name: New PR Review

on:
  pull_request:
    types: [opened]

jobs:
  review:
    # Skip Version Packages PRs (auto-generated by the changesets action) since they don't need a Bonk review
    if: |
      github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name &&
      !(github.event.pull_request.base.repo.owner.login == 'cloudflare' && github.event.pull_request.head.ref == 'changeset-release/main')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: false
    permissions:
      id-token: write
      contents: read
      issues: write
      pull-requests: write
    steps:
      - name: Check if PR author is Cloudflare org member
        run: |
          STATUS=$(gh api \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "/orgs/cloudflare/members/${PR_AUTHOR}" \
            --silent -i 2>/dev/null | head -1 | awk '{print $2}') || true
          if [ "$STATUS" != "204" ]; then
            echo "User ${PR_AUTHOR} is not a member of the Cloudflare organization"
            exit 1
          fi
          echo "User ${PR_AUTHOR} is a Cloudflare org member"
        env:
          GH_TOKEN: ${{ secrets.READ_ONLY_ORG_GITHUB_TOKEN }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 30
          persist-credentials: false

      - name: Load review prompt
        id: prompt
        run: |
          {
            echo 'value<<EOF'
            echo "You are reviewing PR #${{ github.event.pull_request.number }} on ${{ github.repository }}."
            echo ""
            cat .github/bonk_reviewer.md
            echo EOF
          } >> "$GITHUB_OUTPUT"

      - name: Run Bonk
        uses: ask-bonk/ask-bonk/github@24832587005550860c8ad13fd96519e731ca632a # main
        env:
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_AI_GATEWAY_ACCOUNT_ID }}
          CLOUDFLARE_GATEWAY_ID: ${{ secrets.CF_AI_GATEWAY_NAME }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_AI_GATEWAY_TOKEN }}
        with:
          model: "cloudflare-ai-gateway/anthropic/claude-opus-4-8"
          variant: "high"
          forks: "false"
          permissions: write
          opencode_version: 1.15.13 # pin to this version as certain ones cause ProviderInitError issues
          prompt: ${{ steps.prompt.outputs.value }}