name: Qoder Auto Code Review

# Manually triggered: add the "qoder-review" label to a PR. This avoids running
# on every commit (the previous `synchronize` trigger) and lets a maintainer
# decide when a review is needed. Because the trigger is pull_request_target,
# the job is natively associated with the PR head and shows up as a PR check.
on:
  pull_request_target:
    types: [labeled]

jobs:
  qoder-review:
    # Only run when the label added is exactly "qoder-review". Adding a label
    # requires write/triage access, so the labeling action is itself the human
    # gate that authorizes running fork PR code in this trusted context.
    if: github.event.label.name == 'qoder-review'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write

    steps:
      - name: Checkout PR head
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
          # Fork code checkout is opted in; the qoder-review label (settable only
          # by trusted users) is the gate that makes this safe.
          allow-unsafe-pr-checkout: true

      - name: Run Qoder Code Review
        uses: QoderAI/qoder-action@v0
        with:
          qoder_personal_access_token: ${{ secrets.QODER_PERSONAL_ACCESS_TOKEN }}
          prompt: |
            /review-pr
            REPO:${{ github.repository }} PR_NUMBER:${{ github.event.pull_request.number }}