diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml index 992be236961..3cbb8da4d4d 100644 --- a/.github/workflows/grumpy-reviewer.lock.yml +++ b/.github/workflows/grumpy-reviewer.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"62d210b9cc5b49b94f709043e5c5b41cf7e106cbb1484efd12aaa4ca785d96c1","body_hash":"c0c142c9e7e4d9a4b63f4f086983066c6a20792a28fd6956df215e445e9e1526","compiler_version":"v0.86.2","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.79"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"3fd61dc673f0cff55470b3fa77e5646bbd2853a4ffa18152c83bfba011411577","body_hash":"c0c142c9e7e4d9a4b63f4f086983066c6a20792a28fd6956df215e445e9e1526","compiler_version":"v0.86.2","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.79"}} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"6aab9e5b5c91c615506061f09bedd81a23babe3c","version":"v0.86.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44","digest":"sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44","digest":"sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44","digest":"sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12c634be8c228a576832fe45f66c529ac3659db92bddbcf2eeb6d627"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.9","digest":"sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196","pinned_image":"ghcr.io/github/gh-aw-node@sha256:0d9f1fb5fd6610c0ac1f5194a38e45a8a1e81f8a390d5142d8e4e6f26a4b3196"},{"image":"ghcr.io/github/github-mcp-server:v1.9.0","digest":"sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e","pinned_image":"ghcr.io/github/github-mcp-server:v1.9.0@sha256:881b53d6f75f69bdbc1b5b10fc2f1361717c19054143b3a8529fb5c32061a50e"}],"has_pull_request_target":true} # This file was automatically generated by gh-aw (v0.86.2). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -23,7 +23,7 @@ # # For more information: https://github.github.com/gh-aw/introduction/overview/ # -# Grumpy senior code reviewer that automatically reviews the changed lines of every pull request (including community/fork PRs) and leaves grumpy-but- constructive inline review comments. Tone and reviewing standards are delegated to the imported grumpy-reviewer agent. +# Grumpy senior code reviewer that automatically reviews the changed lines of every same-repository pull request and leaves grumpy-but-constructive inline review comments. Tone and reviewing standards are delegated to the imported grumpy-reviewer agent. # # Resolved workflow manifest: # Imports: @@ -61,7 +61,6 @@ on: - opened - reopened - synchronize - # roles: all # Roles processed as role check in pre-activation job workflow_dispatch: inputs: aw_context: @@ -80,7 +79,11 @@ run-name: "Grumpy PR Reviewer" jobs: activation: - if: github.repository == 'ohcnetwork/care_fe' + needs: pre_activation + if: > + needs.pre_activation.outputs.activated == 'true' && (github.repository == 'ohcnetwork/care_fe' && + (github.event.pull_request == null || + github.event.pull_request.head.repo.full_name == github.repository)) runs-on: ubuntu-slim permissions: actions: read @@ -114,6 +117,8 @@ jobs: with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} + trace-id: ${{ needs.pre_activation.outputs.setup-trace-id }} + parent-span-id: ${{ needs.pre_activation.outputs.setup-parent-span-id || needs.pre_activation.outputs.setup-span-id }} safe-output-artifact-client: ${{ env.GH_AW_MAX_DAILY_AI_CREDITS != '' }} env: GH_AW_SETUP_WORKFLOW_NAME: "Grumpy PR Reviewer" @@ -311,6 +316,7 @@ jobs: GH_AW_GITHUB_RUN_ID: ${{ github.run_id }} GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }} GH_AW_MCP_CLI_SERVERS_LIST: "- `github` — run `github --help` to see available tools\n- `safeoutputs` — run `safeoutputs --help` to see available tools" + GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: ${{ needs.pre_activation.outputs.activated }} with: script: | const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); @@ -330,7 +336,8 @@ jobs: GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY, GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID, GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE, - GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST + GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST, + GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED: process.env.GH_AW_NEEDS_PRE_ACTIVATION_OUTPUTS_ACTIVATED } }); - name: Validate prompt placeholders @@ -1323,7 +1330,7 @@ jobs: uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: WORKFLOW_NAME: "Grumpy PR Reviewer" - WORKFLOW_DESCRIPTION: "Grumpy senior code reviewer that automatically reviews the changed lines of every pull request (including community/fork PRs) and leaves grumpy-but- constructive inline review comments. Tone and reviewing standards are delegated to the imported grumpy-reviewer agent." + WORKFLOW_DESCRIPTION: "Grumpy senior code reviewer that automatically