Skip to content

feat(qr): QR codes for any data, with a terminal renderer #1056

feat(qr): QR codes for any data, with a terminal renderer

feat(qr): QR codes for any data, with a terminal renderer #1056

Workflow file for this run

name: AI Review
"on":
pull_request: {}
issue_comment:
types:
- created
permissions:
contents: read
jobs:
review:
name: AI review
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
if: "${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}"
timeout-minutes: 15
concurrency:
group: "ai-review-${{ github.workflow }}-${{ github.event.pull_request.number }}"
cancel-in-progress: true
steps:
- name: Harden and check out with Zuke
uses: zuke-build/zuke@2478fa5a69fb4f16540e54959c98cd976ec3f075 # v1.0.5
with:
egress-policy: block
persist-credentials: "false"
allowed-endpoints: "deno.land:443 dl.deno.land:443 jsr.io:443 github.com:443 api.github.com:443 codeload.github.com:443 objects.githubusercontent.com:443 release-assets.githubusercontent.com:443 api.openai.com:443"
- name: AI review with Zuke
run: ./zuke review
env:
OPENAI_API_KEY: "${{ secrets.OPENAI_API_KEY }}"
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
ZUKE_BUILD_APP_ID: "${{ secrets.ZUKE_BUILD_APP_ID }}"
ZUKE_BUILD_APP_KEY: "${{ secrets.ZUKE_BUILD_APP_KEY }}"
commandReview:
name: AI review on command
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
if: "${{ github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.comment.user.type != 'Bot' && (startsWith(github.event.comment.body, '@zuke-build review') || startsWith(github.event.comment.body, '@zuke-build accept')) }}"
timeout-minutes: 15
concurrency:
group: "ai-review-${{ github.workflow }}-${{ github.event.issue.number }}"
cancel-in-progress: false
steps:
- name: Harden and check out with Zuke
uses: zuke-build/zuke@2478fa5a69fb4f16540e54959c98cd976ec3f075 # v1.0.5
with:
egress-policy: block
persist-credentials: "false"
allowed-endpoints: "deno.land:443 dl.deno.land:443 jsr.io:443 github.com:443 api.github.com:443 codeload.github.com:443 objects.githubusercontent.com:443 release-assets.githubusercontent.com:443 api.openai.com:443"
- name: Check the commenter may start a review
id: callers
shell: bash
run: |
set -euo pipefail
case "$ZUKE_REVIEW_ACTOR" in
""|*[!A-Za-z0-9-]*)
echo "::error::the commenter's login is not a GitHub login"
exit 1 ;;
esac
answer="$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ZUKE_REVIEW_ACTOR/permission" --jq '"\(.permission) \(.role_name)"')" || {
echo "::error::could not read $ZUKE_REVIEW_ACTOR's role on $GITHUB_REPOSITORY; refusing to run the review"
exit 1
}
permission="${answer%% *}"
role="${answer#* }"
case "$role" in
(write|maintain|admin)
echo "$ZUKE_REVIEW_ACTOR has the $role role."
echo "allowed=true" >> "$GITHUB_OUTPUT" ;;
(*)
case "$permission" in
(admin|write)
echo "$ZUKE_REVIEW_ACTOR has the $role role, with $permission access."
echo "allowed=true" >> "$GITHUB_OUTPUT" ;;
(*)
echo "$ZUKE_REVIEW_ACTOR has the $role role on $GITHUB_REPOSITORY; starting a review needs write or above."
echo "allowed=false" >> "$GITHUB_OUTPUT" ;;
esac ;;
esac
env:
GH_TOKEN: "${{ github.token }}"
ZUKE_REVIEW_ACTOR: "${{ github.event.comment.user.login }}"
- name: AI review with Zuke
if: "steps.callers.outputs.allowed == 'true'"
run: ./zuke review
env:
OPENAI_API_KEY: "${{ secrets.OPENAI_API_KEY }}"
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
ZUKE_BUILD_APP_ID: "${{ secrets.ZUKE_BUILD_APP_ID }}"
ZUKE_BUILD_APP_KEY: "${{ secrets.ZUKE_BUILD_APP_KEY }}"
ZUKE_REVIEW_PR: "${{ github.event.issue.number }}"
ZUKE_REVIEW_COMMENT: "${{ github.event.comment.id }}"