.github/workflows/opencode-review.yml

name: OpenCode Review

on:
  issue_comment:
    types: [created]

permissions:
  pull-requests: write
  contents: read
  issues: write

jobs:
  code-review:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    if: >-
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '/review') &&
      (
        github.event.comment.author_association == 'MEMBER' ||
        github.event.comment.author_association == 'OWNER' ||
        github.event.comment.author_association == 'COLLABORATOR'
      )
    steps:
      - name: Get PR info
        id: pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PR_JSON=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.issue.number }})
          HEAD_SHA=$(echo "$PR_JSON" | jq -r '.head.sha')
          BASE_SHA=$(echo "$PR_JSON" | jq -r '.base.sha')
          HEAD_REF=$(echo "$PR_JSON" | jq -r '.head.ref')
          BASE_REF=$(echo "$PR_JSON" | jq -r '.base.ref')
          echo "head_sha=$HEAD_SHA" >> "$GITHUB_OUTPUT"
          echo "base_sha=$BASE_SHA" >> "$GITHUB_OUTPUT"
          echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"
          echo "base_ref=$BASE_REF" >> "$GITHUB_OUTPUT"

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.pr.outputs.head_sha }}
          fetch-depth: 0

      - name: Install OpenCode
        run: |
          for attempt in 1 2 3; do
            if curl -fsSL https://opencode.ai/install | bash; then
              echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"
              exit 0
            fi
            echo "Install attempt $attempt failed, retrying in 10s..."
            sleep 10
          done
          echo "All install attempts failed"
          exit 1

      - name: Install ossutil
        run: |
          tmp_dir="$(mktemp -d)"
          trap 'rm -rf "$tmp_dir"' EXIT
          curl -fsSL -o "$tmp_dir/ossutil.zip" https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip
          unzip -q "$tmp_dir/ossutil.zip" -d "$tmp_dir"
          sudo install -m 0755 "$tmp_dir/ossutil-v1.7.19-linux-amd64/ossutil" /usr/local/bin/ossutil

      - name: Configure OpenCode auth
        id: configure-auth
        env:
          OSS_AK: ${{ secrets.OSS_AK }}
          OSS_SK: ${{ secrets.OSS_SK }}
          OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
          OSS_AUTH_OBJECT: oss://doris-community-ci/auth.json
        run: |
          mkdir -p ~/.local/share/opencode
          ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f "$OSS_AUTH_OBJECT" ~/.local/share/opencode/auth.json
          chmod 600 ~/.local/share/opencode/auth.json
          test -s ~/.local/share/opencode/auth.json

      - name: Configure OpenCode permission
        run: |
          echo '{"permission":"allow"}' > opencode.json

      - name: Prepare review prompt
        run: |
          cat > /tmp/review_prompt.txt <<'PROMPT'
          You are performing an automated code review inside a GitHub Actions runner. The gh CLI is available and authenticated via GH_TOKEN. You can inspect git history, view diffs, run local validation commands, and comment on the pull request.

          Context:
          - Repository: PLACEHOLDER_REPO
          - PR number: PLACEHOLDER_PR_NUMBER
          - PR Head SHA: PLACEHOLDER_HEAD_SHA
          - PR Base SHA: PLACEHOLDER_BASE_SHA

          Read `AGENTS.md` in the repository root. It is the sole review guide; follow it strictly.

          Submission:
          - After completing the review, provide a final summary that includes conclusions for every applicable critical checkpoint required by `AGENTS.md`.
          - If no issues are found, submit a short summary comment with `gh pr comment PLACEHOLDER_PR_NUMBER --body "<summary>"`.
          - If issues are found, submit a review with inline comments plus a comprehensive summary body using the GitHub Reviews API.
          - Build a JSON array of comments like: [{ "path": "<file>", "position": <diff_position>, "body": "..." }]
          - Submit via: `gh api repos/PLACEHOLDER_REPO/pulls/PLACEHOLDER_PR_NUMBER/reviews --input <json_file>`
          - The JSON file should contain: {"event":"COMMENT","body":"<summary>","comments":[...]}
          - Do not use `gh pr review --approve` or `gh pr review --request-changes`.
          PROMPT
          sed -i "s|PLACEHOLDER_REPO|${REPO}|g" /tmp/review_prompt.txt
          sed -i "s|PLACEHOLDER_PR_NUMBER|${PR_NUMBER}|g" /tmp/review_prompt.txt
          sed -i "s|PLACEHOLDER_HEAD_SHA|${HEAD_SHA}|g" /tmp/review_prompt.txt
          sed -i "s|PLACEHOLDER_BASE_SHA|${BASE_SHA}|g" /tmp/review_prompt.txt
        env:
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.issue.number }}
          HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
          BASE_SHA: ${{ steps.pr.outputs.base_sha }}

      - name: Run automated code review
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PROMPT=$(cat /tmp/review_prompt.txt)
          opencode run "$PROMPT" -m "openai/gpt-5.5"

      - name: Persist OpenCode auth
        if: ${{ always() && steps.configure-auth.outcome == 'success' }}
        env:
          OSS_AK: ${{ secrets.OSS_AK }}
          OSS_SK: ${{ secrets.OSS_SK }}
          OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
          OSS_AUTH_OBJECT: oss://doris-community-ci/auth.json
        run: |
          if [ ! -s ~/.local/share/opencode/auth.json ]; then
            echo "::warning::OpenCode auth file is missing or empty; skip OSS auth persistence."
            exit 0
          fi

          if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f ~/.local/share/opencode/auth.json "$OSS_AUTH_OBJECT"; then
            echo "::warning::Failed to persist OpenCode auth to OSS; continue because review already finished."
          fi