@expo/code-review-cli 0.2.3 → 0.4.0

package/templates/workflow.yml

@@ -17,36 +17,30 @@ concurrency:
 jobs:
   review:
     runs-on: ubuntu-latest
-    # Opt-in per PR: only run when the `ai-review` label is present. Remove this
-    # line to review every PR automatically.
-    if: contains(join(github.event.pull_request.labels.*.name, ','), 'ai-review')
+    env:
+      # Version of the published engine used for BOTH the guard and the review, so
+      # the guard that clears a config is the same engine that then reads it. Override
+      # with repo variable ECR_VERSION; pin to a specific version to freeze it.
+      ECR_VERSION: ${{ vars.ECR_VERSION || 'latest' }}
+    # Trigger policy lives in .expo-code-review/config.jsonc (review.trigger); `ecr ci`
+    # self-gates on it (and honors the ai-review:skip label). This coarse gate just
+    # avoids spinning up a runner for a PR that explicitly opted out. Uses the array
+    # form of contains() for an EXACT label match ("ai-review:skip" is not "ai-review").
+    # Prefer to gate entirely here instead? Set config trigger to "label" and replace
+    # the line below with, e.g.:
+    #   if: contains(github.event.pull_request.labels.*.name, 'ai-review')
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ai-review:skip') }}
     # Backstop so a stalled review fails fast instead of hanging.
     timeout-minutes: 60
     # A reviewer failure must never fail the PR's checks.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Shallow is enough — the reviewer gets the diff from the API (`gh`).
           fetch-depth: 1
 
-      # SECURITY: this workflow checks out the PR's code, including
-      # .expo-code-review/config.jsonc, whose auth.tokenEnv names the env var the CLI
-      # forwards as the model credential. Refuse to run unless it's the expected value
-      # (below / repo var ECR_EXPECTED_TOKEN_ENV) so a PR can't repoint it at another
-      # secret in the runner. Keep this in sync with auth.tokenEnv in config.jsonc.
-      - name: Guard config.jsonc tokenEnv
-        env:
-          EXPECTED: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'ANTHROPIC_OAUTH_API_KEY' }}
-        run: |
-          values=$(grep -oE '"tokenEnv"[[:space:]]*:[[:space:]]*"[A-Za-z0-9_]+"' .expo-code-review/config.jsonc | sed -E 's/.*"([A-Za-z0-9_]+)"$/\1/')
-          count=$(printf '%s\n' "$values" | grep -c .)
-          if [ "$count" != "1" ] || [ "$values" != "$EXPECTED" ]; then
-            echo "::error::.expo-code-review/config.jsonc auth.tokenEnv must be \"$EXPECTED\" (found: \"${values:-none}\"). Refusing to run so a PR can't redirect which secret is forwarded to the model provider."
-            exit 1
-          fi
-
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           # The reviewer runs via npx and never installs with a package manager, so
@@ -54,16 +48,57 @@ jobs:
           # to save an empty cache and error).
           package-manager-cache: false
 
+      # SECURITY: this workflow checks out the PR's code, including every
+      # .expo-code-review/config.jsonc + routing.jsonc, whose auth.tokenEnv names the
+      # env var the CLI forwards as the model credential. The canonical guard ships
+      # with the CLI: `ecr verify-config` sweeps every config (root + routing + all
+      # scopes, referenced or not) with the engine's real JSONC parser and refuses
+      # unless tokenEnv appears exactly once, in a ROOT-owned file, equal to the
+      # expected value (repo var ECR_EXPECTED_TOKEN_ENV) — so a PR can't repoint it at
+      # another runner secret, sneak in a JSON-escaped key, or stage an unreferenced
+      # scope config with its own auth. This is layer 2; layer 1 is the runtime
+      # ECR_EXPECTED_TOKEN_ENV lock in `ecr ci` itself, so guard/loader drift fails safe.
+      #
+      # This step MUST run BEFORE `ecr ci` (before any PR code is built or loaded).
+      # Only setup-node (runtime install) precedes it; running the PUBLISHED package
+      # via npx is safe pre-review because npx fetches @expo/code-review-cli@$ECR_VERSION
+      # from the registry — it never builds or executes the PR's code.
+      - name: Guard config tokenEnv (root + routing + all scopes)
+        env:
+          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'ANTHROPIC_OAUTH_API_KEY' }}
+        run: npx --yes -p "@expo/code-review-cli@$ECR_VERSION" ecr verify-config
+
       - name: Run AI review
         # npx installs @expo/code-review-cli and its bundled `opencode` binary and
-        # puts them on PATH for this process. Pin @latest to a version to freeze it.
-        run: npx --yes -p "@expo/code-review-cli@latest" ecr ci
+        # puts them on PATH for this process — the SAME $ECR_VERSION the guard cleared.
+        run: npx --yes -p "@expo/code-review-cli@$ECR_VERSION" ecr ci
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Layer-1 auth lock: the CLI refuses to run when the tokenEnv it would
+          # honor (root config.jsonc, or routing.jsonc defaults.auth) differs from
+          # this — it catches what the guard step above can't. Keep it in sync
+          # with the guard.
+          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'ANTHROPIC_OAUTH_API_KEY' }}
           # Claude Pro/Max OAuth token (from `claude setup-token`) — the env var
           # named by auth.tokenEnv in config.jsonc. Store it as a repo secret.
           # (For an API key instead, set auth.mode "api-key" and pass that key here.)
           ANTHROPIC_OAUTH_API_KEY: ${{ secrets.ANTHROPIC_OAUTH_API_KEY }}
           # Optional: override the model for every agent (uses your OpenCode login).
           REVIEWER_MODEL: ${{ vars.REVIEWER_MODEL }}
+
+      # Observability: the per-run log (token/cache/cost totals + per-pass timing +
+      # coverage notes) is written under .expo-code-review/.runs/ but git-ignored, so
+      # in CI it is otherwise ephemeral — gone when the runner is torn down. Upload it
+      # as an artifact so a reviewer run can be inspected after the fact (why a finding
+      # did/didn't surface, cache-reuse, spend). always() so it is captured even when
+      # the review step timed out or errored; if-no-files-found: ignore because a run
+      # that failed before writing the log (or a no-op skip) legitimately has no file.
+      - name: Upload review run log
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: review-run-log-pr${{ github.event.pull_request.number }}
+          path: .expo-code-review/.runs/reviews.jsonl
+          if-no-files-found: ignore
+          retention-days: 14