AI code review

name: "AI Review Command"

# Chatops for the AI review: the PR author comments `/fix [extra context]` to
# have the bot apply fixes. A `/fix` reply on an inline finding fixes that one
# finding; a top-level `/fix` comment fixes every open finding on the PR. The
# fix is committed and pushed to the PR head branch.
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

concurrency:
  group: "ai-review-command-${{ github.event.issue.number || github.event.pull_request.number }}"
  cancel-in-progress: false

defaults:
  run:
    shell: "bash"

jobs:
  fix:
    name: "AI Fix"
    runs-on: "ubuntu-latest"
    # Cheap pre-filter, tightened to an exact `/fix` token in the resolve step:
    # a PR comment, never the bot's own (so a fix reply can't re-trigger a fix),
    # and only from the PR author. The inactive side of `||` is null and never
    # matches.
    if: >-
      ${{
        github.event.comment.user.type != 'Bot'
        && github.event.comment.user.login == (github.event.issue.user.login || github.event.pull_request.user.login)
        && (
          (github.event_name == 'issue_comment'
            && github.event.issue.pull_request != null
            && startsWith(github.event.comment.body, '/fix'))
          || (github.event_name == 'pull_request_review_comment'
            && startsWith(github.event.comment.body, '/fix'))
        )
      }}
    timeout-minutes: 30
    permissions:
      contents: "write"
      id-token: "write"
      issues: "write"
      pull-requests: "write"
    steps:
      - name: "Mint identity token"
        id: "mint_identity_token"
        if: |-
          ${{ vars.AI_REVIEW_APP_ID }}
        uses: "actions/create-github-app-token@v2"
        with:
          app-id: "${{ vars.AI_REVIEW_APP_ID }}"
          private-key: "${{ secrets.AI_REVIEW_APP_PRIVATE_KEY }}"
          permission-contents: "write"
          permission-issues: "write"
          permission-pull-requests: "write"

      - name: "Resolve trigger"
        id: "trigger"
        env:
          GH_TOKEN: "${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}"
          # Comment body via env, never interpolated into the script, to avoid command injection.
          COMMENT_BODY: "${{ github.event.comment.body }}"
          EVENT_NAME: "${{ github.event_name }}"
          ISSUE_PR_NUMBER: "${{ github.event.issue.number }}"
          REVIEW_HEAD_REF: "${{ github.event.pull_request.head.ref }}"
        run: |
          set -euo pipefail

          # `/fix` must be the exact first token, so `/fixup` does not trigger a fix.
          first_line="$(printf '%s' "${COMMENT_BODY}" | head -n1)"
          if [[ ! "${first_line}" =~ ^/fix([[:space:]]|$) ]]; then
            echo "Comment does not start with the /fix command token; skipping."
            echo "match=false" >> "${GITHUB_OUTPUT}"
            exit 0
          fi
          echo "match=true" >> "${GITHUB_OUTPUT}"

          # An inline-comment event carries the PR head ref; a conversation
          # comment does not, so resolve it.
          if [[ "${EVENT_NAME}" == "pull_request_review_comment" ]]; then
            head_ref="${REVIEW_HEAD_REF}"
          else
            head_ref="$(gh pr view "${ISSUE_PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json headRefName -q .headRefName)"
          fi
          echo "head_ref=${head_ref}" >> "${GITHUB_OUTPUT}"

          # Everything after the leading `/fix` is extra context for the fix.
          instruction="$(printf '%s' "${COMMENT_BODY}" | sed -E '1 s|^[[:space:]]*/fix[[:space:]]*||')"
          {
            echo "INSTRUCTION<<__FIX_EOF__"
            echo "${instruction}"
            echo "__FIX_EOF__"
          } >> "${GITHUB_ENV}"

      - name: "Checkout PR head branch"
        if: ${{ steps.trigger.outputs.match == 'true' }}
        uses: "actions/checkout@v5"
        with:
          ref: "${{ steps.trigger.outputs.head_ref }}"
          fetch-depth: 0
          token: "${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}"

      - name: "Install dependencies"
        if: ${{ steps.trigger.outputs.match == 'true' }}
        uses: "./.github/actions/setup"
        with:
          npm_user: "${{ vars.NPM_USER }}"
          npm_password: "${{ secrets.NPM_PASS }}"
          npm_email: "${{ vars.NPM_EMAIL }}"
          npm_registry_url: "${{ vars.NPM_REGISTRY_URL }}"

