Repository navigation
Python: fix(bedrock): map guardrail_intervened and model_context_window_exceeded stop reasons #650
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: DevFlow PR Review | ||
|
Check warning on line 1 in .github/workflows/devflow-pr-review.yml
|
||
| on: | ||
| pull_request_target: | ||
| types: | ||
| - opened | ||
| - reopened | ||
| - ready_for_review | ||
| workflow_dispatch: | ||
| inputs: | ||
| pr_number: | ||
| description: Pull request number to review | ||
| required: true | ||
| type: string | ||
| permissions: | ||
| contents: read | ||
| copilot-requests: write | ||
| id-token: write | ||
| concurrency: | ||
| group: devflow-pr-review-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }} | ||
| cancel-in-progress: true | ||
| env: | ||
| DEVFLOW_REPOSITORY: ${{ vars.DF_REPO }} | ||
| DEVFLOW_REF: main | ||
| TARGET_REPO_PATH: ${{ github.workspace }}/target-repo | ||
| DEVFLOW_PATH: ${{ github.workspace }}/devflow | ||
| MODEL_CONFIG_PATH: ${{ github.workspace }}/devflow/config.ci.yaml | ||
| jobs: | ||
| prepare_pr: | ||
| runs-on: ubuntu-latest | ||
| permissions: {} | ||
| outputs: | ||
| pr_number: ${{ steps.pr.outputs.pr_number }} | ||
| pr_url: ${{ steps.pr.outputs.pr_url }} | ||
| repo: ${{ steps.pr.outputs.repo }} | ||
| steps: | ||
| - name: Resolve PR metadata | ||
| id: pr | ||
| shell: bash | ||
| env: | ||
| PR_HTML_URL: ${{ github.event.pull_request.html_url }} | ||
| PR_NUMBER_EVENT: ${{ github.event.pull_request.number }} | ||
| PR_NUMBER_INPUT: ${{ inputs.pr_number }} | ||
| run: | | ||
| set -euo pipefail | ||
| if [[ "${GITHUB_EVENT_NAME}" == "pull_request_target" ]]; then | ||
| pr_number="${PR_NUMBER_EVENT}" | ||
| pr_url="${PR_HTML_URL}" | ||
| else | ||
| pr_number="${PR_NUMBER_INPUT}" | ||
| pr_url="https://github.com/${GITHUB_REPOSITORY}/pull/${pr_number}" | ||
| fi | ||
| if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]]; then | ||
| echo "Could not determine PR number; for workflow_dispatch runs, the 'pr_number' input is required when not running on pull_request_target." >&2 | ||
| exit 1 | ||
| fi | ||
| echo "pr_url=${pr_url}" >> "$GITHUB_OUTPUT" | ||
| echo "pr_number=${pr_number}" >> "$GITHUB_OUTPUT" | ||
| echo "repo=${GITHUB_REPOSITORY}" >> "$GITHUB_OUTPUT" | ||
| team_check: | ||
| needs: prepare_pr | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| environment: github-app-auth | ||
| outputs: | ||
| is_team_member: ${{ steps.check.outputs.is_team_member }} | ||
| steps: | ||
| - name: Checkout GitHub automation | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} | ||
| sparse-checkout: | | ||
| .github/actions/github-app-token | ||
| .github/scripts/check_team_membership.js | ||
| fetch-depth: 1 | ||
| persist-credentials: false | ||
| - name: Get GitHub automation token | ||
| id: github-auth | ||
| uses: ./.github/actions/github-app-token | ||
| with: | ||
| mode: ${{ vars.GH_APP_AUTH_MODE }} | ||
| azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} | ||
| azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} | ||
| azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} | ||
| key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} | ||
| key-name: ${{ secrets.GH_APP_KEY_NAME }} | ||
| github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} | ||
| github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} | ||
| repository: ${{ github.repository }} | ||
| permission-profile: team-check | ||
| fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} | ||
| - name: Check review requester team membership | ||
| id: check | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| env: | ||
| MEMBERSHIP_USER: ${{ github.event_name == 'workflow_dispatch' && github.actor || '' }} | ||
| TEAM_NAME: ${{ secrets.DEVELOPER_TEAM }} | ||
| PR_NUMBER: ${{ needs.prepare_pr.outputs.pr_number }} | ||
| with: | ||
| github-token: ${{ steps.github-auth.outputs.token }} | ||
| script: | | ||
| const checkTeamMembership = require('./.github/scripts/check_team_membership.js'); | ||
| const { author, isTeamMember } = await checkTeamMembership({ | ||
| github, | ||
| context, | ||
