Implement Phase 1: AI-powered code review

.github/workflows/on-pull-request.yml

@@ -0,0 +1,104 @@
+name: "egg: Code Review"
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        required: true
+        type: number
+
+jobs:
+  review:
+    name: AI Code Review
+    runs-on: ubuntu-latest
+    # Skip draft PRs, bot PRs, and PRs with [skip-review] in title
+    # For workflow_dispatch, always run (manual trigger implies intent)
+    if: >-
+      github.event_name == 'workflow_dispatch' || (
+        !github.event.pull_request.draft &&
+        github.event.pull_request.user.login != 'james-in-a-box' &&
+        github.event.pull_request.user.login != 'james-in-a-box[bot]' &&
+        !contains(github.event.pull_request.title, '[skip-review]')
+      )
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    concurrency:
+      group: egg-review-${{ github.event.pull_request.number || github.event.inputs.pr_number }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Generate bot token
+        id: bot-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      # For workflow_dispatch, fetch PR metadata via API since
+      # github.event.pull_request is not available
+      - name: Fetch PR metadata
+        if: github.event_name == 'workflow_dispatch'
+        id: pr-meta
+        run: |
+          pr_json=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.inputs.pr_number }})
+          echo "head-ref=$(echo "$pr_json" | jq -r '.head.ref')" >> "$GITHUB_OUTPUT"
+          echo "head-repo=$(echo "$pr_json" | jq -r '.head.repo.full_name')" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.bot-token.outputs.token }}
+
+      # SECURITY: Build the review prompt from a trusted checkout (main).
+      # A malicious PR could replace build-review-prompt.sh to exfiltrate
+      # the bot token. By checking out main for prompt building, we ensure
+      # untrusted code never runs with secrets.
+      - name: Checkout main (trusted)
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          persist-credentials: false
+
+      - name: Build review prompt
+        id: prompt
+        run: bash action/build-review-prompt.sh
+        env:
+          GH_TOKEN: ${{ steps.bot-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
+
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name || steps.pr-meta.outputs.head-repo }}
+          ref: ${{ github.event.pull_request.head.ref || steps.pr-meta.outputs.head-ref }}
+          persist-credentials: false
+
+      - name: Capture actual HEAD SHA
+        id: head
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Run egg review
+        id: egg
+        uses: jwbron/egg/action@main
+        with:
+          prompt-file: ${{ steps.prompt.outputs.prompt-file }}
+          model: ${{ steps.prompt.outputs.model }}
+          anthropic-oauth-token: ${{ secrets.ANTHROPIC_OAUTH_TOKEN }}
+          bot-app-id: ${{ secrets.BOT_APP_ID }}
+          bot-app-private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          bot-app-installation-id: ${{ secrets.BOT_APP_INSTALLATION_ID }}
+          bot-username: james-in-a-box
+          timeout: "10"
+
+      - name: Post review comments
+        if: always() && steps.egg.outputs.exit-code == '0'
+        run: bash action/post-review-comments.sh
+        env:
+          GH_TOKEN: ${{ steps.bot-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
+          HEAD_SHA: ${{ steps.head.outputs.sha }}
+          LOG_FILE: ${{ steps.egg.outputs.log-file }}
+          BOT_USERNAME: james-in-a-box

action/action.yml

@@ -6,8 +6,11 @@ branding:
 
 inputs:
   prompt:
-    description: Task prompt for Claude Code
-    required: true
+    description: Task prompt for Claude Code (mutually exclusive with prompt-file)
+    required: false
+  prompt-file:
+    description: Path to file containing task prompt (for large prompts, mutually exclusive with prompt)
+    required: false
   anthropic-oauth-token:
     description: Anthropic OAuth token for Claude API
     required: true
@@ -64,6 +67,7 @@ runs:
       shell: bash
       env:
         INPUT_PROMPT: ${{ inputs.prompt }}
+        INPUT_PROMPT_FILE: ${{ inputs.prompt-file }}
         INPUT_ANTHROPIC_OAUTH_TOKEN: ${{ inputs.anthropic-oauth-token }}
         INPUT_GITHUB_TOKEN: ${{ inputs.github-token }}
         INPUT_BOT_APP_ID: ${{ inputs.bot-app-id }}