capture-pr-review.yml

name: Bot - Capture PR Review

on:
  pull_request_review:
    types:
      - submitted

permissions: {}

jobs:
  capture:
    name: Capture Review Metadata
    runs-on: hl-sdk-py-lin-md
    if: "!contains(github.actor, '[bot]')"

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - name: Write review metadata
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const fs = require('fs');
            const reviewer = context.payload.review?.user?.login;
            const prNumber = context.payload.pull_request?.number;
            if (
              typeof reviewer !== 'string' ||
              reviewer.length === 0 ||
              !Number.isInteger(prNumber) ||
              prNumber <= 0
            ) {
              throw new Error(`Invalid pull_request_review payload: reviewer=${reviewer}, pr_number=${prNumber}`);
            }
            fs.mkdirSync('review-data', { recursive: true });
            fs.writeFileSync('review-data/review.json', JSON.stringify({ reviewer, pr_number: prNumber }));

      - name: Upload review metadata
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: review-data-${{ github.run_id }}
          path: review-data/review.json
          retention-days: 1