      - name: "Install review plugin into Alokai CLI"
        if: ${{ steps.trigger.outputs.match == 'true' }}
        run: yarn alokai plugins link node_modules/@alokai/cli-plugin-review

      - name: "🔄 Sync @alokai/ai-toolkit skills"
        if: ${{ steps.trigger.outputs.match == 'true' }}
        run: yarn alokai ai sync --yes

      - name: "Configure git identity"
        if: ${{ steps.trigger.outputs.match == 'true' }}
        run: |
          git config user.name "Alokai AI Review"
          git config user.email "alokai-ai-review@users.noreply.github.com"

      - name: "🛠 Run AI fix"
        if: ${{ steps.trigger.outputs.match == 'true' }}
        env:
          GITHUB_TOKEN: "${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}"
          GITHUB_REPOSITORY: "${{ github.repository }}"
          AI_REVIEW_API_KEY: "${{ secrets.AI_REVIEW_API_KEY }}"
          AI_REVIEW_BASE_URL: "${{ vars.AI_REVIEW_BASE_URL }}"
          AI_REVIEW_MODEL: "${{ vars.AI_REVIEW_MODEL }}"
        run: |
          yarn alokai ai fix \
            "${{ github.event.comment.html_url }}" \
            --instruction "${INSTRUCTION}"

{
  "name": "Alokai AI Review",
  "url": "https://alokai.com",
  "public": false,
  "default_permissions": {
    "contents": "read",
    "issues": "write",
    "pull_requests": "write"
  },
  "redirect_url": "https://alokai.com"
}

<form
  action="https://github.com/organizations/YOUR_ORG/settings/apps/new"
  method="post"
>
  <input
    type="hidden"
    name="manifest"
    value='{"name":"Alokai AI Review","url":"https://alokai.com","public":false,"default_permissions":{"contents":"read","issues":"write","pull_requests":"write"},"redirect_url":"https://alokai.com"}'
  />
  <button>Register the AI Review GitHub App</button>
</form>

gh api -X POST /app-manifests/<code>/conversions

on POST /ai-fix-webhook(event):
  require header X-Gitlab-Token == WEBHOOK_SECRET        # the secret you set on the webhook
  require event.object_kind == "note" and event.merge_request exists
  require first token of event.object_attributes.note == "/fix"
  # Author-only, same as the GitHub workflow - and since the bot is never
  # the MR author, its own replies can't re-trigger a fix.
  require event.object_attributes.author_id == event.merge_request.author_id

  POST {CI_SERVER_URL}/api/v4/projects/{event.project.id}/trigger/pipeline
    token = TRIGGER_TOKEN                                # Settings → CI/CD → Pipeline trigger tokens
    ref   = event.merge_request.source_branch
    variables[AI_FIX_COMMENT_URL] = event.object_attributes.url
    variables[AI_FIX_INSTRUCTION] = note text after "/fix"

ai-fix:
  image: node:22
  rules:
    - if: '$CI_PIPELINE_SOURCE == "trigger" && $AI_FIX_COMMENT_URL'
  script:
    - npx -y npm-cli-login -u "$NPM_USER" -p "$NPM_PASSWORD" -e "$NPM_EMAIL" -r https://npm.alokai.cloud --config-path .npmrc
    - echo '@alokai:registry=https://npm.alokai.cloud' >> .npmrc
    - yarn install --frozen-lockfile
    - yarn alokai plugins link node_modules/@alokai/cli-plugin-review
    - yarn alokai ai sync
    - git config user.name "Alokai AI Review"
    - git config user.email "alokai-ai-review@noreply.${CI_SERVER_HOST}"
    # The fix commits and pushes to the MR source branch, which CI_JOB_TOKEN
    # can't do - point the remote at the project access token instead.
    - git remote set-url origin "https://oauth2:${GITLAB_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
    - git checkout -B "${CI_COMMIT_REF_NAME}"
    - |
      ARGS=("${AI_FIX_COMMENT_URL}")
      if [[ -n "${AI_FIX_INSTRUCTION}" ]]; then ARGS+=(--instruction "${AI_FIX_INSTRUCTION}"); fi
      if [[ -n "${AI_REVIEW_BASE_URL}" ]]; then ARGS+=(--base-url "${AI_REVIEW_BASE_URL}"); fi
      if [[ -n "${AI_REVIEW_MODEL}" ]]; then ARGS+=(--model "${AI_REVIEW_MODEL}"); fi
      yarn alokai ai fix "${ARGS[@]}"