@clearlydev/nx-archweave 0.2.1 → 0.2.2

package/dist/bin/review-verdict.js

@@ -2,7 +2,8 @@
 
 // src/bin/review-verdict.ts
 import { spawnSync } from "node:child_process";
-import { realpathSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { appendFileSync, realpathSync } from "node:fs";
 
 // ../review-policy/dist/schema/review-finding.js
 function computeVerdict(findings) {
@@ -231,7 +232,19 @@ var realExec = (command, args, stdin) => {
   const result = spawnSync(command, args, { encoding: "utf-8", input: stdin });
   return { status: result.status ?? null, stdout: result.stdout ?? "" };
 };
-function runReviewVerdictBin(env, exec) {
+var realWriteOutput = (path, text) => appendFileSync(path, text);
+function outputModePath(env) {
+  return env["ARCHWEAVE_VERDICT_OUTPUT"] === "github-output" && env["GITHUB_OUTPUT"] ? env["GITHUB_OUTPUT"] : void 0;
+}
+function renderStepOutputs(commentBody, previousId, blocked) {
+  let delimiter;
+  do
+    delimiter = `ARCHWEAVE_${randomBytes(8).toString("hex")}`;
+  while (commentBody.split("\n").includes(delimiter));
+  return [`comment-body<<${delimiter}`, commentBody, delimiter, `previous-comment-id=${previousId ?? ""}`, `blocked=${blocked}`, ""].join("\n");
+}
+var UNREAD_COMMENTS_ERROR = "::error title=Review verdict not computed::Could not read PR comments, so the verdict could not be computed. Re-run the failed jobs to retry. If it fails again, check that the review job has pull-requests: read.";
+function runReviewVerdictBin(env, exec, writeOutput = realWriteOutput) {
   const logs = [];
   const repo = env["GITHUB_REPOSITORY"];
   const pr = env["ARCHWEAVE_PR_NUMBER"];
@@ -245,14 +258,14 @@ function runReviewVerdictBin(env, exec) {
   const roundAfterId = watermark !== void 0 && /^\d+$/.test(watermark) ? Number(watermark) : void 0;
   const sha = env["ARCHWEAVE_HEAD_SHA"];
   const headSha = sha !== void 0 && /^[0-9a-f]{7,40}$/i.test(sha) ? sha : void 0;
+  const outputPath = outputModePath(env);
   const fetched = exec("gh", ["api", `repos/${repo}/issues/${pr}/comments`, "--paginate"]);
-  if (fetched.status !== 0) {
-    logs.push("verdict gate: could not fetch PR comments via gh \u2014 skipping (check stays green).");
-    return { exitCode: 0, logs };
-  }
-  const pages = splitConcatenatedJson(fetched.stdout);
+  const pages = fetched.status === 0 ? splitConcatenatedJson(fetched.stdout) : null;
   if (pages === null) {
-    logs.push("verdict gate: unexpected gh output \u2014 skipping (check stays green).");
+    if (outputPath !== void 0) return { exitCode: 1, logs: [UNREAD_COMMENTS_ERROR] };
+    logs.push(
+      fetched.status !== 0 ? "verdict gate: could not fetch PR comments via gh \u2014 skipping (check stays green)." : "verdict gate: unexpected gh output \u2014 skipping (check stays green)."
