reusable-review.yml

# Reusable review agent workflow. Called by dispatch workflows via workflow_call.
# Runs in the caller's repo context (secrets, checkout).
name: Review Agent

concurrency:
  group: fullsend-review-${{ inputs.source_repo }}-${{ fromJSON(inputs.event_payload).pull_request.number || fromJSON(inputs.event_payload).issue.number }}
  cancel-in-progress: true

on:
  workflow_call:
    inputs:
      event_type:
        required: true
        type: string
      source_repo:
        required: true
        type: string
      event_payload:
        required: true
        type: string
      mint_url:
        required: true
        type: string
      gcp_region:
        required: true
        type: string
      fullsend_version:
        required: false
        type: string
        default: 'latest'
      install_mode:
        required: false
        type: string
        default: 'per-org'
    secrets:
      FULLSEND_GCP_WIF_PROVIDER:
        required: true
      FULLSEND_GCP_PROJECT_ID:
        required: true

jobs:
  review:
    name: Review
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
      id-token: write
      issues: write
      pull-requests: write

    steps:
      - name: Checkout config repository
        uses: actions/checkout@v6

      - name: Checkout upstream defaults
        uses: actions/checkout@v6
        with:
          repository: fullsend-ai/fullsend
          ref: v0
          path: .defaults
          sparse-checkout: |
            internal/scaffold/fullsend-repo/

      - name: Prepare workspace (upstream defaults + org/repo overrides)
        env:
          INSTALL_MODE: ${{ inputs.install_mode }}
        run: |
          set -euo pipefail
          if [[ "${INSTALL_MODE}" != "per-org" && "${INSTALL_MODE}" != "per-repo" ]]; then
            echo "::error::Invalid install_mode '${INSTALL_MODE}': must be 'per-org' or 'per-repo'"
            exit 1
          fi
          SRC=".defaults/internal/scaffold/fullsend-repo"
          LAYERED_DIRS="agents skills schemas harness plugins policies scripts env"
          for dir in ${LAYERED_DIRS}; do
            if [[ -d "${SRC}/${dir}" ]]; then
              mkdir -p "${dir}"
              cp -r "${SRC}/${dir}/." "${dir}/"
            fi
          done
          CUSTOM_BASE="customized"
          if [[ "${INSTALL_MODE}" == "per-repo" ]]; then
            CUSTOM_BASE=".fullsend/customized"
          fi
          for dir in ${LAYERED_DIRS}; do
            if [[ -d "${CUSTOM_BASE}/${dir}" ]]; then
              find "${CUSTOM_BASE}/${dir}" -type f ! -name '.gitkeep' -print0 \
                | while IFS= read -r -d '' f; do
                    rel="${f#"${CUSTOM_BASE}"/}"
                    mkdir -p "$(dirname "${rel}")"
                    cp "${f}" "${rel}"
                  done
            fi
          done
          mkdir -p .github/scripts
          cp "${SRC}/.github/scripts/setup-agent-env.sh" .github/scripts/setup-agent-env.sh
          rm -rf .defaults

      - name: Validate enrollment and extract repo metadata
        id: repo-parts
        uses: fullsend-ai/fullsend/.github/actions/validate-enrollment@v0
        with:
          source_repo: ${{ inputs.source_repo }}
          install_mode: ${{ inputs.install_mode }}

      - name: Mint review token
        id: app-token
        uses: fullsend-ai/fullsend/.github/actions/mint-token@v0
        with:
          role: review
          repos: ${{ steps.repo-parts.outputs.name }}
          mint_url: ${{ inputs.mint_url }}

      - name: Checkout target repository
        uses: actions/checkout@v6
        with:
          repository: ${{ inputs.source_repo }}
          token: ${{ steps.app-token.outputs.token }}
          path: target-repo
          fetch-depth: 1
          persist-credentials: false

      - name: Pre-fetch prior review context
        id: prior-review
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          SOURCE_REPO: ${{ inputs.source_repo }}
          PR_NUM: >-
            ${{ fromJSON(inputs.event_payload).pull_request.number
             || fromJSON(inputs.event_payload).issue.number }}
          ORG_NAME: ${{ github.repository_owner }}
          REVIEW_APP_CLIENT_ID: ${{ vars.FULLSEND_REVIEW_CLIENT_ID }}
        run: bash scripts/pre-fetch-prior-review.sh

      - name: Setup GCP and prepare credentials
        uses: fullsend-ai/fullsend/.github/actions/setup-gcp@v0
        with:
          gcp_wif_provider: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
          gcp_project_id: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

      - name: Setup agent environment
        env:
          AGENT_PREFIX: REVIEW_
          REVIEW_GH_TOKEN: ${{ steps.app-token.outputs.token }}
          REVIEW_TARGET_REPO_DIR: target-repo
          REVIEW_ANTHROPIC_VERTEX_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
          REVIEW_CLOUD_ML_REGION: ${{ inputs.gcp_region }}
        run: bash .github/scripts/setup-agent-env.sh

      - name: Run review agent
        uses: fullsend-ai/fullsend@v0
        env:
          GITHUB_ISSUE_URL: ${{ fromJSON(inputs.event_payload).issue.html_url }}
          GITHUB_PR_URL: ${{ fromJSON(inputs.event_payload).pull_request.html_url || fromJSON(inputs.event_payload).issue.html_url }}
          REVIEW_TOKEN: ${{ steps.app-token.outputs.token }}
          REPO_FULL_NAME: ${{ inputs.source_repo }}
          PR_NUMBER: ${{ fromJSON(inputs.event_payload).pull_request.number || fromJSON(inputs.event_payload).issue.number }}
          PRIOR_REVIEW_SHA: ${{ steps.prior-review.outputs.prior_sha }}
          PRIOR_REVIEW_FILE: ${{ steps.prior-review.outputs.prior_review_file }}
          PRIOR_REVIEW_PROVENANCE: ${{ steps.prior-review.outputs.prior_review_provenance }}
        with:
          agent: review
          version: ${{ inputs.fullsend_version }}