action.yml

name: MIU PR Review
description: AI code review on a pull request — installs the released miucr binary and runs `miucr review --pr --post`.
author: vanducng

branding:
  icon: eye
  color: purple

inputs:
  github-token:
    description: GitHub token used to read the PR and post review comments.
    required: false
    default: ${{ github.token }}
  api-key:
    description: API key for the review provider (Anthropic by default; sent as ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN).
    required: true
  gate:
    description: Severity gate — fail the run if a finding reaches this level (none|low|medium|high|critical).
    required: false
    default: high
  version:
    description: miucr release tag to install (defaults to the latest published release).
    required: false
    default: latest
  base-url:
    description: Optional Anthropic-compatible gateway base URL (e.g. a GLM/z.ai endpoint).
    required: false
    default: ""
  model:
    description: Optional model override (else the provider/profile default).
    required: false
    default: ""
  sarif-file:
    description: >-
      Optional path to also write a SARIF 2.1.0 report (e.g. miucr.sarif). When
      set, the SAME single review run writes the file (via --sarif-out) so a later
      github/codeql-action/upload-sarif step can publish findings to the Security
      tab — no second LLM pass. The file is written only on a successful review;
      a failed review leaves no file. Unset (default) keeps inline-review-only.
    required: false
    default: ""
  filter-mode:
    description: >-
      Inline-eligibility filter for the posted review: added|diff_context|file|
      nofilter (default diff_context). file/nofilter surface off-diff findings in
      the summary and SARIF but never inline.
    required: false
    default: diff_context
  suggest:
    description: >-
      Emit GitHub native one-click suggested edits for findings with a proven
      clean single-line/contiguous replacement (author-applied, never pushed).
      Default true.
    required: false
    default: "true"
  patch-repair:
    description: >-
      When a single-line fix almost applies but the model's patch is rejected,
      make one focused second pass to repair it into a clean one-click suggestion.
      Requires suggest. Adds a small number of extra LLM calls. Default false.
    required: false
    default: "false"
  build-from-source:
    description: >-
      Build miucr from the checked-out source (CGO_ENABLED=0 go build ./cmd/miucr)
      instead of installing the released binary. Used by miu-cr's own dogfood so a
      PR is reviewed by ITS code, not the last release. Requires Go on the runner.
    required: false
    default: "false"
  pr-number:
    description: PR number to review (defaults to the pull_request event's number).
    required: false
    default: ${{ github.event.pull_request.number }}
  instruction:
    description: Extra free-text steer passed to miucr review --instruction.
    required: false
    default: ""

runs:
  using: composite
  steps:
    - name: Detect release automation PR
      id: skip_release_pr
      shell: bash
      env:
        PR_TITLE: ${{ github.event.pull_request.title }}
      run: |
        set -euo pipefail
        skip=false
        case "${GITHUB_HEAD_REF:-}" in release-please--*) skip=true ;; esac
        case "${PR_TITLE:-}" in chore\(*\):\ release\ *) skip=true ;; esac
        if [ "$skip" = true ]; then echo "::notice::miucr review skipped: release automation PR"; fi
        echo "skip=$skip" >> "$GITHUB_OUTPUT"

    - name: Install miucr
      if: ${{ steps.skip_release_pr.outputs.skip != 'true' }}
      shell: bash
      env:
        MIUCR_VERSION: ${{ inputs.version }}
        BUILD_FROM_SOURCE: ${{ inputs.build-from-source }}
        GITHUB_TOKEN: ${{ inputs.github-token }}
      run: |
        set -euo pipefail
        export MIUCR_INSTALL_DIR="$HOME/.local/bin"
        mkdir -p "$MIUCR_INSTALL_DIR"
        if [ "${BUILD_FROM_SOURCE:-}" = "true" ]; then
          # Self-review: build the PR's own code so the review reflects this PR,
          # not the last release (Go must be set up by the caller).
          CGO_ENABLED=0 go build -o "$MIUCR_INSTALL_DIR/miucr" ./cmd/miucr
        else
          curl -fsSL https://cr.miu.sh/install.sh | sh
        fi
        echo "$MIUCR_INSTALL_DIR" >> "$GITHUB_PATH"
        export PATH="$MIUCR_INSTALL_DIR:$PATH"
        command -v miucr