+    );
     return { exitCode: 0, logs };
   }
   const comments = pages.flatMap((page) => Array.isArray(page) ? page : []).filter(
@@ -264,22 +277,25 @@ function runReviewVerdictBin(env, exec) {
     return { exitCode: 0, logs };
   }
   const previous = [...comments].reverse().find((c) => c.body.includes(VERDICT_MARKER) && c.id !== void 0);
-  const payload = JSON.stringify({ body: result.commentBody });
-  const updated = previous !== void 0 && exec("gh", ["api", "-X", "PATCH", `repos/${repo}/issues/comments/${previous.id}`, "--input", "-"], payload).status === 0;
-  if (!updated) {
-    const post = exec("gh", ["api", "-X", "POST", `repos/${repo}/issues/${pr}/comments`, "--input", "-"], payload);
-    if (post.status !== 0) logs.push("verdict gate: could not post the verdict comment (continuing).");
-  }
-  if (result.kind === "no-round") {
-    logs.push("verdict gate: this run posted no review round for the current commit \u2014 earlier rounds are not judged again; check stays green.");
-    return { exitCode: 0, logs };
+  const settled = result.kind === "no-round" || result.kind === "unparseable";
+  if (outputPath !== void 0) {
+    writeOutput(outputPath, renderStepOutputs(result.commentBody, previous?.id, !settled && result.exitCode !== 0));
+  } else {
+    const payload = JSON.stringify({ body: result.commentBody });
+    const updated = previous !== void 0 && exec("gh", ["api", "-X", "PATCH", `repos/${repo}/issues/comments/${previous.id}`, "--input", "-"], payload).status === 0;
+    if (!updated) {
+      const post = exec("gh", ["api", "-X", "POST", `repos/${repo}/issues/${pr}/comments`, "--input", "-"], payload);
+      if (post.status !== 0) logs.push("verdict gate: could not post the verdict comment (continuing).");
+    }
   }
-  if (result.kind === "unparseable") {
-    logs.push("verdict gate: review output was not machine-readable \u2014 human review requested, check stays green.");
+  if (settled) {
+    logs.push(
+      result.kind === "no-round" ? "verdict gate: this run posted no review round for the current commit \u2014 earlier rounds are not judged again; check stays green." : "verdict gate: review output was not machine-readable \u2014 human review requested, check stays green."
+    );
     return { exitCode: 0, logs };
   }
   logs.push(`verdict gate: ${result.verdict}`);
-  return { exitCode: result.exitCode, logs };
+  return { exitCode: outputPath === void 0 ? result.exitCode : 0, logs };
 }
 function splitConcatenatedJson(stdout) {
   const text = stdout.trim();

package/dist/generators/add-review/generator.js

@@ -177,13 +177,14 @@ function renderConcurrencyBlock() {
     "  cancel-in-progress: false"
   ].join("\n");
 }
-function renderPermissionsBlock() {
-  return ["permissions:", "  contents: read", "  pull-requests: write", "  id-token: write"].join("\n");
+var REVIEW_GATE_CONDITION = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+function renderReviewPermissions(idToken) {
+  return ["permissions:", "  contents: read", "  pull-requests: write", ...idToken ? ["  id-token: write"] : []].join("\n");
 }
 function renderCheckoutStep(gateCondition, extraWith = []) {
   return [
     "- name: Checkout repository",
-    `  if: ${gateCondition}`,
+    ...gateCondition === void 0 ? [] : [`  if: ${gateCondition}`],
     `  uses: ${pinnedUses("actions/checkout")}`,
     "  with:",
     ...extraWith.map((line) => `    ${line}`),
@@ -225,10 +226,46 @@ function renderRoundGateStep(maxRounds) {
     "    fi"
   ].join("\n");
 }
+var JUDGE_CONDITION = "steps.ai-review-result.outputs.run == 'true'";
