@expo/code-review-cli 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/README.md +133 -50
  2. package/build/commands/ci.js +10 -6
  3. package/build/commands/doctor.js +57 -11
  4. package/build/commands/verify-config.js +65 -27
  5. package/build/config/load.js +50 -7
  6. package/build/config/schema.js +46 -16
  7. package/build/core/auth.js +209 -50
  8. package/build/core/coordinator.js +2 -2
  9. package/build/core/opencode.js +453 -53
  10. package/build/core/prompts.js +68 -7
  11. package/build/core/review.js +145 -32
  12. package/build/core/verify.js +4 -2
  13. package/package.json +3 -3
  14. package/templates/agents/security.md +4 -4
  15. package/templates/command.yml +11 -8
  16. package/templates/config.jsonc +26 -13
  17. package/templates/coordinator.md +3 -3
  18. package/templates/routing.jsonc +1 -1
  19. package/templates/workflow.yml +13 -8
package/templates/workflow.yml CHANGED
@@ -30,8 +30,12 @@ jobs:
30
30
  # the line below with, e.g.:
31
31
  # if: contains(github.event.pull_request.labels.*.name, 'ai-review')
32
32
  if: ${{ !contains(github.event.pull_request.labels.*.name, 'ai-review:skip') }}
33
- # Backstop so a stalled review fails fast instead of hanging.
34
- timeout-minutes: 60
33
+ # Backstop so a stalled review fails fast instead of hanging. This is the ONE cap
34
+ # with no soft landing (GitHub hard-kills the job and nothing is posted), so keep
35
+ # margin over the worst-case internal chain: the passes budget
36
+ # (budget.totalPassesMinutes, 55m — the cross-file pass expands to fill it) +
37
+ # coordinator (10m) + verification + CI setup.
38
+ timeout-minutes: 90
35
39
  # A reviewer failure must never fail the PR's checks.
36
40
  continue-on-error: true
37
41
  steps:
@@ -65,7 +69,8 @@ jobs:
65
69
  # from the registry — it never builds or executes the PR's code.
66
70
  - name: Guard config tokenEnv (root + routing + all scopes)
67
71
  env:
68
- ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'ANTHROPIC_OAUTH_API_KEY' }}
72
+ # (Comma-separated set for a multi-credential auth.providers config.)
73
+ ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'OPENAI_API_KEY' }}
69
74
  run: npx --yes -p "@expo/code-review-cli@$ECR_VERSION" ecr verify-config
70
75
 
71
76
  - name: Run AI review
@@ -79,11 +84,11 @@ jobs:
79
84
  # honor (root config.jsonc, or routing.jsonc defaults.auth) differs from
80
85
  # this — it catches what the guard step above can't. Keep it in sync
81
86
  # with the guard.
82
- ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'ANTHROPIC_OAUTH_API_KEY' }}
83
- # Claude Pro/Max OAuth token (from `claude setup-token`) — the env var
84
- # named by auth.tokenEnv in config.jsonc. Store it as a repo secret.
85
- # (For an API key instead, set auth.mode "api-key" and pass that key here.)
86
- ANTHROPIC_OAUTH_API_KEY: ${{ secrets.ANTHROPIC_OAUTH_API_KEY }}
87
+ ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'OPENAI_API_KEY' }}
88
+ # OpenAI API key — the env var named by auth.tokenEnv in config.jsonc.
89
+ # Store it as a repo secret; a project-scoped key restricted to model
90
+ # inference (with a spend limit) is all the reviewer needs.
91
+ OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
87
92
  # Optional: override the model for every agent (uses your OpenCode login).
88
93
  REVIEWER_MODEL: ${{ vars.REVIEWER_MODEL }}
89
94