From cd300220a21baf104c605c0fe491b6959e9a1b32 Mon Sep 17 00:00:00 2001
From: Himanshu Kumar <himanshu231204@gmail.com>
Date: Tue, 21 Jul 2026 20:38:05 +0530
Subject: [PATCH 1/2] feat: add automatic PR review workflow with OpenCode AI

New workflow that triggers on PR open/sync/reopen/ready_for_review:
- Skips draft PRs
- Uses OpenCode AI for general code review
- Reviews bugs, security, performance, style, and tests
- Posts structured review comment with verdict
- Cancels in-progress reviews for same PR

Uses existing OPENCODE_API_KEY secret and deepseek-v4-flash-free model.
---
 .github/workflows/pr-review.yml | 75 +++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 .github/workflows/pr-review.yml

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
new file mode 100644
index 0000000..bf8fe1f
--- /dev/null
+++ b/.github/workflows/pr-review.yml
@@ -0,0 +1,75 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# PR Review Workflow for OpenAgentHQ
+# Automatically reviews PRs using OpenCode AI when opened or updated.
+#
+# Trigger: pull_request → opened/synchronize/reopened/ready_for_review
+# Permissions: id-token: write, contents: read, pull-requests: read, issues: read
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: PR Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+# Cancel in-progress reviews for the same PR
+concurrency:
+  group: pr-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: AI Code Review
+    runs-on: ubuntu-latest
+
+    # Skip draft PRs — they aren't ready for review
+    if: github.event.pull_request.draft == false
+
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: read
+      issues: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run OpenCode PR Review
+        uses: anomalyco/opencode/github@latest
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+        with:
+          model: opencode/deepseek-v4-flash-free
+          prompt: |
+            Review this pull request thoroughly. Provide a structured code review covering:
+
+            ## Summary
+            Brief summary of what this PR does.
+
+            ## Issues Found
+            For each issue found, categorize it:
+            - [BUG] — Logic errors, race conditions, edge cases
+            - [SECURITY] — Vulnerabilities, injection, secrets exposure
+            - [PERFORMANCE] — Inefficiency, N+1 queries, memory issues
+            - [STYLE] — Readability, naming, code organization
+            - [TEST] — Missing tests, weak assertions, coverage gaps
+
+            Each issue should include:
+            - File path and line number
+            - Severity: LOW / MEDIUM / HIGH
+            - Description of the problem
+            - Suggested fix
+
+            ## Positive Notes
+            Highlight what was done well (good patterns, clean code, proper tests).
+
+            ## Verdict
+            - APPROVE — No blocking issues
+            - COMMENT — Minor suggestions, no blockers
+            - REQUEST CHANGES — Blocking issues that must be fixed
+
+            Be specific and actionable. Reference actual code from the diff.
+            If no issues are found, say "No issues found. Good job!"

From cf358fe23a0cf1d8deb08bd0f6c20f216660b863 Mon Sep 17 00:00:00 2001
From: Himanshu Kumar <himanshu231204@gmail.com>
Date: Tue, 21 Jul 2026 20:44:43 +0530
Subject: [PATCH 2/2] fix: address PR review findings

- Add GITHUB_TOKEN env and use_github_token: true for posting comments
- Upgrade permissions to pull-requests: write, issues: write
- Pin action version to @v1 instead of @latest

Addresses all3 issues flagged by OpenCode AI review.
---
 .github/workflows/pr-review.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index bf8fe1f..2a79acf 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -3,7 +3,7 @@
 # Automatically reviews PRs using OpenCode AI when opened or updated.
 #
 # Trigger: pull_request → opened/synchronize/reopened/ready_for_review
-# Permissions: id-token: write, contents: read, pull-requests: read, issues: read
+# Permissions: id-token: write, contents: read, pull-requests: write, issues: write
 # ─────────────────────────────────────────────────────────────────────────────
 
 name: PR Review
@@ -28,8 +28,8 @@ jobs:
     permissions:
       id-token: write
       contents: read
-      pull-requests: read
-      issues: read
+      pull-requests: write
+      issues: write
 
     steps:
       - name: Checkout repository
@@ -38,11 +38,13 @@ jobs:
           persist-credentials: false
 
       - name: Run OpenCode PR Review
-        uses: anomalyco/opencode/github@latest
+        uses: anomalyco/opencode/github@v1
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           model: opencode/deepseek-v4-flash-free
+          use_github_token: true
           prompt: |
             Review this pull request thoroughly. Provide a structured code review covering: