[vgpopov]

What

A block repo on node-simple-pnpm.yaml@v4-beta gets an AI review of its PR when the PR has the ai-review label.

• node-simple-pnpm.yaml: a new job ai-review on pull_request that calls block-review.yaml.
• .github/workflows/block-review.yaml (reusable):
  • reads the PR labels the PR has now (a re-run gets the labels of the first run);
  • checks that secrets.env holds ANTHROPIC_API_KEY, and fails with an error that says where to add it;
  • when the repo has no .reviewrules/config.json, writes the settings for the run: the block rule set from block-review-rules at v0.1.0 and the block ignore patterns. Nothing is committed.
• actions/review/reviewrules: installs reviewrules, reviews the diff (Haiku for the rules, Opus at medium effort for the bug hypotheses), and posts each finding as a review comment on its line. A finding outside the diff lines goes to the review body. A hidden marker stops a re-run from posting the same finding again. The artifact reviewrules-attempt-<n> holds report.json and the model sessions.

Setup in a block repo

In .github/workflows/build.yaml:

1. Use node-simple-pnpm.yaml@v4-beta.
2. Add "ANTHROPIC_API_KEY": ${{ toJSON(secrets.ANTHROPIC_API_KEY) }} to secrets.env. The org secret exists.

Then add the ai-review label to a PR. build.yaml starts on opened, synchronize, and reopened, so the review runs on the next push, or when you re-run the "AI review" job.

Needed before use

• Save the model sessions of an API backend run with --session-dir popoffvg/reviewrules#3 (the --session-dir flag). The action pins its commit 81894bc; move the pin to the merge commit after a squash merge.
• Read access to the private milaboratory/block-review-rules for the fetch: make it public, or put REVIEWRULES_RULE_SETS_TOKEN in secrets.env.

Tested

• The action on Test the AI review CI (do not merge) platforma-open/antibody-variant-designer#7 (a test PR with three planted rule violations): 7 line comments on the right lines; the re-run posted no rule finding again and uploaded the artifact with report.json and 33 session files.
• post-review.js with a fake GitHub client: line placement, findings outside the diff, no repeat on a second run.
• actionlint on both workflows.
• Not run yet: the ai-review job inside node-simple-pnpm.yaml. It calls @v4-beta refs, which hold the review action only after this PR merges.

🤖 Generated with Claude Code

[greptile-apps]

Automatic reviews are disabled for this repository. Configure in Code Review Settings.