From 6b2de2969491ba3a4393233655ce5d28d4f49430 Mon Sep 17 00:00:00 2001 From: "everstake-ai-review-fanout[bot]" Date: Fri, 4 Sep 2026 19:35:27 +0000 Subject: [PATCH] ci(ai-review): onboard the AI review callers (v2.12.1) Adds the combined review and eval caller and the manual re-run caller, both pinned to infra-ai-platform v2.12.1, plus a CODEBASE.md draft when the repo had none; removes the legacy workflow_run eval pair when present. Opened by the onboarding fanout of infra-ai-platform. --- .github/workflows/ai-review-manual.yml | 73 ++++++++++++++++++++++++++ .github/workflows/ai-review.yml | 72 +++++++++++++++++++++++++ CODEBASE.md | 23 ++++++++ 3 files changed, 168 insertions(+) create mode 100644 .github/workflows/ai-review-manual.yml create mode 100644 .github/workflows/ai-review.yml create mode 100644 CODEBASE.md diff --git a/.github/workflows/ai-review-manual.yml b/.github/workflows/ai-review-manual.yml new file mode 100644 index 0000000..b501c65 --- /dev/null +++ b/.github/workflows/ai-review-manual.yml @@ -0,0 +1,73 @@ +name: AI PR Review (manual) + +# Manually re-run the AI reviewer and/or the judge on any PR. Use after +# force-pushing, updating prompts, or to refresh a stale review. Deliberately +# UNGATED (no gate_on_recommendation): its job names give it distinct check +# contexts, so a manual run can never satisfy a required check. +# what=both review, then eval of the fresh review (default) +# what=review review only +# what=eval judge the LATEST review comment already on the PR (cheap) + +on: + workflow_dispatch: + inputs: + pr_number: + description: PR number + required: true + type: string + what: + description: What to run + required: false + type: choice + options: [both, review, eval] + default: both + +permissions: + contents: read + models: read + pull-requests: write + issues: write + +jobs: + review: + name: AI PR Review (manual) + if: ${{ inputs.what != 'eval' }} + permissions: + contents: read + models: read + pull-requests: write + issues: write + uses: everstake/infra-ai-platform/.github/workflows/ai-pr-review.yml@579156f8f4dabf68087c784cbeb228c3fc58214d # v2.12.1 + with: + pr_number: ${{ inputs.pr_number }} + variant: universal + # Generated lockfiles carry no review value and inflate the diff. + diff_exclude_extra: '^diff --git .*(yarn\.lock|package-lock\.json|pnpm-lock\.yaml|go\.sum)' + client_id: ${{ vars.AI_REVIEW_APP_CLIENT_ID }} + infra_ai_ref: 579156f8f4dabf68087c784cbeb228c3fc58214d + secrets: + APP_PRIVATE_KEY: ${{ secrets.AI_REVIEW_APP_PRIVATE_KEY }} + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + + eval: + name: AI PR Eval (manual) + needs: review + # Runs after a successful review, or alone when what=eval (review skipped). + if: ${{ !cancelled() && inputs.what != 'review' && needs.review.result != 'failure' }} + permissions: + contents: read + models: read + pull-requests: write + issues: write + uses: everstake/infra-ai-platform/.github/workflows/ai-pr-eval.yml@579156f8f4dabf68087c784cbeb228c3fc58214d # v2.12.1 + with: + pr_number: ${{ inputs.pr_number }} + variant: universal + model: claude-sonnet-5 + require_codebase: false + diff_exclude_extra: '^diff --git .*(yarn\.lock|package-lock\.json|pnpm-lock\.yaml|go\.sum)' + client_id: ${{ vars.AI_REVIEW_APP_CLIENT_ID }} + infra_ai_ref: 579156f8f4dabf68087c784cbeb228c3fc58214d + secrets: + APP_PRIVATE_KEY: ${{ secrets.AI_REVIEW_APP_PRIVATE_KEY }} + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml new file mode 100644 index 0000000..3f51af6 --- /dev/null +++ b/.github/workflows/ai-review.yml @@ -0,0 +1,72 @@ +name: AI PR Review + +# Combined merge-gate caller (review job + eval job). Design: ADR-0005. +# No paths: filter by design — see the ADR before adding one. + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + +permissions: + contents: read + models: read + pull-requests: write + issues: write + +jobs: + review: + # Draft is the only caller-level skip: a draft cannot merge, and + # ready_for_review fires a fresh run that reports the real context. + # Dependabot/fork skips live INSIDE the reusable (skip_dependabot / + # skip_forks below) so the check context is still reported as success — + # a caller-level `if:` skip reports a different, shorter context and a + # required check then hangs forever. Rationale: ADR-0005. + if: ${{ github.event.pull_request.draft == false }} + permissions: + contents: read + models: read + pull-requests: write + issues: write + uses: everstake/infra-ai-platform/.github/workflows/ai-pr-review.yml@579156f8f4dabf68087c784cbeb228c3fc58214d # v2.12.1 + with: + pr_number: ${{ github.event.pull_request.number }} + variant: universal + # Generated lockfiles carry no review value and inflate the diff. + diff_exclude_extra: '^diff --git .*(yarn\.lock|package-lock\.json|pnpm-lock\.yaml|go\.sum)' + gate_on_recommendation: true + require_codebase: false + # Label bypass disabled under a merge gate — the only sanctioned + # bypass is the org ruleset's bypass list. Empty matches no label. + skip_label: "" + skip_dependabot: true + skip_forks: true + client_id: ${{ vars.AI_REVIEW_APP_CLIENT_ID }} + infra_ai_ref: 579156f8f4dabf68087c784cbeb228c3fc58214d + secrets: + APP_PRIVATE_KEY: ${{ secrets.AI_REVIEW_APP_PRIVATE_KEY }} + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + + eval: + needs: review + # A skipped review concludes SUCCESS (so its check context is reported); + # the output is what tells us not to judge a review that never ran. + if: ${{ needs.review.outputs.skipped != 'true' }} + permissions: + contents: read + models: read + pull-requests: write + issues: write + uses: everstake/infra-ai-platform/.github/workflows/ai-pr-eval.yml@579156f8f4dabf68087c784cbeb228c3fc58214d # v2.12.1 + with: + pr_number: ${{ github.event.pull_request.number }} + variant: universal + # Generated lockfiles carry no review value and inflate the diff. + diff_exclude_extra: '^diff --git .*(yarn\.lock|package-lock\.json|pnpm-lock\.yaml|go\.sum)' + model: claude-sonnet-5 + gate_min_score: 9 + require_codebase: false + client_id: ${{ vars.AI_REVIEW_APP_CLIENT_ID }} + infra_ai_ref: 579156f8f4dabf68087c784cbeb228c3fc58214d + secrets: + APP_PRIVATE_KEY: ${{ secrets.AI_REVIEW_APP_PRIVATE_KEY }} + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/CODEBASE.md b/CODEBASE.md new file mode 100644 index 0000000..adcb430 --- /dev/null +++ b/CODEBASE.md @@ -0,0 +1,23 @@ +# CODEBASE.md — DRAFT (generated by the AI-review onboarding fanout) + +> Refine this file: it is injected into the AI reviewer's system prompt as +> the repo-specific ground truth. Until it names this repo's real conventions, +> the reviewer works from the universal contract alone. + +## What this repository is + + + +## Tech stack + + + +## Forbidden patterns (auto-flag in review) + + + +## Acceptable patterns (DON'T flag as bugs) + +