From 1ce976e3c7aaba77519577e91206f6c6083ac48c Mon Sep 17 00:00:00 2001 From: Youichi Fujimoto Date: Sat, 18 Jul 2026 10:05:42 +0900 Subject: [PATCH] ci: adopt klein-cli AI review workflow Add an AI code-review workflow that delegates to klein-cli's published reusable workflow (fpt/klein-cli/.github/workflows/ai-review-reusable.yml). Runs klein review over each PR diff and posts a sticky summary plus inline comments. Gated to same-repo PRs so fork PRs never see the API-key secret. Requires the OPENAI_API_KEY repo secret. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ai-review.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/workflows/ai-review.yml diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml new file mode 100644 index 0000000..31316d1 --- /dev/null +++ b/.github/workflows/ai-review.yml @@ -0,0 +1,24 @@ +# AI code review, delegated to klein-cli's reusable workflow. +# +# Trust model: this uses `on: pull_request` (NOT pull_request_target) and the +# job is gated to same-repository branches below, so the API-key secret is only +# ever exposed to code from contributors who already have push access. Fork PRs +# get no secrets and are skipped. +name: AI Review + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + pull-requests: write + +jobs: + review: + if: github.event.pull_request.head.repo.full_name == github.repository + uses: fpt/klein-cli/.github/workflows/ai-review-reusable.yml@main + with: + language: en + secrets: + openai-api-key: ${{ secrets.OPENAI_API_KEY }}