name: opencode-review

on:
  pull_request_target:
    types: [opened, synchronize, reopened, ready_for_review]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      issues: read
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          persist-credentials: false

      - name: Install opencode
        run: |
          curl -fsSL https://opencode.ai/install | bash
          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"

      - name: Run opencode review
        env:
          GH_TOKEN: ${{ github.token }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          MODEL: openai/gpt-5.5
          PROMPT: |
            Review this pull request following the repo-local
            code-review-excellence skill at
            .agents/skills/code-review-excellence/SKILL.md.

            Workflow constraints:
            - You are running in GitHub Actions from a pull_request_target
              workflow with repository secrets available.
            - The local checkout is the trusted base revision, not the PR head.
            - Do not checkout, build, install dependencies from, or execute code
              from the PR head branch.
            - Local base branches such as main may not exist, and local git
              history may be shallow.
            - Do not spend time trying local git diff forms such as
              `git diff main`, `git diff origin/main`, or merge-base discovery.
            - Use the GitHub CLI as the source of truth for the PR diff:
              `gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }}`.
            - Use `gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --json title,body,files,commits,reviews,comments,baseRefName,headRefName`
              for PR metadata when needed.
            - Return the review body only. The workflow publishes your output.
            - After identifying changed files from `gh pr diff` or the provided
              PR context, read only the relevant files and nearby dependencies.
            - Do not make code changes during review unless explicitly asked.

            Prioritize actionable findings over summary. Focus on:
            - Correctness bugs and edge cases
            - Security and data exposure risks
            - Performance regressions
            - Missing or weak tests
            - Maintainability issues that affect future changes

            Avoid repeating findings already made by earlier reviewers unless
            the current diff still contains a severe unresolved issue and the
            new comment adds concrete evidence.

            Use severity labels such as [blocking], [important], [nit],
            and [suggestion]. Keep feedback specific, constructive, and
            tied to affected files or lines when possible.
        run: opencode run --model "$MODEL" "$PROMPT" > opencode-review.md

      - name: Upload opencode review
        uses: actions/upload-artifact@v4
        with:
          name: opencode-review
          path: opencode-review.md
          if-no-files-found: error

  publish:
    needs: review
    runs-on: ubuntu-latest
    if: always()
    permissions:
      actions: read
      pull-requests: write
      issues: write
    steps:
      - name: Download opencode review
        uses: actions/download-artifact@v4
        with:
          name: opencode-review

      - name: Publish opencode review
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --body-file opencode-review.md