+function renderAiReviewResultStep() {
+  return [
+    "- name: Check the AI review result",
+    "  id: ai-review-result",
+    "  env:",
+    "    AI_REVIEW_RESULT: ${{ needs.ai-review.result }}",
+    "    REVIEW_ENABLED: ${{ needs.ai-review.outputs.enabled }}",
+    "    REVIEW_ALLOWED: ${{ needs.ai-review.outputs.allowed }}",
+    "    LAST_COMMENT_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "  run: |",
+    '    if [ "$AI_REVIEW_RESULT" != success ]; then',
+    `      echo "::error title=AI review did not succeed::The AI review job ended with '$AI_REVIEW_RESULT'."`,
+    "      exit 1",
+    "    fi",
+    '    case "$REVIEW_ENABLED/$REVIEW_ALLOWED" in',
+    "      false/* | true/false)",
+    '        echo "The AI review did not run (no secret, or the round limit) - nothing to judge."',
+    '        echo "run=false" >> "$GITHUB_OUTPUT"',
+    "        exit 0",
+    "        ;;",
+    "      true/true)",
+    '        case "$LAST_COMMENT_ID" in',
+    "          '' | *[!0-9]*) ;;",
+    "          *)",
+    '            echo "run=true" >> "$GITHUB_OUTPUT"',
+    "            exit 0",
+    "            ;;",
+    "        esac",
+    "        ;;",
+    "    esac",
+    `    echo "::error title=Review verdict not computed::The AI review job's results did not reach this job, so no verdict can be computed. Re-run all jobs."`,
+    "    exit 1"
+  ].join("\n");
+}
 function renderVerdictGateStep(maxRounds, locale) {
   return [
     "- name: Compute review verdict",
-    "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
+    "  id: verdict",
+    `  if: ${JUDGE_CONDITION}`,
     "  env:",
     "    GH_TOKEN: ${{ github.token }}",
     "    GITHUB_REPOSITORY: ${{ github.repository }}",
@@ -236,7 +273,8 @@ function renderVerdictGateStep(maxRounds, locale) {
     `    ARCHWEAVE_MAX_ROUNDS: '${maxRounds}'`,
     `    ARCHWEAVE_LOCALE: '${locale}'`,
     "    ARCHWEAVE_HEAD_SHA: ${{ github.event.pull_request.head.sha }}",
-    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "    ARCHWEAVE_VERDICT_OUTPUT: 'github-output'",
     "  run: |",
     "    if [ -x node_modules/.bin/archweave-review-verdict ]; then",
     "      node_modules/.bin/archweave-review-verdict",
@@ -245,16 +283,46 @@ function renderVerdictGateStep(maxRounds, locale) {
     "    fi"
   ].join("\n");
 }
+function renderBlockStep() {
+  return [
+    "- name: Fail on a blocking verdict",
+    "  if: steps.verdict.outputs.blocked == 'true'",
+    "  run: |",
+    '    echo "The review verdict is BLOCK - see the verdict comment on this pull request."',
+    "    exit 1"
+  ].join("\n");
+}
+function renderVerdictCommentStep() {
+  return [
+    "- name: Post review verdict",
+    "  env:",
+    "    GH_TOKEN: ${{ github.token }}",
+    "    REPOSITORY: ${{ github.repository }}",
+    "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+    "    VERDICT_BODY: ${{ needs.review.outputs.comment-body }}",
+    "    PREVIOUS_ID: ${{ needs.review.outputs.previous-comment-id }}",
+    "  run: |",
+    `    payload=$(jq -n --arg body "$VERDICT_BODY" '{body: $body}')`,
+    '    case "$PREVIOUS_ID" in',
+    "      ''|*[!0-9]*) PREVIOUS_ID= ;;",
+    "    esac",
+    `    if [ -n "$PREVIOUS_ID" ] && printf '%s' "$payload" | gh api -X PATCH "repos/$REPOSITORY/issues/comments/$PREVIOUS_ID" --input - > /dev/null; then`,
+    "      exit 0",
+    "    fi",
+    `    printf '%s' "$payload" | gh api -X POST "repos/$REPOSITORY/issues/$PR_NUMBER/comments" --input - > /dev/null \\`,
+    '      || echo "Could not post the verdict comment (continuing)."'
