# Copyright 2025-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause
name: Codex PR Review

# This workflow does one simple thing - it posts a comment "@codex review" under the name of the person who has
# active OpenAI ChatGPT subscription with Codex integration to this repo enabled. This triggers Codex review.

# To update the token:
# If you have ChatGPT subscription, go to https://chatgpt.com/codex and Click "Enable Code Review".
# After that create your personal (scoped) Github token for ispc org with
# Pull Request and Issues "read and write" permissions and store that token in
# CODEX_TOKEN ispc github org secrets.

# zizmor is not wrong, but we need to access token in the target repo for the PR to make it work.
# The token is created with minimal scope possible.

# Temporary disable pull_requst_target due to unclear security policies.
on:
  #pull_requst_target:  # zizmor: ignore[dangerous-triggers]
  #  types: [opened, reopened]
  workflow_dispatch:  # Manual trigger
    inputs:
      pr_number:
        description: 'PR number to comment on'
        required: true
        type: number

permissions:
  contents: read

jobs:
  comment:
    runs-on: ubuntu-latest
    # The secret is available only in that repo.
    if: github.repository == 'ispc/ispc'
    steps:
      - name: Comment on PR
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ secrets.CODEX_TOKEN }}
          script: |
            const pr_number = parseInt(
              context.eventName === 'workflow_dispatch'
                ? context.payload.inputs.pr_number
                : context.issue.number
            );

            await github.rest.issues.createComment({
              issue_number: pr_number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '@codex review'
            });
