From 47196830920b4350b4aaea75171586ab55b4544a Mon Sep 17 00:00:00 2001 From: He Wang Date: Thu, 16 Jul 2026 19:39:05 +0800 Subject: [PATCH] ci(review): add OpenCode pull request workflow ci: - Run OpenCode reviews for same-repository pull requests targeting main - Enable clean-review approval and debug logging - Allow Dependabot reviews to use an optional write-capable token docs: - Document GitHub Actions, approval, and Dependabot credential setup --- .github/workflows/code-review.yml | 64 +++++++++++++++++++++++++++++++ AGENTS.md | 11 ++++++ docker/README.md | 33 ++++++++++++++++ 3 files changed, 108 insertions(+) create mode 100644 .github/workflows/code-review.yml diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml new file mode 100644 index 0000000..e01697c --- /dev/null +++ b/.github/workflows/code-review.yml @@ -0,0 +1,64 @@ +name: Code review + +on: + pull_request: + branches: + - main + types: + - opened + - synchronize + - reopened + - ready_for_review + +concurrency: + group: code-review-${{ github.event.pull_request.number }} + cancel-in-progress: true + +permissions: + contents: read + pull-requests: write + +jobs: + review: + name: OpenCode review + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.draft == false + runs-on: ubuntu-latest + timeout-minutes: 60 + steps: + - name: Run code review + env: + AUTO_APPROVE_ON_CLEAN_REVIEW: "true" + GIT_PLATFORM_TYPE: github + GIT_REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git + GIT_REPO_TOKEN: ${{ secrets.CODE_REVIEW_GITHUB_TOKEN || github.token }} + LOG_LEVEL: DEBUG + OPENCODE_UPSTREAM_ENDPOINT: ${{ vars.OPENCODE_UPSTREAM_ENDPOINT }} + OPENCODE_UPSTREAM_API_KEY: ${{ secrets.OPENCODE_UPSTREAM_API_KEY }} + OPENCODE_MODEL: ${{ vars.OPENCODE_MODEL }} + run: | + set -euo pipefail + + for name in \ + OPENCODE_UPSTREAM_ENDPOINT \ + OPENCODE_UPSTREAM_API_KEY \ + OPENCODE_MODEL + do + if [ -z "${!name:-}" ]; then + echo "::error::Missing GitHub Actions configuration: ${name}" + exit 1 + fi + done + + docker run --rm \ + -e AUTO_APPROVE_ON_CLEAN_REVIEW \ + -e GIT_PLATFORM_TYPE \ + -e GIT_REPO_URL \ + -e GIT_REPO_TOKEN \ + -e LOG_LEVEL \ + -e OPENCODE_UPSTREAM_ENDPOINT \ + -e OPENCODE_UPSTREAM_API_KEY \ + -e OPENCODE_MODEL \ + whhe/code-review-bot:opencode \ + --cr-id "${{ github.event.pull_request.number }}" diff --git a/AGENTS.md b/AGENTS.md index 3a8941a..d0296b7 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -148,3 +148,14 @@ commands; the bot does not enumerate agent instruction files. Git clone and fetc credential helper so tokens are never embedded in workspace URLs or Git metadata. The agent factory explicitly forwards only the required OpenCode runtime environment through ACP's filtered subprocess environment. Existing global config files are left untouched. + +`.github/workflows/code-review.yml` runs `whhe/code-review-bot:opencode` for non-draft, +same-repository pull requests targeting `main` and skips fork pull requests. Dependabot pull +requests are allowed to run, but GitHub does not provide Actions secrets and grants the built-in +`GITHUB_TOKEN` read-only permissions for those runs. The workflow therefore prefers an optional +`CODE_REVIEW_GITHUB_TOKEN` secret and falls back to the built-in token; Dependabot reviews require +same-named Dependabot secrets for that write-capable token and `OPENCODE_UPSTREAM_API_KEY`. The +workflow uses repository variables for `OPENCODE_UPSTREAM_ENDPOINT` and `OPENCODE_MODEL`. +It enables clean-review approval with `AUTO_APPROVE_ON_CLEAN_REVIEW=true` and debug logging with +`LOG_LEVEL=DEBUG`; the repository must allow GitHub Actions to create and approve pull requests for +the built-in token to approve a clean review. diff --git a/docker/README.md b/docker/README.md index 88f18ba..aaa5846 100644 --- a/docker/README.md +++ b/docker/README.md @@ -173,6 +173,39 @@ The image `ENTRYPOINT` runs bootstrap setup then `exec`s the job command. GitLab `GITLAB_TOKEN` and `ANTHROPIC_API_KEY` as masked CI/CD variables in that project's settings. Optionally set `ANTHROPIC_MODEL`. +### GitHub Actions + +The repository includes `.github/workflows/code-review.yml`, which reviews pull requests targeting +`main` with `whhe/code-review-bot:opencode`. Configure these values under **Settings → Secrets and +variables → Actions** before enabling the workflow: + +| Type | Name | Description | +|---|---|---| +| Repository variable | `OPENCODE_UPSTREAM_ENDPOINT` | OpenAI-compatible API base URL | +| Repository variable | `OPENCODE_MODEL` | Upstream model ID | +| Repository secret | `OPENCODE_UPSTREAM_API_KEY` | Upstream API credential | + +The workflow sets `AUTO_APPROVE_ON_CLEAN_REVIEW=true` and `LOG_LEVEL=DEBUG`. Under **Settings → +Actions → General → Workflow permissions**, enable **Allow GitHub Actions to create and approve +pull requests** so clean reviews can be approved with the built-in `GITHUB_TOKEN`. + +The workflow runs for opened, updated, reopened, and ready-for-review pull requests. It uses the +built-in `GITHUB_TOKEN` with `contents: read` and `pull-requests: write`. The workflow itself does +not check out or directly execute the pull-request branch, and it skips draft and fork pull +requests. Fork pull requests are skipped because GitHub does not expose repository secrets to +their `pull_request` workflows; branches inside the repository should therefore be limited to +trusted collaborators. Dependabot pull requests are not skipped, but GitHub supplies Dependabot +secrets instead of Actions secrets and gives the built-in `GITHUB_TOKEN` read-only permissions for +those runs. To review them, add these values under **Settings → Secrets and variables → +Dependabot**: + +| Name | Description | +|---|---| +| `OPENCODE_UPSTREAM_API_KEY` | The same upstream API credential used by regular reviews | +| `CODE_REVIEW_GITHUB_TOKEN` | Fine-grained token limited to this repository, with Contents read and Pull requests write permissions | + +Regular pull requests use the built-in `GITHUB_TOKEN` when `CODE_REVIEW_GITHUB_TOKEN` is absent. + ### Other platforms Adapt the example above to your platform's workflow syntax. Any CI environment that can run a