@clearlydev/nx-archweave 0.2.1 → 0.2.2

package/dist/generators/doctor/generator.js

@@ -320,13 +320,14 @@ function renderConcurrencyBlock() {
     "  cancel-in-progress: false"
   ].join("\n");
 }
-function renderPermissionsBlock() {
-  return ["permissions:", "  contents: read", "  pull-requests: write", "  id-token: write"].join("\n");
+var REVIEW_GATE_CONDITION = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+function renderReviewPermissions(idToken) {
+  return ["permissions:", "  contents: read", "  pull-requests: write", ...idToken ? ["  id-token: write"] : []].join("\n");
 }
 function renderCheckoutStep(gateCondition, extraWith = []) {
   return [
     "- name: Checkout repository",
-    `  if: ${gateCondition}`,
+    ...gateCondition === void 0 ? [] : [`  if: ${gateCondition}`],
     `  uses: ${pinnedUses("actions/checkout")}`,
     "  with:",
     ...extraWith.map((line) => `    ${line}`),
@@ -368,10 +369,46 @@ function renderRoundGateStep(maxRounds) {
     "    fi"
   ].join("\n");
 }
+var JUDGE_CONDITION = "steps.ai-review-result.outputs.run == 'true'";
+function renderAiReviewResultStep() {
+  return [
+    "- name: Check the AI review result",
+    "  id: ai-review-result",
+    "  env:",
+    "    AI_REVIEW_RESULT: ${{ needs.ai-review.result }}",
+    "    REVIEW_ENABLED: ${{ needs.ai-review.outputs.enabled }}",
+    "    REVIEW_ALLOWED: ${{ needs.ai-review.outputs.allowed }}",
+    "    LAST_COMMENT_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "  run: |",
+    '    if [ "$AI_REVIEW_RESULT" != success ]; then',
+    `      echo "::error title=AI review did not succeed::The AI review job ended with '$AI_REVIEW_RESULT'."`,
+    "      exit 1",
+    "    fi",
+    '    case "$REVIEW_ENABLED/$REVIEW_ALLOWED" in',
+    "      false/* | true/false)",
+    '        echo "The AI review did not run (no secret, or the round limit) - nothing to judge."',
+    '        echo "run=false" >> "$GITHUB_OUTPUT"',
+    "        exit 0",
+    "        ;;",
+    "      true/true)",
+    '        case "$LAST_COMMENT_ID" in',
+    "          '' | *[!0-9]*) ;;",
+    "          *)",
+    '            echo "run=true" >> "$GITHUB_OUTPUT"',
+    "            exit 0",
+    "            ;;",
+    "        esac",
+    "        ;;",
+    "    esac",
+    `    echo "::error title=Review verdict not computed::The AI review job's results did not reach this job, so no verdict can be computed. Re-run all jobs."`,
+    "    exit 1"
+  ].join("\n");
+}
 function renderVerdictGateStep(maxRounds, locale) {
   return [
     "- name: Compute review verdict",
-    "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
+    "  id: verdict",
+    `  if: ${JUDGE_CONDITION}`,
     "  env:",
     "    GH_TOKEN: ${{ github.token }}",
     "    GITHUB_REPOSITORY: ${{ github.repository }}",
@@ -379,7 +416,8 @@ function renderVerdictGateStep(maxRounds, locale) {
     `    ARCHWEAVE_MAX_ROUNDS: '${maxRounds}'`,
     `    ARCHWEAVE_LOCALE: '${locale}'`,
     "    ARCHWEAVE_HEAD_SHA: ${{ github.event.pull_request.head.sha }}",
-    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "    ARCHWEAVE_VERDICT_OUTPUT: 'github-output'",
     "  run: |",
     "    if [ -x node_modules/.bin/archweave-review-verdict ]; then",
     "      node_modules/.bin/archweave-review-verdict",
@@ -388,16 +426,46 @@ function renderVerdictGateStep(maxRounds, locale) {
     "    fi"
   ].join("\n");
 }
+function renderBlockStep() {
+  return [
+    "- name: Fail on a blocking verdict",
+    "  if: steps.verdict.outputs.blocked == 'true'",
+    "  run: |",
+    '    echo "The review verdict is BLOCK - see the verdict comment on this pull request."',
+    "    exit 1"
+  ].join("\n");
+}
+function renderVerdictCommentStep() {
+  return [
+    "- name: Post review verdict",
