rules
@@ -58,7 +59,7 @@ concurrency:
 jobs:
   review:
     if: ${{ !github.event.pull_request.draft }}
-    uses: your-org/ff-sec-action/.github/workflows/ai-code-review.yml@v1
+    uses: filecoin-project/ff-sec-actions/.github/workflows/ai-code-review.yml@v1
     with:
       domain: filecoin            # picks prompts/filecoin.md
       fail-on-severity: none      # or: critical | high | medium
@@ -86,7 +87,7 @@ jobs:
       contents: read
       pull-requests: write        # needed to post the review comment
     steps:
-      - uses: your-org/ff-sec-action/actions/ai-code-review@v1
+      - uses: filecoin-project/ff-sec-actions/actions/ai-code-review@v1
         id: ai
         with:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -112,7 +113,7 @@ Two patterns:
 steps:
   - uses: actions/checkout@v4
     with:
-      repository: your-org/ff-sec-action
+      repository: filecoin-project/ff-sec-actions
       ref: v1                      # or a full SHA for the strictest pinning
       path: .ff-sec
   - run: bash .ff-sec/scripts/<script>.sh
@@ -123,7 +124,7 @@ steps:
 **b. Locally, from a clone:**
 
 ```sh
-git clone --depth 1 --branch v1 https://github.com/your-org/ff-sec-action
+git clone --depth 1 --branch v1 https://github.com/filecoin-project/ff-sec-actions
 bash ff-sec-action/scripts/<script>.sh
 ```
 
@@ -132,7 +133,7 @@ and fails fast with a clear message when one is missing. Example — running the
 AI review against any PR from your terminal:
 
 ```sh
-PR_NUMBER=123 REPO=your-org/some-repo \
+PR_NUMBER=123 REPO=filecoin-project/some-repo \
 ANTHROPIC_API_KEY=... GH_TOKEN=$(gh auth token) \
 PROMPT_FILE=prompts/filecoin.md BASE_PROMPT_FILE=prompts/base-reviewer.md \
 SCHEMA_FILE=actions/ai-code-review/scripts/schema.json \
@@ -165,6 +166,8 @@ executes PR code**.
 |---|---|---|
 | `anthropic-api-key` | — (required) | Pass from secrets |
 | `github-token` | `${{ github.token }}` | Needs `pull-requests: write` to comment |
+| `pr-number` | current PR event | Set explicitly for `workflow_dispatch` runs |
+| `repo` | current repository | Cross-repo runs need a `github-token` with access to that repo |
 | `model` | `claude-opus-4-8` | Any current Claude model ID |
 | `domain` | `filecoin` | Resolves `prompts/<domain>.md` |
 | `prompt-file` | `""` | Absolute path override; beats `domain` |
@@ -253,7 +256,7 @@ Guidelines:
   this repo: it owns `runs-on`, `permissions` (least privilege), and secret
   plumbing — the action owns the logic. That keeps both surfaces in sync.
 - Reference the sibling action by **full path with a tag**
-  (`uses: your-org/ff-sec-action/actions/<name>@v1`), not a relative path —
+  (`uses: filecoin-project/ff-sec-actions/actions/<name>@v1`), not a relative path —
   relative references don't resolve without a checkout. Keep the tag in sync
   when releasing (grep for `@v1` before tagging).
 - Mirror the composite action's inputs 1:1 with the same names and defaults so
@@ -309,8 +312,15 @@ Guidelines:
 - **Local dry-run:** every script must be runnable locally with env vars (see
   [Standalone scripts](#3-standalone-scripts)) — use a real PR in a sandbox
   repo and `POST_COMMENT=false`-style flags.
-- **End-to-end:** open a PR against a sandbox repo whose workflow points at
-  your branch: `uses: your-org/ff-sec-action/actions/<name>@<your-branch>`.
+- **Manual run (fastest end-to-end):** Actions tab → "AI Code Review (manual)"
+  → Run workflow. Pick your branch, give it a PR number (any PR in this repo,
+  or another repo via the `repo` input + a `GH_PAT` secret). It checks out the
+  selected branch and runs the **local** action, so branch changes are tested
+  before any tag exists. `post-comment` defaults to `false` — results land in
+  the job summary.
