code-review.yml

name: Code review

on:
  # CI'S COMPLETION, not the push. `require_ci_green` refuses a commit whose
  # checks are still running, so a push-triggered review would find CI pending,
  # skip, and never come back -- reporting success having done nothing.
  workflow_run:
    # The workflow's `name:`, never its filename. `Tests` is this repository's
    # ONLY pull-request workflow. The template this file came from also listed
    # `Lint`, which does not exist here; a name matching no workflow never
    # fires, so it was silent dead weight rather than a second trigger.
    workflows: ["Tests"]
    types: [completed]
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      pr:
        description: Pull request number
        required: true
      force:
        description: >
          Review a commit that has already been reviewed. The bot skips an
          unchanged head, so without this a re-dispatch is a no-op that reports
          success.
        type: boolean
        default: false

jobs:
  review:
    # Guards, each of which cost a failed run elsewhere to learn:
    #   1. workflow_run fires for default-branch pushes too, where there is no
    #      pull request. `workflow_run.event` is what triggered the UPSTREAM
    #      run, so 'pull_request' is the precise discriminator.
    #   2. A comment only starts a review when it is addressed to the bot.
    if: >
      (github.event_name != 'workflow_run' ||
       github.event.workflow_run.event == 'pull_request') &&
      (github.event_name != 'issue_comment' ||
       (github.event.issue.pull_request != null &&
        startsWith(github.event.comment.body, '@marketdata-code-review')))
    uses: MarketData-App/code-review-bot/.github/workflows/review.yml@main
    # NOT `secrets: inherit`. That only passes secrets to a reusable workflow in
    # the SAME organisation. This repository is on the MarketDataApp user account
    # and the bot is owned by MarketData-App, so inherit crosses an owner
    # boundary and delivers nothing -- the call fails at evaluation naming a
    # secret that is sitting in this repository's settings.
    secrets:
      CODE_REVIEW_APP_PRIVATE_KEY: ${{ secrets.CODE_REVIEW_APP_PRIVATE_KEY }}
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
    with:
      # REQUIRED: this repository is public and on the MarketDataApp user
      # account, so it can never reach the organisation's self-hosted runner --
      # that runner group is visibility=all with
      # allows_public_repositories=false. A job that asks for it is not refused,
      # it queues forever with no runner and nothing saying why.
      runs-on: '["ubuntu-latest"]'
      # `|| false` is load-bearing: `inputs` exists only for workflow_dispatch,
      # and a null against a boolean-typed input fails the ENTIRE workflow at
      # evaluation -- no job, no log.
      force: ${{ inputs.force || false }}