    - name: Review PR
      if: ${{ steps.skip_release_pr.outputs.skip != 'true' }}
      # One LLM review run posts the inline review AND (when sarif-file is set)
      # writes the SARIF report via --sarif-out — no second pass. miucr writes the
      # file only on a successful review, so a failed review leaves no file and the
      # caller's `hashFiles(...)`-guarded upload step is skipped (see the example).
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.github-token }}
        API_KEY: ${{ inputs.api-key }}
        BASE_URL: ${{ inputs.base-url }}
        MODEL: ${{ inputs.model }}
        GATE: ${{ inputs.gate }}
        FILTER_MODE: ${{ inputs.filter-mode }}
        SARIF_FILE: ${{ inputs.sarif-file }}
        SUGGEST: ${{ inputs.suggest }}
        PATCH_REPAIR: ${{ inputs.patch-repair }}
        PR_NUMBER: ${{ inputs.pr-number }}
        INSTRUCTION: ${{ inputs.instruction }}
      run: |
        set -euo pipefail
        # A gateway base-url means Bearer auth (ANTHROPIC_AUTH_TOKEN); plain
        # Anthropic uses x-api-key (ANTHROPIC_API_KEY). miucr rejects an
        # auth-token with no base-url, so set exactly one.
        if [ -n "$BASE_URL" ]; then
          export ANTHROPIC_AUTH_TOKEN="$API_KEY" ANTHROPIC_BASE_URL="$BASE_URL"
        else
          export ANTHROPIC_API_KEY="$API_KEY"
        fi
        if [ -n "$MODEL" ]; then export ANTHROPIC_MODEL="$MODEL"; fi
        if [ -z "$PR_NUMBER" ]; then echo "::error::miucr: pr-number is empty"; exit 1; fi
        REF="${GITHUB_REPOSITORY}#${PR_NUMBER}"
        ARGS=(review --pr "$REF" --post --gate "$GATE" --filter-mode "$FILTER_MODE" --deep-context --timeout 900s --conversation)
        if [ -n "$SARIF_FILE" ]; then ARGS+=(--sarif-out "$SARIF_FILE"); fi
        if [ "${SUGGEST:-}" = "true" ]; then ARGS+=(--suggest); fi
        if [ "${PATCH_REPAIR:-}" = "true" ]; then ARGS+=(--patch-repair); fi
        if [ -n "$INSTRUCTION" ]; then ARGS+=(--instruction "$INSTRUCTION"); fi
        # Retry on a RETRYABLE provider error (envelope retryable:true — e.g. a 529
        # overloaded / rate-limit), then soft-pass: a transient upstream outage must
        # not fail the check (it's not the PR's fault). A non-retryable error (or a
        # gate failure, which is not retryable) still fails as before.
        attempt=0; max=3
        while :; do
          attempt=$((attempt+1))
          # Capture combined stdout+stderr: the JSON envelope is on stdout but we
          # also surface stderr diagnostics in the log, and grep the envelope from
          # whichever stream it lands on.
          set +e
          out="$(miucr "${ARGS[@]}" 2>&1)"; rc=$?
          set -e
          printf '%s\n' "$out"
          [ "$rc" -eq 0 ] && break
          # Retry only on a FAILURE envelope marked retryable (require "ok":false so a
          # findings-mention of the literal "retryable":true can't trigger a false soft-pass);
          # tolerate optional whitespace.
          if printf '%s' "$out" | grep -q '"ok":[[:space:]]*false' && printf '%s' "$out" | grep -qE '"retryable":[[:space:]]*true'; then
            if [ "$attempt" -lt "$max" ]; then
              backoff=$(( attempt * 20 + RANDOM % 20 ))  # escalating + jittered: avoid a thundering herd
              echo "::warning::miucr review hit a retryable provider error (attempt $attempt/$max); retrying in ${backoff}s"
              sleep "$backoff"; continue
            fi
            echo "::warning::miucr review skipped: provider unavailable after $max attempts (transient upstream error, not a code issue)"
            exit 0
          fi
          exit "$rc"
        done