# ForgeDock CI Review — Workflow Template
#
# Copy this file to .github/workflows/forgedock-review.yml in your repository
# to enable automatic AI-powered PR review on every pull request.
#
# Prerequisites:
#   1. Add ANTHROPIC_API_KEY as a repository secret (Settings > Secrets > Actions)
#   2. Ensure Claude Code is installed: https://docs.anthropic.com/en/docs/claude-code
#   3. ForgeDock must be installed in the repo running the pipeline (npx forgedock)
#
# Security:
#   - ANTHROPIC_API_KEY is ONLY passed via the env: block — never echoed or logged
#   - GITHUB_TOKEN is scoped to this workflow run only
#   - Review findings are posted as PR comments, not stored in workflow logs
#
# Fork PR limitation:
#   - pull_request events from forks do NOT have access to repository secrets
#   - External contributors' PRs will not trigger this workflow automatically
#   - To review fork PRs, see the pull_request_target alternative below (with security caveats)
#
# See docs/CI.md for full setup guide, customization options, and troubleshooting.

name: ForgeDock PR Review

on:
  pull_request:
    types: [opened, synchronize, reopened]

# Minimum permissions required for ForgeDock review:
#   contents: read     — checkout code and read files
#   pull-requests: write — post review findings as PR comments
permissions:
  contents: read
  pull-requests: write

jobs:
  forgedock-review:
    name: AI PR Review
    runs-on: ubuntu-latest

    # Skip review for bot-authored PRs (dependabot, release bots, etc.)
    # Remove this condition if you want all PRs reviewed.
    if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]'

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          # Fetch full history so /review-pr can access git blame and log
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: '20'

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code
        # Installs claude CLI for non-interactive (headless) execution

      - name: Install ForgeDock
        run: npx forgedock install
        # Symlinks ForgeDock commands into ~/.claude/commands/
        # This makes /review-pr available to claude --print

      - name: Run ForgeDock PR Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Pass PR number via environment — do not echo secrets in run: scripts
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          claude --print "/review-pr $PR_NUMBER" \
            --dangerously-skip-permissions
        # --print runs Claude Code in non-interactive (headless) mode
        # --dangerously-skip-permissions skips the interactive permission prompt
        #   required for unattended CI execution; safe here because the runner
        #   is ephemeral and permissions are constrained by the workflow above

      # Optional: set a commit status based on review verdict
      # Uncomment to enable pass/fail badges on PRs.
      #
      # - name: Set Commit Status
      #   if: always()
      #   uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      #   with:
      #     script: |
      #       const state = '${{ job.status }}' === 'success' ? 'success' : 'failure';
      #       await github.rest.repos.createCommitStatus({
      #         owner: context.repo.owner,
      #         repo: context.repo.repo,
      #         sha: context.payload.pull_request.head.sha,
      #         state: state,
      #         context: 'ForgeDock Review',
      #         description: state === 'success' ? 'Review complete' : 'Review found issues',
      #       });