Skip to content

Run public OCR reviews on hosted runners by request #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
VladimirBrejcha merged 1 commit into from
Aug 20, 2026
Merged

Run public OCR reviews on hosted runners by request #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 35 additions & 58 deletions .github/workflows/ocr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# OpenCodeReview PR auto-review — self-contained workflow for PUBLIC repos.
# OpenCodeReview PR on-demand review — self-contained workflow for PUBLIC repos.
# GitHub only lets public caller repos invoke PUBLIC reusable workflows, so
# simulator-broker / agent-skills cannot call the private
# fiveonecode/workflows reusable. This file inlines the proven job body from
Expand All @@ -11,31 +11,23 @@ name: OpenCodeReview PR Review
concurrency:
group: >-
${{
(
github.event_name == 'pull_request_target'
|| (
github.event_name == 'issue_comment'
&& github.event.issue.pull_request
&& github.event.comment.user.type != 'Bot'
&& (
github.event.comment.author_association == 'MEMBER'
|| github.event.comment.author_association == 'OWNER'
|| github.event.comment.author_association == 'COLLABORATOR'
)
&& (
startsWith(github.event.comment.body, '/open-code-review')
|| startsWith(github.event.comment.body, '@open-code-review')
)
)
github.event.issue.pull_request
&& github.event.comment.user.type != 'Bot'
&& (
github.event.comment.author_association == 'MEMBER'
|| github.event.comment.author_association == 'OWNER'
|| github.event.comment.author_association == 'COLLABORATOR'
)
&& format('ocr-{0}', github.event.pull_request.number || github.event.issue.number)
&& (
startsWith(github.event.comment.body, '/open-code-review')
|| startsWith(github.event.comment.body, '@open-code-review')
)
&& format('ocr-{0}', github.event.issue.number)
|| format('noop-{0}', github.run_id)
}}
cancel-in-progress: true

on:
pull_request_target:
types: [opened, synchronize, reopened]
issue_comment:
types: [created]

Expand All @@ -46,52 +38,37 @@ permissions:
jobs:
code-review:
if: |
github.event_name == 'pull_request_target'
|| (
github.event_name == 'issue_comment'
&& github.event.issue.pull_request
&& github.event.comment.user.type != 'Bot'
&& (
github.event.comment.author_association == 'MEMBER'
|| github.event.comment.author_association == 'OWNER'
|| github.event.comment.author_association == 'COLLABORATOR'
)
&& (
startsWith(github.event.comment.body, '/open-code-review')
|| startsWith(github.event.comment.body, '@open-code-review')
)
github.event.issue.pull_request
&& github.event.comment.user.type != 'Bot'
&& (
github.event.comment.author_association == 'MEMBER'
|| github.event.comment.author_association == 'OWNER'
|| github.event.comment.author_association == 'COLLABORATOR'
)
&& (
startsWith(github.event.comment.body, '/open-code-review')
|| startsWith(github.event.comment.body, '@open-code-review')
)
# Self-hosted; the org runner group is granted access to this public repo and
# forking is restricted so untrusted forks cannot schedule workflow runs here.
runs-on: self-hosted
# Public-repository reviews run only after an authorized member requests one,
# on GitHub's free, ephemeral standard runner.
runs-on: ubuntu-latest
timeout-minutes: 240
steps:
- name: Get PR context
id: pr-context
uses: actions/github-script@v7
with:
script: |
let baseRef, headSha, title, prNumber;
if (context.eventName === 'issue_comment') {
prNumber = context.issue.number;
const { data: pr } = await github.rest.pulls.get({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: prNumber,
});
baseRef = pr.base.ref;
headSha = pr.head.sha;
title = pr.title;
} else {
prNumber = context.payload.pull_request.number;
baseRef = context.payload.pull_request.base.ref;
headSha = context.payload.pull_request.head.sha;
title = context.payload.pull_request.title;
}
const prNumber = context.issue.number;
const { data: pr } = await github.rest.pulls.get({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: prNumber,
});
core.setOutput('pr_number', String(prNumber));
core.setOutput('base_ref', baseRef);
core.setOutput('head_sha', headSha);
core.setOutput('title', title);
core.setOutput('base_ref', pr.base.ref);
core.setOutput('head_sha', pr.head.sha);
core.setOutput('title', pr.title);

- name: Checkout base (trusted)
uses: actions/checkout@v4
Expand Down Expand Up @@ -195,4 +172,4 @@ jobs:
stickySummary: true,
incremental: true,
incrementalOverlapThreshold: parseFloat(process.env.OCR_INCREMENTAL_OVERLAP_THRESHOLD),
});
});
Loading