openobserve/.github/workflows/ai-code-review.yml

name: AI Code Review

on:
  pull_request:
    # labeled/unlabeled so adding or removing 'ready-for-ci' starts or resets the review.
    types: [opened, synchronize, reopened, labeled, unlabeled, ready_for_review, converted_to_draft]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to review"
        required: true
        type: string
      force_full:
        description: "Force full review tier (ignore risk assessment)"
        required: false
        type: boolean
        default: false

jobs:
  review:
    # Paid CI runs only on PRs carrying the 'ready-for-ci' label; the merge queue runs unit tests on the merged code.
    if: ${{ github.event_name != 'pull_request' || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false) }}
    # Explicit name: without it GitHub serializes the whole matrix object (api_key_env, marker) into the public check name.
    name: review (${{ matrix.provider.name }})
    runs-on: ubuntu-latest
    timeout-minutes: 25
    # Concurrency is per-job (not workflow-level) so it can see `matrix`: keyed per-PR AND
    # per-provider, so provider legs get independent groups and don't cancel each other.
    concurrency:
      group: ai-review-${{ matrix.provider.name }}-${{ github.event.pull_request.number || github.event.inputs.pr_number }}
      cancel-in-progress: true
    permissions:
      contents: read
      pull-requests: write
      issues: write
      actions: read
    strategy:
      # One provider's failure shouldn't sink the others.
      fail-fast: false
      matrix:
        # DeepSeek-V4-Pro is the sole reviewer (the GLM-5.2 head-to-head has ended).
        # Markers must not name the model: they ship inside the posted PR comment. Adding a
        # provider? Give it a distinct `<!-- ai-code-review-<suffix> -->` marker — run-review.mjs
        # matches that shape, so two legs sharing one marker overwrite each other's comment.
        provider:
          - name: deepseek
            provider_id: deepseek-review
            model_id: deepseek-v4-pro
            model_variant: ""
            api_key_env: DEEPSEEK_API_KEY
            marker: "<!-- ai-code-review -->"
    steps:
      # Debounce: a push inside this window cancels the run (concurrency) before anything paid starts.
      - if: github.event_name == 'pull_request'
        run: sleep 60
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 1

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: scripts/ai-review/package-lock.json

      - name: Install AI review dependencies
        working-directory: scripts/ai-review
        run: npm ci

      - name: Install opencode
        env:
          # Pinned so an upstream opencode release can't silently change review behavior
          # (agent/tool semantics, prompt handling) underneath this workflow. Bump
          # deliberately after testing against scripts/ai-review locally.
          OPENCODE_VERSION: "1.17.13"
        run: |
          curl -fsSL https://opencode.ai/install | bash -s -- --version "$OPENCODE_VERSION"
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"

      - name: Set trace ID
        run: echo "O2_TRACE_ID=$(openssl rand -hex 16)" >> "$GITHUB_ENV"

      - name: Set PR number
        id: pr
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "pr_number=${{ github.event.inputs.pr_number }}" >> "$GITHUB_OUTPUT"
          else
            echo "pr_number=${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for skip marker
        id: skip
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          PR_NUMBER="${{ steps.pr.outputs.pr_number }}"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "skip_review=false" >> "$GITHUB_OUTPUT"
            echo "force_full=${{ github.event.inputs.force_full || 'false' }}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Check PR body and comments for skip markers
          PR_BODY=$(gh pr view "$PR_NUMBER" --json body --jq '.body' 2>/dev/null || echo "")
          COMMENTS=$(gh api "repos/${{ github.repository }}/issues/$PR_NUMBER/comments" --jq '.[].body' 2>/dev/null || echo "")

          if echo "$PR_BODY$COMMENTS" | grep -qiE '\[skip (ai )?review\]|\[skip ci\]|break glass'; then
            echo "Skip marker found. Skipping AI review."
            echo "skip_review=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip_review=false" >> "$GITHUB_OUTPUT"
          fi
          echo "force_full=false" >> "$GITHUB_OUTPUT"

      # Mint a GitHub App installation token so the review comment is authored by the
      # "OpenObserve Code Reviewer" app (branded name + avatar) instead of github-actions[bot].
      # Gated on the OO_REVIEWER_APP_ID repo/org variable: if the app isn't configured the step is
      # skipped. `continue-on-error` makes it fail-safe even when the variable IS set but the app
      # isn't installed yet (or the key is wrong): minting fails, the token output is empty, and
      # the run step's `|| github.token` fallback posts as github-actions[bot] instead of breaking
      # CI. So this is safe at every rollout stage; it auto-activates once the app is installed and
      # OO_REVIEWER_APP_ID + OO_REVIEWER_APP_PRIVATE_KEY are provisioned.
      - name: Generate OpenObserve Code Reviewer app token
        id: app_token
        if: ${{ steps.skip.outputs.skip_review == 'false' && vars.OO_REVIEWER_APP_ID != '' }}
        continue-on-error: true
        # Pinned to a full commit SHA (not a mutable tag) because this action receives the app's
        # signing private key — a repointed/compromised release could exfiltrate it. Same pin
        # discipline as OPENCODE_VERSION above. Bump deliberately after review.
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.OO_REVIEWER_APP_ID }}
          private-key: ${{ secrets.OO_REVIEWER_APP_PRIVATE_KEY }}

      - name: Run AI Code Review
        if: steps.skip.outputs.skip_review == 'false'
        env:
          # App token when the app is configured (comment posts as OpenObserve Code Reviewer),
          # else github.token (posts as github-actions[bot]). Same engine either way.
          GH_TOKEN: ${{ steps.app_token.outputs.token || github.token }}
          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
          FORCE_FULL: ${{ steps.skip.outputs.force_full }}
          # Provider selection for this matrix leg (see run-review.mjs for how these are used).
          REVIEW_PROVIDER_ID: ${{ matrix.provider.provider_id }}
          REVIEW_MODEL_ID: ${{ matrix.provider.model_id }}
          REVIEW_MODEL_VARIANT: ${{ matrix.provider.model_variant }}
          REVIEW_API_KEY_ENV: ${{ matrix.provider.api_key_env }}
          REVIEW_MARKER: ${{ matrix.provider.marker }}
          # run-review.mjs reads only the key named by REVIEW_API_KEY_ENV.
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
          O2_TRACE_INGEST_URL: ${{ secrets.O2_TRACE_INGEST_URL }}
          O2_TRACE_ORG: ${{ secrets.O2_TRACE_ORG }}
          O2_TRACE_USERNAME: ${{ secrets.O2_TRACE_USERNAME }}
          O2_TRACE_PASSWORD: ${{ secrets.O2_TRACE_PASSWORD }}
          O2_TRACE_AUTH: ${{ secrets.O2_TRACE_AUTH }}
          O2_TRACE_STREAM: ${{ secrets.O2_TRACE_STREAM }}
          O2_TRACE_EXPORT_TIMEOUT_MS: ${{ vars.O2_TRACE_EXPORT_TIMEOUT_MS }}
          O2_TRACE_EXPORT_BATCH_SIZE: ${{ vars.O2_TRACE_EXPORT_BATCH_SIZE }}
        run: node scripts/ai-review/run-review.mjs

      - name: Log skip
        if: steps.skip.outputs.skip_review == 'true'
        run: echo "AI Code Review skipped due to skip marker or break glass"