feat: automatic PR review workflow with OpenCode AI

.github/workflows/pr-review.yml

@@ -0,0 +1,77 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# PR Review Workflow for OpenAgentHQ
+# Automatically reviews PRs using OpenCode AI when opened or updated.
+#
+# Trigger: pull_request → opened/synchronize/reopened/ready_for_review
+# Permissions: id-token: write, contents: read, pull-requests: write, issues: write
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: PR Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+# Cancel in-progress reviews for the same PR
+concurrency:
+  group: pr-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: AI Code Review
+    runs-on: ubuntu-latest
+
+    # Skip draft PRs — they aren't ready for review
+    if: github.event.pull_request.draft == false
+
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
+      issues: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run OpenCode PR Review
+        uses: anomalyco/opencode/github@v1
+        env:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          model: opencode/deepseek-v4-flash-free
+          use_github_token: true
+          prompt: |
+            Review this pull request thoroughly. Provide a structured code review covering:
+
+            ## Summary
+            Brief summary of what this PR does.
+
+            ## Issues Found
+            For each issue found, categorize it:
+            - [BUG] — Logic errors, race conditions, edge cases
+            - [SECURITY] — Vulnerabilities, injection, secrets exposure
+            - [PERFORMANCE] — Inefficiency, N+1 queries, memory issues
+            - [STYLE] — Readability, naming, code organization
+            - [TEST] — Missing tests, weak assertions, coverage gaps
+
+            Each issue should include:
+            - File path and line number
+            - Severity: LOW / MEDIUM / HIGH
+            - Description of the problem
+            - Suggested fix
+
+            ## Positive Notes
+            Highlight what was done well (good patterns, clean code, proper tests).
+
+            ## Verdict
+            - APPROVE — No blocking issues
+            - COMMENT — Minor suggestions, no blockers
+            - REQUEST CHANGES — Blocking issues that must be fixed
+
+            Be specific and actionable. Reference actual code from the diff.
+            If no issues are found, say "No issues found. Good job!"