ai-review.yml

name: AI review

on:
  pull_request_target:
    types: [opened, labeled, unlabeled, synchronize, reopened, ready_for_review, converted_to_draft, closed]

permissions:
  contents: read

jobs:
  review:
    uses: stackrox/harness-openshell/.github/workflows/pr-review-reusable.yml@fb457d7b957d599efc7d816d92c0d2fccb3550b1
    with:
      # `uses` pins the workflow adapter; harness-ref pins the checked-out
      # Harness CLI/scripts. Keep both at the same release commit.
      harness-ref: fb457d7b957d599efc7d816d92c0d2fccb3550b1
      review-label: stackrox-ai-review
      allow-draft-reviews: false
      review-agent: codex
      codex-inference-provider: openai-inference
      codex-model: gpt-5.6-luna
      codex-workspace: codex-review
      codex-bootstrap: true
      required-providers: '["github-review", "openai-inference"]'
      openshell-github-app-client-id: ${{ vars.OPENSHELL_GITHUB_APP_CLIENT_ID }}
    secrets:
      VERTEX_AI_SERVICE_ACCOUNT_KEY: ${{ secrets.VERTEX_AI_SERVICE_ACCOUNT_KEY }}
      OPENSHELL_GITHUB_APP_PRIVATE_KEY: ${{ secrets.OPENSHELL_GITHUB_APP_PRIVATE_KEY }}
      OPENSHELL_CODEX_API_KEY: ${{ secrets.OPENSHELL_CODEX_API_KEY }}