name: Codex PR Review

on:
  pull_request_target:
    types: [opened, reopened, ready_for_review, synchronize, edited]

concurrency:
  group: codex-pr-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  pr-review:
    if: |
      github.event.pull_request.draft == false &&
      !endsWith(github.actor, '[bot]') &&
      !contains(github.event.pull_request.labels.*.name, 'bot-skip')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: read
      checks: read
      statuses: read
      pull-requests: write
    outputs:
      review_result: ${{ steps.run_codex.outputs.final-message }}

    steps:
      # Load executable scripts and prompts from trusted base code. PR objects
      # are fetched for inspection below, never checked out or run.
      - name: Checkout review policy
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          fetch-depth: 0

      - name: Prepare review context and check for duplicate inputs
        id: prepare
        uses: actions/github-script@v7
        with:
          script: |
            const { prepareReview } = require('./.github/scripts/pr-review.cjs');
            await prepareReview({ github, context, core });
        env:
          HAPI_BOT_LOGINS: ${{ vars.HAPI_BOT_LOGINS }}

      - name: Fetch fixed review commits
        if: steps.prepare.outputs.should_review == 'true'
        env:
          BASE_SHA: ${{ steps.prepare.outputs.base_sha }}
          CURRENT_HEAD_SHA: ${{ steps.prepare.outputs.current_head_sha }}
        run: git fetch --no-tags origin "$BASE_SHA" "$CURRENT_HEAD_SHA"

      - name: Analyze requirement, approach, and code
        id: run_codex
        if: steps.prepare.outputs.should_review == 'true'
        uses: openai/codex-action@v1.11
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_TOKEN: ${{ github.token }}
          REVIEW_CONTEXT_PATH: ${{ steps.prepare.outputs.context_path }}
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          responses-api-endpoint: ${{ secrets.OPENAI_BASE_URL }}
          model: ${{ vars.OPENAI_MODEL || 'gpt-5.2-codex' }}
          effort: ${{ vars.OPENAI_EFFORT || 'high' }}
          # Tolerate flaky relay streams: more reconnects, longer idle timeout
          codex-args: '-c model_providers.codex-action-responses-proxy.stream_max_retries=10 -c model_providers.codex-action-responses-proxy.stream_idle_timeout_ms=600000'
          sandbox: danger-full-access
          safety-strategy: drop-sudo
          prompt-file: .github/prompts/codex-pr-review.md
          allow-bots: true
          allow-users: "*"

      - name: Validate and publish one review
        id: publish
        if: steps.prepare.outputs.should_review == 'true'
        uses: actions/github-script@v7
        env:
          HAPI_BOT_LOGINS: ${{ vars.HAPI_BOT_LOGINS }}
          REVIEW_CONTEXT_PATH: ${{ steps.prepare.outputs.context_path }}
          REVIEW_RESULT: ${{ steps.run_codex.outputs.final-message }}
        with:
          script: |
            const { publishReview } = require('./.github/scripts/pr-review.cjs');
            await publishReview({ github, context, core });