.github/workflows/opencode-review.yml

name: OpenCode Review

on:
  issue_comment:
    types: [created]

permissions:
  contents: read
  pull-requests: read

# One shared OAuth snapshot: do not race refresh-token persistence.
concurrency:
  group: opencode-review-auth
  cancel-in-progress: false

jobs:
  authorize:
    if: github.event.issue.pull_request && contains(github.event.comment.body, '/review')
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      allowed: ${{ steps.authorize.outputs.allowed }}
      number: ${{ steps.authorize.outputs.number }}
      head_sha: ${{ steps.authorize.outputs.head_sha }}
      base_sha: ${{ steps.authorize.outputs.base_sha }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - name: Check the exact command and repository write permission
        id: authorize
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 .github/scripts/review.py authorize --command /review

  analyze:
    needs: authorize
    if: needs.authorize.outputs.allowed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
      BASE_SHA: ${{ needs.authorize.outputs.base_sha }}
    steps:
      - name: Checkout trusted orchestration only
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          filter: blob:none
          persist-credentials: false
      - name: Fetch reviewed objects without checking out PR code
        run: git fetch --no-tags origin "$BASE_SHA" "$HEAD_SHA"
      - name: Prepare bounded text input from Git objects
        run: python3 .github/scripts/review.py packet --output "$RUNNER_TEMP/review-prompt.txt"
      - name: Install checksum-verified OpenCode and ossutil
        run: |
          set -euo pipefail
          tools="$RUNNER_TEMP/review-tools"
          mkdir -p "$tools"
          curl --fail --silent --show-error --location --retry 3 \
            https://github.com/anomalyco/opencode/releases/download/v1.19.3/opencode-linux-x64.tar.gz \
            --output "$tools/opencode.tar.gz"
          echo "13a8fb2978302071b86f9d7e00da9c8895f9cd846978379c3bdc6a5333536c9b  $tools/opencode.tar.gz" | sha256sum --check
          tar -xzf "$tools/opencode.tar.gz" -C "$tools"
          curl --fail --silent --show-error --location --retry 3 \
            https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip \
            --output "$tools/ossutil.zip"
          echo "dcc512e4a893e16bbee63bc769339d8e56b21744fd83c8212a9d8baf28767343  $tools/ossutil.zip" | sha256sum --check
          unzip -q "$tools/ossutil.zip" -d "$tools"
      - name: Load and mask the OpenCode auth snapshot
        id: auth
        env:
          OSS_AK: ${{ secrets.OSS_AK }}
          OSS_SK: ${{ secrets.OSS_SK }}
        run: |
          set -euo pipefail
          umask 077
          runtime="$RUNNER_TEMP/opencode-review"
          mkdir -p "$runtime/data/opencode"
          "$RUNNER_TEMP/review-tools/ossutil-v1.7.19-linux-amd64/ossutil" \
            -i "$OSS_AK" -k "$OSS_SK" -e oss-cn-hongkong.aliyuncs.com \
            cp -f oss://doris-community-ci/auth.json "$runtime/data/opencode/auth.json"
          python3 .github/scripts/review.py mask-auth --input "$runtime/data/opencode/auth.json"
      - name: Run a text-only review without external plugins or inherited secrets
        run: |
          mkdir -p "$RUNNER_TEMP/review-result"
          python3 .github/scripts/review.py model \
            --binary "$RUNNER_TEMP/review-tools/opencode" \
            --runtime "$RUNNER_TEMP/opencode-review" \
            --input "$RUNNER_TEMP/review-prompt.txt" \
            --output "$RUNNER_TEMP/review-result/review.json"
      - name: Persist refreshed authentication
        if: always() && steps.auth.outcome == 'success'
        env:
          OSS_AK: ${{ secrets.OSS_AK }}
          OSS_SK: ${{ secrets.OSS_SK }}
        run: |
          set -euo pipefail
          auth="$RUNNER_TEMP/opencode-review/data/opencode/auth.json"
          python3 .github/scripts/review.py mask-auth --input "$auth"
          "$RUNNER_TEMP/review-tools/ossutil-v1.7.19-linux-amd64/ossutil" \
            -i "$OSS_AK" -k "$OSS_SK" -e oss-cn-hongkong.aliyuncs.com \
            cp -f "$auth" oss://doris-community-ci/auth.json
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: opencode-review-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/review-result/review.json
          if-no-files-found: error
          retention-days: 7

  publish:
    needs: [authorize, analyze]
    if: needs.authorize.outputs.allowed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
    env:
      PR_NUMBER: ${{ needs.authorize.outputs.number }}
      HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
      BASE_SHA: ${{ needs.authorize.outputs.base_sha }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          filter: blob:none
          persist-credentials: false
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: opencode-review-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/review-result
      - name: Fetch reviewed objects without checking out PR code
        run: git fetch --no-tags origin "$BASE_SHA" "$HEAD_SHA"
      - name: Validate the result and publish for the reviewed commit
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 .github/scripts/review.py publish --kind code --input "$RUNNER_TEMP/review-result/review.json"