code-review.yml

name: Code Review

# Reviews a pull request, triggered automatically when a PR is opened or marked
# ready for review (eligibility rules on the job condition), or on request by a
# "/code-review" PR comment or a review request for vaadin-review-bot.
# The review itself lives in the shared vaadin/github-actions/code-review
# action (prepared review inputs, the Claude review, posting the findings as
# one review); this workflow owns the triggers, eligibility rules, and the
# reaction to the trigger.

on:
  issue_comment:
    types: [created]
  pull_request:
    types: [opened, ready_for_review, review_requested]
    branches: [main]

# One review per PR at a time; a re-trigger queues instead of aborting a run
# that may be mid-posting.
concurrency:
  group: code-review-${{ github.event.issue.number || github.event.pull_request.number }}
  cancel-in-progress: false

env:
  PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}

jobs:
  check:
    # Eligibility is a cheap `if` pre-filter plus an authoritative org-membership
    # check in the job. Requested reviews (comment, review request) only check
    # who asked. Auto triggers (opened, ready for review) additionally skip
    # drafts, chore PRs, and known bots. The pre-filter allows CONTRIBUTOR
    # because on pull_request events the author_association of a private org
    # member is reported as CONTRIBUTOR; the org-membership API call in the job
    # is what actually confirms access.
    if: |
      (github.event_name == 'issue_comment' &&
       github.event.issue.pull_request &&
       github.event.comment.body == '/code-review' &&
       contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
      (github.event_name == 'pull_request' &&
       github.event.action == 'review_requested' &&
       github.event.requested_reviewer.login == 'vaadin-review-bot') ||
      (github.event_name == 'pull_request' &&
       contains(fromJSON('["opened", "ready_for_review"]'), github.event.action) &&
       github.event.pull_request.draft == false &&
       !contains(fromJSON('["dependabot[bot]", "vaadin-bot"]'), github.event.pull_request.user.login) &&
       contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR"]'), github.event.pull_request.author_association) &&
       !startsWith(github.event.pull_request.title, 'chore:') &&
       !startsWith(github.event.pull_request.title, 'chore('))
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      eligible: ${{ steps.access.outputs.eligible }}
    steps:
      - name: Check org membership
        id: access
        env:
          GH_TOKEN: ${{ secrets.VAADIN_REVIEW_BOT || github.token }}
          REQUESTER: ${{ github.event.sender.login }}
        run: |
          if gh api "orgs/${{ github.repository_owner }}/members/$REQUESTER" --silent; then
            echo "eligible=true" >> "$GITHUB_OUTPUT"
          else
            echo "eligible=false" >> "$GITHUB_OUTPUT"
          fi

  review:
    needs: check
    if: needs.check.outputs.eligible == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
      pull-requests: write
      id-token: write
    steps:
      - name: React to trigger
        env:
          GH_TOKEN: ${{ secrets.VAADIN_REVIEW_BOT || github.token }}
        run: |
          if [ "${{ github.event_name }}" = "issue_comment" ]; then
            target="issues/comments/${{ github.event.comment.id }}"
          else
            target="issues/$PR_NUMBER"
          fi
          gh api "repos/${{ github.repository }}/$target/reactions" \
            -f content=eyes

      - name: Checkout PR branch
        uses: actions/checkout@v6
        with:
          ref: refs/pull/${{ env.PR_NUMBER }}/head
          fetch-depth: 1

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: '24'

      - name: Run code review
        uses: vaadin/github-actions/code-review@main
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          pr-number: ${{ env.PR_NUMBER }}
          github-token: ${{ secrets.VAADIN_REVIEW_BOT || github.token }}
          reference-repos: |
            vaadin/flow | the Vaadin Flow framework (Java). Consult it to understand base component classes, the `Element` API, and framework internals this repository builds on.
            vaadin/web-components | the Vaadin web components (JavaScript/Lit). Consult it to understand the client-side properties, events, and DOM behavior of the components that the Flow components here wrap.
          upload-execution-log: ${{ vars.CLAUDE_DEBUG }}