reviews the changed lines of every same-repository pull request and leaves grumpy-but-constructive inline review comments. Tone and reviewing standards are delegated to the imported grumpy-reviewer agent." HAS_PATCH: ${{ needs.agent.outputs.has_patch }} GH_AW_DETECTION_CONTINUE_ON_ERROR: "true" with: @@ -1503,6 +1510,46 @@ jobs: } } + pre_activation: + if: > + github.repository == 'ohcnetwork/care_fe' && + (github.event.pull_request == null || + github.event.pull_request.head.repo.full_name == github.repository) + runs-on: ubuntu-slim + env: + GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} + outputs: + activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }} + matched_command: '' + setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }} + setup-span-id: ${{ steps.setup.outputs.span-id }} + setup-trace-id: ${{ steps.setup.outputs.trace-id }} + steps: + - name: Setup Scripts + id: setup + uses: github/gh-aw-actions/setup@6aab9e5b5c91c615506061f09bedd81a23babe3c # v0.86.2 + with: + destination: ${{ runner.temp }}/gh-aw/actions + job-name: ${{ github.job }} + env: + GH_AW_SETUP_WORKFLOW_NAME: "Grumpy PR Reviewer" + GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/grumpy-reviewer.lock.yml@${{ github.ref }} + GH_AW_INFO_VERSION: "1.0.79" + GH_AW_INFO_AWF_VERSION: "v0.27.44" + GH_AW_INFO_ENGINE_ID: "copilot" + - name: Check team membership for workflow + id: check_membership + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_REQUIRED_ROLES: "admin,maintainer,write" + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require('${{ runner.temp }}/gh-aw/actions/check_membership.cjs'); + await main(); + safe_outputs: needs: - activation diff --git a/.github/workflows/grumpy-reviewer.md b/.github/workflows/grumpy-reviewer.md index 8411556007f..e540c51f4a7 100644 --- a/.github/workflows/grumpy-reviewer.md +++ b/.github/workflows/grumpy-reviewer.md @@ -1,9 +1,9 @@ --- description: > Grumpy senior code reviewer that automatically reviews the changed lines of - every pull request (including community/fork PRs) and leaves grumpy-but- - constructive inline review comments. Tone and reviewing standards are - delegated to the imported grumpy-reviewer agent. + every same-repository pull request and leaves grumpy-but-constructive inline + review comments. Tone and reviewing standards are delegated to the imported + grumpy-reviewer agent. on: pull_request_target: types: @@ -11,21 +11,23 @@ on: - reopened - synchronize workflow_dispatch: - # Allow any contributor's pull request — including those from forks — to be - # reviewed. `pull_request_target` runs in the base-repository context, so the - # Copilot engine credentials are available even for fork PRs (a plain - # `pull_request` trigger would not expose them). The default role gate - # ([admin, maintainer, write]) would otherwise skip external contributors, so - # `all` is required to actually review community PRs. This is safe because the - # agent runs read-only via the safe-outputs pattern: it can only emit - # structured review comments that separate, permission-scoped jobs apply, so - # untrusted PR content can never gain write access to the repository. - roles: all -# Only run on the upstream repository. Forks don't have the Copilot engine -# credentials configured, so runs on forks would otherwise fail loudly and spam -# fork maintainers. This condition short-circuits every job cleanly (workflow -# shows as skipped, no error) on any repo other than ohcnetwork/care_fe. -if: ${{ github.repository == 'ohcnetwork/care_fe' }} +# Only run on the upstream repository, and only for pull requests whose branch +# lives in that same repository (i.e. NOT from a fork). Two reasons: +# 1. Forks don't have the Copilot engine credentials configured, so runs on a +# fork repo would fail loudly and spam fork maintainers. +# 2. Fork PRs carry untrusted content: the GitHub MCP server's integrity +# policy refuses to hand a fork PR's diff to the agent ("lower integrity +# than agent requires"), so the review can't be produced anyway. Skipping +# such PRs here — rather than starting the engine and letting it fail — is a +# clean no-op (the workflow shows as skipped, no billed run, no error +# issue) instead of a spurious "missing data" failure. +# `pull_request_target` runs in the base-repository context, so a same-repo PR's +# author already has write access; the default role gate ([admin, maintainer, +# write]) covers them without needing `roles: all`. +if: > + ${{ github.repository == 'ohcnetwork/care_fe' && + (github.event.pull_request == null || + github.event.pull_request.head.repo.full_name == github.repository) }} # The Copilot engine authenticates inference with the COPILOT_GITHUB_TOKEN repo # secret — a fine-grained PAT whose owner has a Copilot license and only the # "Copilot Requests: Read" account permission (no repo scopes). Reading the PR