+    "  env:",
+    "    GH_TOKEN: ${{ github.token }}",
+    "    REPOSITORY: ${{ github.repository }}",
+    "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+    "    VERDICT_BODY: ${{ needs.review.outputs.comment-body }}",
+    "    PREVIOUS_ID: ${{ needs.review.outputs.previous-comment-id }}",
+    "  run: |",
+    `    payload=$(jq -n --arg body "$VERDICT_BODY" '{body: $body}')`,
+    '    case "$PREVIOUS_ID" in',
+    "      ''|*[!0-9]*) PREVIOUS_ID= ;;",
+    "    esac",
+    `    if [ -n "$PREVIOUS_ID" ] && printf '%s' "$payload" | gh api -X PATCH "repos/$REPOSITORY/issues/comments/$PREVIOUS_ID" --input - > /dev/null; then`,
+    "      exit 0",
+    "    fi",
+    `    printf '%s' "$payload" | gh api -X POST "repos/$REPOSITORY/issues/$PR_NUMBER/comments" --input - > /dev/null \\`,
+    '      || echo "Could not post the verdict comment (continuing)."'
+  ].join("\n");
+}
 var SETUP_NODE_VERSION = "22";
 var FALLBACK_PNPM_VERSION = "10";
 var INSTALL_LINES = {
-  pnpm: ["    pnpm install --frozen-lockfile"],
-  npm: ["    npm ci"],
+  pnpm: ["    pnpm install --frozen-lockfile --ignore-scripts"],
+  npm: ["    npm ci --ignore-scripts"],
   yarn: [
     "    corepack enable yarn",
-    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then yarn install --immutable; else yarn install --frozen-lockfile; fi'
+    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then YARN_ENABLE_SCRIPTS=false yarn install --immutable --mode=skip-build; else yarn install --frozen-lockfile --ignore-scripts; fi'
   ],
-  bun: ["    bun install --frozen-lockfile"]
+  bun: ["    bun install --frozen-lockfile --ignore-scripts"]
 };
 function renderPnpmVersionStep(gate) {
   return [
@@ -413,7 +481,7 @@ function renderPnpmVersionStep(gate) {
   ].join("\n");
 }
 function renderWorkspaceSetupSteps(packageManager) {
-  const gate = "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+  const gate = `  if: ${JUDGE_CONDITION}`;
   const steps = [];
   if (packageManager === "pnpm") {
     steps.push(renderPnpmVersionStep(gate));
@@ -448,6 +516,60 @@ function renderWorkspaceSetupSteps(packageManager) {
   ].join("\n"));
   return steps.join("\n\n");
 }
+function renderReviewWorkflow(input, parts) {
+  const aiReviewSteps = [renderSecretGateStep(parts.secretName), renderRoundGateStep(input.maxRounds), ...parts.reviewSteps];
+  const reviewSteps = [
+    renderAiReviewResultStep(),
+    renderCheckoutStep(JUDGE_CONDITION),
+    renderWorkspaceSetupSteps(input.packageManager),
+    renderVerdictGateStep(input.maxRounds, input.locale),
+    renderBlockStep()
+  ];
+  return [
+    `name: ${parts.name}`,
+    "",
+    renderTriggerBlock(),
+    "",
+    renderConcurrencyBlock(),
+    "",
+    "permissions: {}",
+    "",
+    "jobs:",
+    "  ai-review:",
+    "    runs-on: ubuntu-latest",
+    indentBlock(renderReviewPermissions(parts.idToken), 4),
+    "    outputs:",
+    "      enabled: ${{ steps.secret-gate.outputs.enabled }}",
+    "      allowed: ${{ steps.round-gate.outputs.allowed }}",
+    "      last-comment-id: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    steps:",
+    indentBlock(aiReviewSteps.join("\n\n"), 6),
+    "",
+    "  review:",
+    "    needs: ai-review",
+    "    if: always()",
+    "    runs-on: ubuntu-latest",
+    "    permissions:",
+    "      contents: read",
+    "      pull-requests: read",
+    "    outputs:",
+    "      comment-body: ${{ steps.verdict.outputs.comment-body }}",
+    "      previous-comment-id: ${{ steps.verdict.outputs.previous-comment-id }}",
+    "    steps:",
+    indentBlock(reviewSteps.join("\n\n"), 6),
+    "",
+    "  review-comment:",
+    "    needs: review",
+    // Runs after a BLOCK failed the review job, too: the comment explains the red check.
