@tutar/graph-engineering 0.3.0

package/templates/pr-review/.github/workflows/github-pr-review.yml

@@ -0,0 +1,138 @@
+name: Graph Engineering PR Review
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      pull_request_number:
+        description: Pull request number to review
+        required: true
+        type: number
+      event_prompt:
+        description: Review objective placed at the start of the Goal Prompt
+        required: false
+        default: Review this change against the repository rules and its requested behavior.
+        type: string
+
+concurrency:
+  group: ${{ github.repository }}:pull-request:${{ github.event.pull_request.number || inputs.pull_request_number }}
+  cancel-in-progress: false
+
+jobs:
+  route:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      should_start: ${{ steps.route.outputs.should_start }}
+      pull_request_number: ${{ steps.route.outputs.pull_request_number }}
+      event_prompt: ${{ steps.route.outputs.event_prompt }}
+      codex_model: ${{ steps.route.outputs.codex_model }}
+      codex_effort: ${{ steps.route.outputs.codex_effort }}
+      safety_strategy: ${{ steps.route.outputs.safety_strategy }}
+    steps:
+      - name: Check out the trusted router
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - name: Route the GitHub Event
+        id: route
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node .github/graph-engineering/route-review.mjs
+
+  review:
+    needs: route
+    if: >-
+      needs.route.outputs.should_start == 'true' &&
+      (github.event_name != 'workflow_dispatch' ||
+      github.ref == format('refs/heads/{0}', github.event.repository.default_branch))
+    runs-on: [self-hosted, Linux, X64, codex]
+    permissions:
+      contents: read
+      pull-requests: read
+      checks: read
+    steps:
+      - name: Check out the trusted review control plane
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          path: .graph-engineering-trusted
+          persist-credentials: false
+      - name: Read trusted PR facts and form the Goal Prompt
+        id: target
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PULL_REQUEST_NUMBER: ${{ needs.route.outputs.pull_request_number }}
+          EVENT_PROMPT: ${{ needs.route.outputs.event_prompt }}
+        run: node .graph-engineering-trusted/.github/graph-engineering/prepare-review.mjs
+      - name: Check out the trusted PR target
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ steps.target.outputs.head_sha }}
+          path: review-workspace
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Run the Codex Compatible Executor
+        id: codex
+        continue-on-error: true
+        uses: tutar/codex-action@f33581290086e62dc34d420a7f1862477fc2b503 # maintained runner-login patch
+        with:
+          prompt-file: ${{ github.workspace }}/pr-review-goal.md
+          output-schema-file: ${{ github.workspace }}/.graph-engineering-trusted/.github/graph-engineering/review-result.schema.json
+          working-directory: ${{ github.workspace }}/review-workspace
+          codex-version: 0.153.4
+          model: ${{ needs.route.outputs.codex_model }}
+          effort: ${{ needs.route.outputs.codex_effort }}
+          safety-strategy: ${{ needs.route.outputs.safety_strategy }}
+      - name: Map the Action terminal and final-message
+        if: always()
+        env:
+          ACTION_OUTCOME: ${{ steps.codex.outcome }}
+          FINAL_MESSAGE: ${{ steps.codex.outputs.final-message }}
+          TRUSTED_TARGET: ${{ steps.target.outputs.target_json }}
+        run: node .graph-engineering-trusted/.github/graph-engineering/capture-review.mjs
+      - name: Preserve the trusted target and candidate Review Result
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: pr-review-result
+          path: |
+            pr-review-target.json
+            pr-review-context.md
+            review-execution.json
+            review-result.json
+          if-no-files-found: error
+
+  publish:
+    needs: [route, review]
+    if: >-
+      always() &&
+      needs.route.result == 'success' &&
+      needs.route.outputs.should_start == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: read
+      checks: write
+    steps:
+      - name: Check out the trusted publisher
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          path: .graph-engineering-publisher
+          persist-credentials: false
+      - name: Download the candidate Review Result
+        continue-on-error: true
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: pr-review-result
+          path: pr-review-artifact
+      - name: Validate and publish the Check Run
+        env:
+          GH_TOKEN: ${{ github.token }}
+          UPSTREAM_RESULT: ${{ needs.review.result }}
+        run: node .graph-engineering-publisher/.github/graph-engineering/publish-review.mjs