cursor-code-review.yml

name: Agentic Code Review (Cursor)

# Disabled for automatic PR reviews. Active reviewer is opencode-code-review.yml.
# Kept as workflow_dispatch backup (requires CURSOR_API_KEY). Re-enable pull_request here
# only after disabling opencode-code-review.yml pull_request triggers.
on:
  workflow_dispatch:
    inputs:
      pr_number:
        description: Pull request number to review (required for manual runs)
        required: true
        type: string

permissions:
  contents: read
  pull-requests: write

concurrency:
  group: cursor-review-${{ github.event.inputs.pr_number || github.ref }}
  cancel-in-progress: true

jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
        with: { fetch-depth: 0 }
      - uses: actions/setup-node@v6
        with: { node-version: "22.13" }

      - name: Resolve PR context
        id: pr
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            PR="${{ github.event.pull_request.number }}"
            HEAD_REF="${{ github.head_ref }}"
            BASE_REF="${{ github.event.pull_request.base.ref }}"
          else
            PR="${{ github.event.inputs.pr_number }}"
            [[ -n "$PR" ]] || { echo "::error::workflow_dispatch requires pr_number"; exit 1; }
            HEAD_REF="$(gh pr view "$PR" --json headRefName --jq .headRefName)"
            BASE_REF="$(gh pr view "$PR" --json baseRefName --jq .baseRefName)"
          fi
          echo "number=$PR" >> "$GITHUB_OUTPUT"
          echo "head_ref=$HEAD_REF" >> "$GITHUB_OUTPUT"
          echo "base_ref=$BASE_REF" >> "$GITHUB_OUTPUT"
          echo "Reviewing PR #$PR ($HEAD_REF → $BASE_REF)"

      - name: Run code reviewer
        env:
          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
          GITHUB_TOKEN: ${{ github.token }}
          # Default 600000 (10m) is tight for Custom-stack / large md+json diffs.
          AGENTIC_CODE_REVIEWERS_TIMEOUT_MS: "1200000"
          # No --exclude-patterns CLI; extra globs merge into BASE_EXCLUDE (release dist/config.js).
          # Paths = config.json plans.dir / plans.specsDir ({plansDir} / {specsDir}).
          AGENTIC_CODE_REVIEWERS_EXTRA_EXCLUDE_PATTERNS: ".agents/plans/**,.agents/specs/**"
        run: |
          set -euo pipefail
          if [[ -z "${CURSOR_API_KEY:-}" ]]; then
            echo "::error::CURSOR_API_KEY repository secret is not set"
            exit 1
          fi
          # Download to a file so BASH_SOURCE is bound (curl|bash leaves it unbound under set -u).
          curl -fsSL https://raw.githubusercontent.com/jpolvora/agentic-code-reviewers/release/run.sh \
            -o /tmp/agentic-code-reviewers-run.sh
          bash /tmp/agentic-code-reviewers-run.sh \
            --engine cursor-sdk \
            --model composer-2.5 \
            --variant high \
            --gh \
            --pr-id "${{ steps.pr.outputs.number }}" \
            --stack Custom \
            --custom-prompt .github/agentic-code-reviewers-prompt.md \
            --score-min 3 \
            --include-patterns "**/*.md,**/*.mdc,**/*.yml,**/*.yaml,**/*.json,**/*.sh,**/*.ps1,**/*.psm1,**/*.psd1,**/*.cmd,**/*.js,**/*.ts,**/*.css,**/*.html,**/*.cjs,**/*.py,**/*.prd" \
            --source-branch "refs/heads/${{ steps.pr.outputs.head_ref }}" \
            --target-branch "refs/heads/${{ steps.pr.outputs.base_ref }}"

      - name: Check for unresolved threads
        id: check-threads
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ steps.pr.outputs.number }}
        run: |
          set -euo pipefail
          ACTIVE="$(gh api graphql \
            -f query='query($o:String!,$n:String!,$p:Int!){
              repository(owner:$o,name:$n){
                pullRequest(number:$p){
                  reviewThreads(first:100){ nodes { isResolved isOutdated } }
                }
              }
            }' \
            -f o="${{ github.repository_owner }}" \
            -f n="${{ github.event.repository.name }}" \
            -F p="$PR_NUMBER" \
            --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
              | select(.isResolved == false and .isOutdated == false)] | length')"
          echo "active_threads=${ACTIVE}" >> "$GITHUB_OUTPUT"
          echo "Unresolved review threads: ${ACTIVE}"

      - name: Block merge on unresolved threads
        if: ${{ steps.check-threads.outputs.active_threads != '0' }}
        run: |
          echo "::error::PR has ${{ steps.check-threads.outputs.active_threads }} unresolved review thread(s). Resolve them before merging."
          exit 1