+    "    if: ${{ !cancelled() && needs.review.outputs.comment-body != '' }}",
+    "    runs-on: ubuntu-latest",
+    "    permissions:",
+    "      pull-requests: write",
+    "    steps:",
+    indentBlock(renderVerdictCommentStep(), 6),
+    ""
+  ].join("\n");
+}
 
 // ../template-engine/dist/review/claude/claude-provider.js
 var SECRET_NAME = "CLAUDE_CODE_OAUTH_TOKEN";
@@ -480,40 +602,26 @@ function composePrompt(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Claude review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
-      "  with:",
-      `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt(input), 6),
-      "    claude_args: |",
-      `      --allowedTools "${ALLOWED_TOOLS}"`
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Claude Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Claude Code Review",
+    secretName: SECRET_NAME,
+    // The Claude GitHub App signs in with the workflow's OIDC token (claude-code-action's FAQ).
+    idToken: true,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Claude review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
+        "  with:",
+        `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
+        "    prompt: |",
+        indentBlock(composePrompt(input), 6),
+        "    claude_args: |",
+        `      --allowedTools "${ALLOWED_TOOLS}"`
+      ].join("\n")
+    ]
+  });
 }
 var claudeProvider = {
   id: "claude",
@@ -553,49 +661,39 @@ function composePrompt2(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml2(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME2),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition),
-    [
-      "- name: Install cursor-agent CLI",
-      `  if: ${gateCondition}`,
-      "  run: |",
-      "    curl https://cursor.com/install -fsS | bash",
-      '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
-    ].join("\n"),
-    [
-      "- name: Run Cursor review",
-      `  if: ${gateCondition}`,
-      "  env:",
-      `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
-      "    GH_TOKEN: ${{ github.token }}",
-      "  run: |",
-      `    agent -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
-      indentBlock(composePrompt2(input), 4),
-      `    ${PROMPT_HEREDOC_DELIMITER}`,
-      '    )"'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Cursor Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Cursor Code Review",
+    secretName: SECRET_NAME2,
+    // An API key: the Cursor CLI needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Install cursor-agent CLI",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  run: |",
+        // HTTPS only, TLS 1.2 or newer. Cursor publishes no pinned version or checksum for
+        // this installer; docs/pr-review.md states what that leaves open.
+        "    curl --proto '=https' --tlsv1.2 -fsS https://cursor.com/install | bash",
+        // The docs name ~/.cursor/bin; the installer currently links `agent` into ~/.local/bin.
+        // Both go on the PATH, so the next step finds it wherever the installer puts it.