+- **End-to-end from a consumer:** open a PR against a sandbox repo whose
+  workflow points at your branch:
+  `uses: filecoin-project/ff-sec-actions/actions/<name>@<your-branch>`.
   Verify the comment, job summary, outputs, and the failure gate.
 - PRs to this repo get reviewed by the org security team (add a `CODEOWNERS`
   entry for your action's directory if you want ownership).

actions/ai-code-review/action.yml

@@ -13,6 +13,14 @@ inputs:
     description: Token used to read the PR diff and post the review comment.
     required: false
     default: ${{ github.token }}
+  pr-number:
+    description: PR number to review. Defaults to the current pull_request event (set explicitly for workflow_dispatch runs).
+    required: false
+    default: ""
+  repo:
+    description: owner/repo containing the PR. Defaults to the current repository (cross-repo runs need a github-token with access to that repo).
+    required: false
+    default: ""
   model:
     description: Claude model ID.
     required: false
@@ -81,11 +89,11 @@ runs:
         DOMAIN: ${{ inputs.domain }}
         PROMPT_FILE_OVERRIDE: ${{ inputs.prompt-file }}
         ACTION_PATH: ${{ github.action_path }}
-        PR_NUMBER: ${{ github.event.pull_request.number }}
-        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ inputs.pr-number || github.event.pull_request.number }}
+        REPO: ${{ inputs.repo || github.repository }}
       run: |
         if [ -z "${PR_NUMBER}" ]; then
-          echo "::error::ai-code-review must run on a pull_request event."
+          echo "::error::No PR to review: run on a pull_request event or set the pr-number input."
           exit 1
         fi
         if [ -n "${PROMPT_FILE_OVERRIDE}" ]; then

examples/consumer-ai-code-review.yml

@@ -14,7 +14,7 @@ jobs:
   # Option A — reusable workflow (recommended: permissions pre-wired)
   review:
     if: ${{ !github.event.pull_request.draft }}
-    uses: your-org/ff-sec-action/.github/workflows/ai-code-review.yml@v1
+    uses: filecoin-project/ff-sec-actions/.github/workflows/ai-code-review.yml@v1
     with:
       domain: filecoin
       fail-on-severity: none       # set to `critical` once the team trusts the signal
@@ -29,7 +29,7 @@ jobs:
   #     contents: read
   #     pull-requests: write
   #   steps:
-  #     - uses: your-org/ff-sec-action/actions/ai-code-review@v1
+  #     - uses: filecoin-project/ff-sec-actions/actions/ai-code-review@v1
   #       id: ai
   #       with:
   #         anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

examples/consumer-manual-ai-code-review.yml

@@ -0,0 +1,51 @@
+# Manual (on-demand) AI review for a CONSUMER repo.
+# Drop this into the consumer repo as .github/workflows/ai-review-manual.yml,
+# then: Actions tab -> "AI Code Review (manual)" -> Run workflow -> enter a PR number.
+# Or from the CLI:  gh workflow run "AI Code Review (manual)" -f pr-number=123
+#
+# Requirements in the consumer repo:
+# - ANTHROPIC_API_KEY secret visible to this repo (org secret recommended)
+# - If ff-sec-actions is private: it must allow org repo access
+#   (ff-sec-actions Settings -> Actions -> General -> Access)
+# - This file must be on the default branch before it appears in the Actions tab
+#
+# Use @main until a v1 tag exists in ff-sec-actions; switch to @v1 after tagging.
+name: AI Code Review (manual)
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr-number:
+        description: PR number in THIS repo to review
+        required: true
+      domain:
+        description: Domain prompt (prompts/<domain>.md in ff-sec-actions)
+        required: false
+        default: filecoin
+      post-comment:
+        description: Post the sticky PR comment (job summary always written)
+        required: false
+        type: choice
+        options: ["true", "false"]
+        default: "true"
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      # No checkout needed: the action fetches the PR diff via the GitHub API.
+      - uses: filecoin-project/ff-sec-actions/actions/ai-code-review@main
+        id: ai
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+          pr-number: ${{ inputs.pr-number }}
+          domain: ${{ inputs.domain }}
+          post-comment: ${{ inputs.post-comment }}
+
+      - if: always()
+        run: |
+          echo "findings-count:   ${{ steps.ai.outputs.findings-count }}"
+          echo "highest-severity: ${{ steps.ai.outputs.highest-severity }}"