ai-code-review.yml

name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - '**/*.js'
      - '**/*.jsx'
      - '**/*.ts'
      - '**/*.tsx'
      - '**/*.py'
      - '**/*.java'
      - '**/*.c'
      - '**/*.cpp'
      - '**/*.cs'
      - '**/*.go'
      - '**/*.rs'
      - '**/*.php'
      - '**/*.rb'
      - '**/*.swift'
      - '**/*.kt'

permissions:
  contents: read
  pull-requests: write

jobs:
  ai-code-review:
    name: AI Code Review
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get changed files
        id: changed-files
        run: |
          git diff --name-only \
            ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} \
            | grep -E '\.(js|jsx|ts|tsx|py|java|c|cpp|cs|go|rs|php|rb|swift|kt)$' \
            > code_files.txt || true

          if [ -s code_files.txt ]; then
            echo "has-code-changes=true" >> $GITHUB_OUTPUT
            echo "Changed files:"
            cat code_files.txt
          else
            echo "has-code-changes=false" >> $GITHUB_OUTPUT
            echo "No code files changed"
          fi

      - name: Review changed files via REST API
        if: steps.changed-files.outputs.has-code-changes == 'true'
        env:
          API_ENDPOINT: ${{ vars.AI_CODE_REVIEWER_ENDPOINT || 'https://ai-code-reviewer-backend.mohammedfirdousaraoye.workers.dev' }}
        run: |
          mkdir -p review-results
          echo "# AI Code Review Results" > review-results/summary.md
          echo "" >> review-results/summary.md
          echo "**PR:** #${{ github.event.pull_request.number }} — ${{ github.event.pull_request.title }}" >> review-results/summary.md
          echo "" >> review-results/summary.md

          total=0
          flagged=0

          while IFS= read -r file; do
            [ -f "$file" ] || continue
            total=$((total + 1))

            # Detect language from extension
            ext="${file##*.}"
            case "$ext" in
              js|jsx)  lang="javascript" ;;
              ts|tsx)  lang="typescript" ;;
              py)      lang="python"     ;;
              java)    lang="java"       ;;
              go)      lang="go"         ;;
              rs)      lang="rust"       ;;
              cpp|cc|cxx|c) lang="cpp"  ;;
              cs)      lang="csharp"    ;;
              php)     lang="php"        ;;
              rb)      lang="ruby"       ;;
              swift)   lang="swift"      ;;
              kt)      lang="kotlin"     ;;
              *)       lang="other"      ;;
            esac

            echo "Reviewing $file ($lang)..."

            # Read file content (limit to 4000 chars to stay within request size)
            code=$(head -c 4000 "$file")

            # Call the REST API
            response=$(curl -s -w "\n%{http_code}" \
              -X POST "$API_ENDPOINT/api/review" \
              -H "Content-Type: application/json" \
              -d "$(jq -n \
                --arg code "$code" \
                --arg language "$lang" \
                --arg category "security" \
                '{code: $code, language: $language, category: $category}'
              )" \
              --max-time 60) || {
              echo "Request failed for $file" >&2
              continue
            }

            http_code=$(echo "$response" | tail -1)
            body=$(echo "$response" | head -n -1)

            if [ "$http_code" != "200" ]; then
              echo "API returned $http_code for $file" >&2
              continue
            fi

            review_text=$(echo "$body" | jq -r '.review.result // "No review returned"')

            {
              echo "## \`$file\`"
              echo ""
              echo "$review_text"
              echo ""
              echo "---"
              echo ""
            } >> review-results/summary.md

            # Simple heuristic: flag if the word "issue", "vulnerability", or "bug" appears
            if echo "$review_text" | grep -qi '\b(issue|vulnerability|bug|insecure|problem)\b'; then
              flagged=$((flagged + 1))
            fi

          done < code_files.txt

          {
            echo "## Summary"
            echo ""
            echo "- Files reviewed: $total"
            echo "- Files with potential issues: $flagged"
            if [ "$flagged" -eq 0 ]; then
              echo "- Status: No major issues detected"
            else
              echo "- Status: Review flagged issues before merging"
            fi
          } >> review-results/summary.md

      - name: Post review as PR comment
        if: steps.changed-files.outputs.has-code-changes == 'true'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
            const summaryPath = 'review-results/summary.md';
            if (!fs.existsSync(summaryPath)) {
              console.log('No review summary generated');
              return;
            }

            const body = fs.readFileSync(summaryPath, 'utf8');

            // Update existing comment if one exists, otherwise create
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const existing = comments.find(c => c.body.startsWith('# AI Code Review Results'));

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Upload review artifacts
        if: steps.changed-files.outputs.has-code-changes == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: ai-review-results
          path: review-results/
          retention-days: 30