+  ].join("\n");
+}
 var SETUP_NODE_VERSION = "22";
 var FALLBACK_PNPM_VERSION = "10";
 var INSTALL_LINES = {
-  pnpm: ["    pnpm install --frozen-lockfile"],
-  npm: ["    npm ci"],
+  pnpm: ["    pnpm install --frozen-lockfile --ignore-scripts"],
+  npm: ["    npm ci --ignore-scripts"],
   yarn: [
     "    corepack enable yarn",
-    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then yarn install --immutable; else yarn install --frozen-lockfile; fi'
+    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then YARN_ENABLE_SCRIPTS=false yarn install --immutable --mode=skip-build; else yarn install --frozen-lockfile --ignore-scripts; fi'
   ],
-  bun: ["    bun install --frozen-lockfile"]
+  bun: ["    bun install --frozen-lockfile --ignore-scripts"]
 };
 function renderPnpmVersionStep(gate) {
   return [
@@ -270,7 +338,7 @@ function renderPnpmVersionStep(gate) {
   ].join("\n");
 }
 function renderWorkspaceSetupSteps(packageManager) {
-  const gate = "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+  const gate = `  if: ${JUDGE_CONDITION}`;
   const steps = [];
   if (packageManager === "pnpm") {
     steps.push(renderPnpmVersionStep(gate));
@@ -305,6 +373,60 @@ function renderWorkspaceSetupSteps(packageManager) {
   ].join("\n"));
   return steps.join("\n\n");
 }
+function renderReviewWorkflow(input, parts) {
+  const aiReviewSteps = [renderSecretGateStep(parts.secretName), renderRoundGateStep(input.maxRounds), ...parts.reviewSteps];
+  const reviewSteps = [
+    renderAiReviewResultStep(),
+    renderCheckoutStep(JUDGE_CONDITION),
+    renderWorkspaceSetupSteps(input.packageManager),
+    renderVerdictGateStep(input.maxRounds, input.locale),
+    renderBlockStep()
+  ];
+  return [
+    `name: ${parts.name}`,
+    "",
+    renderTriggerBlock(),
+    "",
+    renderConcurrencyBlock(),
+    "",
+    "permissions: {}",
+    "",
+    "jobs:",
+    "  ai-review:",
+    "    runs-on: ubuntu-latest",
+    indentBlock(renderReviewPermissions(parts.idToken), 4),
+    "    outputs:",
+    "      enabled: ${{ steps.secret-gate.outputs.enabled }}",
+    "      allowed: ${{ steps.round-gate.outputs.allowed }}",
+    "      last-comment-id: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    steps:",
+    indentBlock(aiReviewSteps.join("\n\n"), 6),
+    "",
+    "  review:",
+    "    needs: ai-review",
+    "    if: always()",
+    "    runs-on: ubuntu-latest",
+    "    permissions:",
+    "      contents: read",
+    "      pull-requests: read",
+    "    outputs:",
+    "      comment-body: ${{ steps.verdict.outputs.comment-body }}",
+    "      previous-comment-id: ${{ steps.verdict.outputs.previous-comment-id }}",
+    "    steps:",
+    indentBlock(reviewSteps.join("\n\n"), 6),
+    "",
+    "  review-comment:",
+    "    needs: review",
+    // Runs after a BLOCK failed the review job, too: the comment explains the red check.
+    "    if: ${{ !cancelled() && needs.review.outputs.comment-body != '' }}",
+    "    runs-on: ubuntu-latest",
+    "    permissions:",
+    "      pull-requests: write",
+    "    steps:",
+    indentBlock(renderVerdictCommentStep(), 6),
+    ""
+  ].join("\n");
+}
 
 // ../template-engine/dist/review/claude/claude-provider.js
 var SECRET_NAME = "CLAUDE_CODE_OAUTH_TOKEN";
@@ -337,40 +459,26 @@ function composePrompt(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Claude review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
-      "  with:",
-      `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt(input), 6),
-      "    claude_args: |",
-      `      --allowedTools "${ALLOWED_TOOLS}"`
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Claude Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Claude Code Review",
+    secretName: SECRET_NAME,
+    // The Claude GitHub App signs in with the workflow's OIDC token (claude-code-action's FAQ).
