From e8f766cc68617f067cc4ab63e0f8d6f5d090d8aa Mon Sep 17 00:00:00 2001
From: Aaron Sachs <898627+asachs01@users.noreply.github.com>
Date: Mon, 31 Aug 2026 13:04:45 -0400
Subject: [PATCH] ci: pilot AI first-pass PR review via open-code-review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Automated first-pass review, not a merge gate — a human approval is
still required separately via branch protection (to follow once this
pilot is validated). Fork PRs are deliberately excluded for now
(uses pull_request, not pull_request_target) until the action's
internal steps get reviewed for safe fork-secret handling.

Pinned to alibaba/open-code-review@v1.11.1 by commit SHA rather than
@main, with a dependabot.yml entry to track future pin updates.
---
 .github/dependabot.yml               |  9 ++++++
 .github/workflows/ai-code-review.yml | 46 ++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/ai-code-review.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..3f4f0b92
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/ai-code-review.yml b/.github/workflows/ai-code-review.yml
new file mode 100644
index 00000000..d43baae2
--- /dev/null
+++ b/.github/workflows/ai-code-review.yml
@@ -0,0 +1,46 @@
+#
+# Automated first-pass PR review via alibaba/open-code-review, wired in as
+# part of the SOC2 change-management control (see issue tracking in
+# WYRE-AI/msp-claude-plugins). This is a REVIEW ASSIST, not the merge gate —
+# branch protection separately requires a human approval before merge.
+#
+# Deliberately uses `pull_request` (not `pull_request_target`): this repo
+# accepts community/fork PRs (see CONTRIBUTING.md tiers), and pull_request_target
+# would expose repo secrets to workflow runs triggered from a fork. Until the
+# action's internal steps have been reviewed for safe fork-PR handling, fork
+# PRs simply won't get the automated pass — a human reviewer still covers them.
+
+name: AI Code Review (pilot)
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: ai-code-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Run OpenCodeReview
+        uses: alibaba/open-code-review@8d023aafcec05f8ba5628fca3eaba88078e5d201  # v1.11.1
+        with:
+          llm_url: ${{ secrets.OCR_LLM_URL }}
+          llm_auth_token: ${{ secrets.OCR_LLM_AUTH_TOKEN }}
+          llm_model: ${{ secrets.OCR_LLM_MODEL }}
+          llm_use_anthropic: ${{ secrets.OCR_LLM_USE_ANTHROPIC }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          sticky_summary: 'true'
+          incremental: 'true'
+          upload_artifacts: 'true'