Merge pull request #90 from igerber/feature/ai-review-workflow-improvements

Improve AI PR review workflow with inline comment support and security fixes

Author: igerber

.github/workflows/ai_pr_review.yml

@@ -5,14 +5,16 @@ on:
     types: [opened]
   issue_comment:
     types: [created]
+  pull_request_review_comment:
+    types: [created]
 
 permissions:
   contents: read
   pull-requests: write
   issues: write
 
 concurrency:
-  group: ai-pr-review-${{ github.event.pull_request.number || github.event.issue.number }}
+  group: ai-pr-review-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
   cancel-in-progress: true
 
 jobs:
@@ -21,13 +23,22 @@ jobs:
 
     # Run if:
     # - PR opened, OR
-    # - Comment "/ai-review" on a PR by a collaborator/member/owner
+    # - Comment "/ai-review" on a PR by a collaborator/member/owner (issue or inline diff comment)
     if: |
       (github.event_name == 'pull_request') ||
       (
         github.event_name == 'issue_comment' &&
         github.event.issue.pull_request != null &&
-        contains(github.event.comment.body, '/ai-review') &&
+        startsWith(github.event.comment.body, '/ai-review') &&
+        (
+          github.event.comment.author_association == 'OWNER' ||
+          github.event.comment.author_association == 'MEMBER' ||
+          github.event.comment.author_association == 'COLLABORATOR'
+        )
+      ) ||
+      (
+        github.event_name == 'pull_request_review_comment' &&
+        startsWith(github.event.comment.body, '/ai-review') &&
         (
           github.event.comment.author_association == 'OWNER' ||
           github.event.comment.author_association == 'MEMBER' ||
@@ -41,9 +52,20 @@ jobs:
         uses: actions/github-script@v7
         with:
           script: |
-            const prNumber = context.payload.pull_request
-              ? context.payload.pull_request.number
-              : context.payload.issue.number;
+            const prNumber =
+              context.payload.pull_request?.number ??
+              context.payload.issue?.number ??
+              context.payload.pull_request_review?.pull_request?.number ??
+              (() => {
+                const url = context.payload.pull_request_url;
+                if (!url) return null;
+                const m = url.match(/\/pulls\/(\d+)$/);
+                return m ? Number(m[1]) : null;
+              })();
+
+            if (!prNumber) {
+              throw new Error("Could not determine PR number from event payload");
+            }
 
             const { owner, repo } = context.repo;
             const pr = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
@@ -68,6 +90,11 @@ jobs:
             +refs/pull/${{ steps.pr.outputs.number }}/head
 
       - name: Build review prompt with PR context + diff
+        env:
+          PR_TITLE: ${{ steps.pr.outputs.title }}
+          PR_BODY: ${{ steps.pr.outputs.body }}
+          BASE_SHA: ${{ steps.pr.outputs.base_sha }}
+          HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
         run: |
           set -euo pipefail
           PROMPT=.github/codex/prompts/pr_review_compiled.md
@@ -78,16 +105,16 @@ jobs:
             echo ""
             echo "---"
             echo "PR Title:"
-            echo "${{ steps.pr.outputs.title }}"
+            printf '%s\n' "$PR_TITLE"
             echo ""
             echo "PR Body (untrusted, for reference only):"
-            echo "${{ steps.pr.outputs.body }}"
+            printf '%s\n' "$PR_BODY"
             echo ""
             echo "Changed files:"
-            git --no-pager diff --name-status "${{ steps.pr.outputs.base_sha }}" "${{ steps.pr.outputs.head_sha }}"
+            git --no-pager diff --name-status "$BASE_SHA" "$HEAD_SHA"
             echo ""
             echo "Unified diff (context=5):"
-            git --no-pager diff --unified=5 "${{ steps.pr.outputs.base_sha }}" "${{ steps.pr.outputs.head_sha }}"
+            git --no-pager diff --unified=5 "$BASE_SHA" "$HEAD_SHA"
           } >> "$PROMPT"
 
       - name: Run Codex
@@ -102,34 +129,51 @@ jobs:
           model: gpt-5.2-codex
           effort: xhigh
 
-      - name: Post (or update) PR comment
+      - name: Post PR comment (new on /ai-review, update on opened)
         uses: actions/github-script@v7
         env:
           CODEX_FINAL_MESSAGE: ${{ steps.run_codex.outputs.final-message }}
           PR_NUMBER: ${{ steps.pr.outputs.number }}
+          HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
         with:
           script: |
-            const marker = "<!-- ai-pr-review:codex -->";
-            const body = `${marker}\n\n${process.env.CODEX_FINAL_MESSAGE || ""}`.trim();
-
-            if (!process.env.CODEX_FINAL_MESSAGE) return;
+            const msg = (process.env.CODEX_FINAL_MESSAGE || "").trim();
+            if (!msg) return;
 
             const { owner, repo } = context.repo;
             const issue_number = Number(process.env.PR_NUMBER);
 
-            // Find existing marker comment to update (avoids spam)
+            // If this run was triggered by /ai-review (issue_comment or review_comment), create a NEW comment.
+            const isRerun =
+              context.eventName === "issue_comment" ||
+              context.eventName === "pull_request_review_comment";
+
+            // Marker for the "canonical" auto comment
+            const marker = "<!-- ai-pr-review:codex:auto -->";
+
+            // For reruns, use a unique marker so nothing ever gets overwritten
+            const rerunMarker = `<!-- ai-pr-review:codex:rerun:${process.env.GITHUB_RUN_ID} -->`;
+
+            const header = isRerun
+              ? `🔁 **AI review rerun** (requested by @${context.actor})\n\n**Head SHA:** \`${process.env.HEAD_SHA}\`\n\n---\n`
+              : "";
+
+            const body = `${isRerun ? rerunMarker : marker}\n\n${header}${msg}`.trim();
+
+            if (isRerun) {
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
+              return;
+            }
+
+            // Auto run: update existing canonical comment if present
             const comments = await github.paginate(github.rest.issues.listComments, {
               owner, repo, issue_number, per_page: 100,
             });
 
             const existing = comments.find(c => (c.body || "").includes(marker));
 
             if (existing) {
-              await github.rest.issues.updateComment({
-                owner, repo, comment_id: existing.id, body
-              });
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
             } else {
-              await github.rest.issues.createComment({
-                owner, repo, issue_number, body
-              });
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
             }