+        '    echo "$HOME/.local/bin" >> "$GITHUB_PATH"',
+        '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
+      ].join("\n"),
+      [
+        "- name: Run Cursor review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
+        "    GH_TOKEN: ${{ github.token }}",
+        "  run: |",
+        `    agent -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
+        indentBlock(composePrompt2(input), 4),
+        `    ${PROMPT_HEREDOC_DELIMITER}`,
+        '    )"'
+      ].join("\n")
+    ]
+  });
 }
 var cursorProvider = {
   id: "cursor",
@@ -634,40 +732,26 @@ function composePrompt3(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml3(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME3),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Gemini review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
-      "  env:",
-      "    GITHUB_TOKEN: ${{ github.token }}",
-      "  with:",
-      `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt3(input), 6)
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Gemini Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Gemini Code Review",
+    secretName: SECRET_NAME3,
+    // An API key: run-gemini-cli uses OIDC only for Google Cloud workload identity federation.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Gemini review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
+        "  env:",
+        "    GITHUB_TOKEN: ${{ github.token }}",
+        "  with:",
+        `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
+        "    prompt: |",
+        indentBlock(composePrompt3(input), 6)
+      ].join("\n")
+    ]
+  });
 }
 var geminiProvider = {
   id: "gemini",
@@ -706,64 +790,49 @@ function composePrompt4(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml4(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME4),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
-    [
-      "- name: Fetch base and head refs for the PR",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "  run: |",
-      "    # Explicit destinations: the sandboxed review step has no network, so both sides",
-      "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
-      "    git fetch --no-tags origin \\",
-      '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
-      '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
-    ].join("\n"),
-    [
-      "- name: Run Codex review",
-      "  id: codex-review",
-      `  if: ${gateCondition}`,
-      `  uses: ${pinnedUses("openai/codex-action")}`,
-      "  with:",
-      `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
-      '    permission-profile: ":read-only"',
-      "    prompt: |",
-      indentBlock(composePrompt4(input), 6)
-    ].join("\n"),
-    [
-      "- name: Post review comment",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    GH_TOKEN: ${{ github.token }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
-      "  run: |",
-      '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: GPT Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "GPT Code Review",
+    secretName: SECRET_NAME4,
+    // An API key: codex-action needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
+      [
+        "- name: Fetch base and head refs for the PR",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "  run: |",
+        "    # Explicit destinations: the sandboxed review step has no network, so both sides",
+        "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
+        "    git fetch --no-tags origin \\",
+        '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
+        '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
+      ].join("\n"),
+      [
+        "- name: Run Codex review",
+        "  id: codex-review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("openai/codex-action")}`,
+        "  with:",
+        `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
+        '    permission-profile: ":read-only"',
+        "    prompt: |",
+        indentBlock(composePrompt4(input), 6)
+      ].join("\n"),
+      [
+        "- name: Post review comment",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    GH_TOKEN: ${{ github.token }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
+        "  run: |",
+        '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
+      ].join("\n")
+    ]
+  });
 }
 var gptProvider = {
   id: "gpt",
@@ -1038,13 +1107,14 @@ function buildReviewConfigConsistencyCheck(root, mainWorkflowPath, mainExists, c
       evidence: [mainWorkflowPath, CONFIG_PATH]
     });
   }
+  const earlierVersion = !/^ {2}review-comment:$/m.test(workflowContent);
   return createDoctorCheck({
     id: "review-config-consistency",
     label: "Review config/workflow consistency",
     status: "warning",
-    message: `${mainWorkflowPath} differs from what ${CONFIG_PATH}'s review options would generate`,
+    message: earlierVersion ? `${mainWorkflowPath} was generated by an earlier nx-archweave version: it installs dependencies in the job that holds the provider secret` : `${mainWorkflowPath} differs from what ${CONFIG_PATH}'s review options would generate`,
     evidence: [mainWorkflowPath, CONFIG_PATH],
-    suggestedAction: `Re-run the add-review generator with --onConflict=overwrite to re-sync ${mainWorkflowPath} with ${CONFIG_PATH}, or update ${CONFIG_PATH} to match the installed file.`
+    suggestedAction: earlierVersion ? `Re-run add-review --onConflict=overwrite to regenerate ${mainWorkflowPath}: the verdict then runs in a job without the secret, an OIDC token or install scripts. Edits you made to the file are replaced; the report shows the difference first.` : `Re-run the add-review generator with --onConflict=overwrite to re-sync ${mainWorkflowPath} with ${CONFIG_PATH}, or update ${CONFIG_PATH} to match the installed file.`
   });
 }