+    idToken: true,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Claude review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
+        "  with:",
+        `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
+        "    prompt: |",
+        indentBlock(composePrompt(input), 6),
+        "    claude_args: |",
+        `      --allowedTools "${ALLOWED_TOOLS}"`
+      ].join("\n")
+    ]
+  });
 }
 var claudeProvider = {
   id: "claude",
@@ -410,49 +518,39 @@ function composePrompt2(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml2(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME2),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition),
-    [
-      "- name: Install cursor-agent CLI",
-      `  if: ${gateCondition}`,
-      "  run: |",
-      "    curl https://cursor.com/install -fsS | bash",
-      '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
-    ].join("\n"),
-    [
-      "- name: Run Cursor review",
-      `  if: ${gateCondition}`,
-      "  env:",
-      `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
-      "    GH_TOKEN: ${{ github.token }}",
-      "  run: |",
-      `    agent -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
-      indentBlock(composePrompt2(input), 4),
-      `    ${PROMPT_HEREDOC_DELIMITER}`,
-      '    )"'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Cursor Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Cursor Code Review",
+    secretName: SECRET_NAME2,
+    // An API key: the Cursor CLI needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Install cursor-agent CLI",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  run: |",
+        // HTTPS only, TLS 1.2 or newer. Cursor publishes no pinned version or checksum for
+        // this installer; docs/pr-review.md states what that leaves open.
+        "    curl --proto '=https' --tlsv1.2 -fsS https://cursor.com/install | bash",
+        // The docs name ~/.cursor/bin; the installer currently links `agent` into ~/.local/bin.
+        // Both go on the PATH, so the next step finds it wherever the installer puts it.
+        '    echo "$HOME/.local/bin" >> "$GITHUB_PATH"',
+        '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
+      ].join("\n"),
+      [
+        "- name: Run Cursor review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
+        "    GH_TOKEN: ${{ github.token }}",
+        "  run: |",
+        `    agent -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
+        indentBlock(composePrompt2(input), 4),
+        `    ${PROMPT_HEREDOC_DELIMITER}`,
+        '    )"'
+      ].join("\n")
+    ]
+  });
 }
 var cursorProvider = {
   id: "cursor",
@@ -491,40 +589,26 @@ function composePrompt3(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml3(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME3),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Gemini review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
-      "  env:",
-      "    GITHUB_TOKEN: ${{ github.token }}",
-      "  with:",
-      `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt3(input), 6)
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Gemini Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Gemini Code Review",
+    secretName: SECRET_NAME3,
+    // An API key: run-gemini-cli uses OIDC only for Google Cloud workload identity federation.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Gemini review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
+        "  env:",
+        "    GITHUB_TOKEN: ${{ github.token }}",
+        "  with:",
+        `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
+        "    prompt: |",
+        indentBlock(composePrompt3(input), 6)
+      ].join("\n")
+    ]
+  });
 }
 var geminiProvider = {
   id: "gemini",
@@ -563,64 +647,49 @@ function composePrompt4(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml4(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME4),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
-    [
-      "- name: Fetch base and head refs for the PR",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "  run: |",
-      "    # Explicit destinations: the sandboxed review step has no network, so both sides",
-      "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
-      "    git fetch --no-tags origin \\",
-      '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
-      '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
-    ].join("\n"),
-    [
-      "- name: Run Codex review",
-      "  id: codex-review",
-      `  if: ${gateCondition}`,
-      `  uses: ${pinnedUses("openai/codex-action")}`,
-      "  with:",
-      `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
-      '    permission-profile: ":read-only"',
-      "    prompt: |",
-      indentBlock(composePrompt4(input), 6)
-    ].join("\n"),
-    [
-      "- name: Post review comment",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    GH_TOKEN: ${{ github.token }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
-      "  run: |",
-      '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: GPT Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "GPT Code Review",
+    secretName: SECRET_NAME4,
+    // An API key: codex-action needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
+      [
+        "- name: Fetch base and head refs for the PR",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "  run: |",
+        "    # Explicit destinations: the sandboxed review step has no network, so both sides",
+        "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
+        "    git fetch --no-tags origin \\",
+        '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
+        '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
+      ].join("\n"),
+      [
+        "- name: Run Codex review",
+        "  id: codex-review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("openai/codex-action")}`,
+        "  with:",
+        `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
+        '    permission-profile: ":read-only"',
+        "    prompt: |",
+        indentBlock(composePrompt4(input), 6)
+      ].join("\n"),
+      [
+        "- name: Post review comment",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    GH_TOKEN: ${{ github.token }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
+        "  run: |",
+        '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
+      ].join("\n")
+    ]
+  });
 }
 var gptProvider = {
   id: "gpt",