commitreview.yml

# commitreview reviewing commitreview. It uses the last released major rather
# than executing code from the pull request under review.
name: commitreview

on:
  pull_request_target:
    types: [opened, synchronize, reopened]
  issue_comment:
    types: [created]

permissions:
  contents: read
  pull-requests: write

concurrency:
  group: commitreview-${{ github.event.pull_request.number || github.event.issue.number }}
  cancel-in-progress: true

jobs:
  review:
    if: >-
      github.event_name == 'pull_request_target' ||
      (github.event.issue.pull_request && contains(github.event.comment.body, '@commitreview'))
    runs-on: ubuntu-latest
    steps:
      - uses: dymoo/commitreview@v2
        with:
          api-key: ${{ secrets.LLM_API_KEY }}
          base-url: ${{ vars.LLM_BASE_URL }}
          model: ${{ vars.LLM_MODEL }}
          instructions: |
            This action has no runtime dependencies. Any import that is not
            from node: or a relative src/ path is a finding.
            Anchoring, chunking and JSON extraction require tests when changed.