| teamSlug: process.env.TEAM_NAME, | ||
| prNumber: process.env.PR_NUMBER, | ||
| username: process.env.MEMBERSHIP_USER, | ||
| }); | ||
| core.setOutput('is_team_member', isTeamMember ? 'true' : 'false'); | ||
| if (isTeamMember) { | ||
| core.info(`User ${author} is a team member; proceeding with review.`); | ||
| } else { | ||
| core.info(`User ${author} is not a member of ${process.env.TEAM_NAME}; skipping review.`); | ||
| } | ||
| review: | ||
| runs-on: ubuntu-latest | ||
| needs: [prepare_pr, team_check] | ||
| if: ${{ needs.team_check.outputs.is_team_member == 'true' }} | ||
| environment: github-app-auth | ||
| timeout-minutes: 60 | ||
| steps: | ||
| - name: Checkout GitHub automation | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} | ||
| sparse-checkout: .github/actions/github-app-token | ||
| fetch-depth: 1 | ||
| persist-credentials: false | ||
| - name: Get GitHub automation token | ||
| id: github-auth | ||
| uses: ./.github/actions/github-app-token | ||
| with: | ||
| mode: ${{ vars.GH_APP_AUTH_MODE }} | ||
| azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }} | ||
| azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }} | ||
| azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }} | ||
| key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }} | ||
| key-name: ${{ secrets.GH_APP_KEY_NAME }} | ||
| github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }} | ||
| github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }} | ||
| repository: ${{ github.repository }} | ||
| permission-profile: devflow | ||
| fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }} | ||
| # Safe checkout: base repo only, not the untrusted PR head. | ||
| - name: Checkout target repo base | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| path: target-repo | ||
| # Private DevFlow checkout: the PAT/token grants access to this repo's code. | ||
| - name: Checkout DevFlow | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| repository: ${{ env.DEVFLOW_REPOSITORY }} | ||
| ref: ${{ env.DEVFLOW_REF }} | ||
| token: ${{ secrets.DEVFLOW_TOKEN }} | ||
| fetch-depth: 1 | ||
| persist-credentials: false | ||
| path: devflow | ||
| - name: Set up Python | ||
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | ||
| with: | ||
| python-version: "3.13" | ||
| - name: Set up uv | ||
| uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 | ||
| with: | ||
| version: "0.5.x" | ||
| enable-cache: true | ||
| - name: Install DevFlow dependencies | ||
| working-directory: ${{ env.DEVFLOW_PATH }} | ||
| run: uv sync --frozen | ||
| - name: Classify PR relevance | ||
| id: spam | ||
| working-directory: ${{ env.DEVFLOW_PATH }} | ||
| env: | ||
| DEVFLOW_GITHUB_TOKEN: ${{ steps.github-auth.outputs.token }} | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }} | ||
| AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }} | ||
| PR_REPO: ${{ needs.prepare_pr.outputs.repo }} | ||
| PR_NUMBER: ${{ needs.prepare_pr.outputs.pr_number }} | ||
| run: | | ||
| uv run python scripts/classify_pr_spam.py \ | ||
| --repo "$PR_REPO" \ | ||
| --pr-number "$PR_NUMBER" \ | ||
| --repo-path "${TARGET_REPO_PATH}" \ | ||
| --github-token "$DEVFLOW_GITHUB_TOKEN" \ | ||
| --apply-labels | ||
| - name: Stop after spam gate | ||
| if: ${{ steps.spam.outputs.decision != 'allow' }} | ||
| shell: bash | ||
| env: | ||
| SPAM_DECISION: ${{ steps.spam.outputs.decision }} | ||
| run: | | ||
| echo "Skipping review because spam gate decided: ${SPAM_DECISION}" | ||
| - name: Run PR review | ||
| if: ${{ steps.spam.outputs.decision == 'allow' }} | ||
| id: review | ||
| working-directory: ${{ env.DEVFLOW_PATH }} | ||
| env: | ||
| DEVFLOW_GITHUB_TOKEN: ${{ steps.github-auth.outputs.token }} | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }} | ||
| AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }} | ||
| PR_URL: ${{ needs.prepare_pr.outputs.pr_url }} | ||
| run: | | ||
| uv run python scripts/trigger_pr_review.py \ | ||
| --pr-url "$PR_URL" \ | ||
| --github-username "$GITHUB_ACTOR" \ | ||
| --github-token "$DEVFLOW_GITHUB_TOKEN" \ | ||
| --no-require-comment-selection | ||
