feat(bots): onboard reviewer-bot to pinned databricks-bot-engine #84
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Engineer Bot — follow-up. | |
| # | |
| # When someone replies to a review thread on a PR carrying the `engineer-bot` | |
| # label (or the label is applied), the bot re-evaluates the open threads in | |
| # catch-up mode, applies a fixup (or replies / marks blocked), and pushes to the | |
| # PR branch. Driven by this repo's .bot/ prompts. | |
| # | |
| # Like the author, this builds/runs the product (setup-poetry). Shared setup | |
| # (tokens + Node + engine install, PAT-free via an engine-scoped App token) is in | |
| # the local ./.github/actions/bot-prelude composite; this file owns checkout, | |
| # setup-poetry, and the followup run. Engine installed in REF mode pinned to a SHA. | |
| # | |
| # The gate below is the canonical label-gated form copied verbatim from the | |
| # engine dogfood (the single source of truth). It ANDs with the engine-side | |
| # floor; do not weaken it. | |
| name: Engineer Bot — Follow-up | |
| on: | |
| pull_request_review_comment: | |
| types: [created] | |
| # `engineer-bot` label applied → catch-up over pre-existing review threads. | |
| pull_request: | |
| types: [labeled] | |
| permissions: | |
| contents: write # push fixup commits to the PR branch | |
| pull-requests: write # post inline replies | |
| id-token: write # JFrog OIDC exchange for the engine/SDK/CLI install | |
| jobs: | |
| followup: | |
| # SECURITY + scope (CANONICAL label-gated model — verbatim from the engine): | |
| # - skip fork PRs — keep the model + App token out of untrusted code's reach; | |
| # - operate only on non-fork OPEN PRs carrying the `engineer-bot` label | |
| # (maintainer-applied opt-in; label requires triage+); | |
| # - comment path: trusted commenters only (OWNER/MEMBER/COLLABORATOR, or a | |
| # bot — reviewer-bot/Copilot), never the engineer-bot's own comments, and | |
| # never a reviewer-bot reconcile loopback; | |
| # - labeled path: the `engineer-bot` label was just applied by a human. | |
| if: >- | |
| github.event.pull_request.head.repo.fork == false | |
| && github.event.pull_request.state == 'open' | |
| && ( | |
| ( | |
| github.event_name == 'pull_request_review_comment' | |
| && contains(github.event.pull_request.labels.*.name, 'engineer-bot') | |
| && !startsWith(github.event.comment.user.login, 'peco-engineer-bot') | |
| && !contains(github.event.comment.body, '<!-- pr-review-bot:v1 reconcile -->') | |
| && ( | |
| contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) | |
| || ( | |
| github.event.comment.user.type == 'Bot' | |
| && ( | |
| startsWith(github.event.comment.user.login, 'peco-review-bot') | |
| || startsWith(github.event.comment.user.login, 'Copilot') | |
| || startsWith(github.event.comment.user.login, 'copilot') | |
| ) | |
| ) | |
| ) | |
| ) | |
| || ( | |
| github.event_name == 'pull_request' | |
| && github.event.action == 'labeled' | |
| && github.event.label.name == 'engineer-bot' | |
| && github.event.sender.type != 'Bot' | |
| && !startsWith(github.event.sender.login, 'peco-engineer-bot') | |
| ) | |
| ) | |
| environment: azure-prod # DATABRICKS_HOST / DATABRICKS_TOKEN live here | |
| runs-on: | |
| group: databricks-protected-runner-group | |
| labels: [linux-ubuntu-latest] | |
| timeout-minutes: 30 | |
| concurrency: | |
| group: engineer-bot-followup-pr-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| steps: | |
| # Checkout FIRST (remote action) so the local `./` composites resolve. | |
| # Check out the PR head BRANCH (not the merge ref) so fixups push back to | |
| # it. persist-credentials:false; the run step below sets an authenticated | |
| # push remote from the minted App token. | |
| - name: Checkout PR head branch | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.ref }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| # Python + connector deps via the repo's OWN setup-poetry action (JFrog | |
| # mirror + poetry lock + install) — egress-safe, tolerates a stale lock. | |
| # The agent runs `poetry run python -m pytest tests/unit` to verify fixups. | |
| - name: Setup Poetry + connector deps (for pytest self-verify) | |
| uses: ./.github/actions/setup-poetry | |
| with: | |
| python-version: '3.11' | |
| # Shared prelude: mint the engineer-bot token (pushes fixup commits, posts | |
| # replies) + the engine-scoped token, set up Node, install the engine. | |
| - name: Bot prelude (tokens + Node + engine install) | |
| id: prelude | |
| uses: ./.github/actions/bot-prelude | |
| with: | |
| app-id: ${{ secrets.ENGINEER_BOT_APP_ID }} | |
| private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }} | |
| # Engine pin lives in ONE place: bot-prelude's `engine-ref` default. | |
| # Bump it there to move all four bots in lockstep; override here only | |
| # to run this workflow against a different engine commit. | |
| # Run the follow-up. Inlines the engine's bot-run env contract for | |
| # engineer:followup, plus the authenticated push remote bot-run would set | |
| # up (followup pushes fixup commits via a plain `git push`, which doesn't | |
| # consult GH_TOKEN; the checkout is persist-credentials:false). | |
| - name: Run engineer follow-up (catch-up over all unaddressed threads) | |
| env: | |
| GH_TOKEN: ${{ steps.prelude.outputs.token }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| HEAD_BRANCH: ${{ github.event.pull_request.head.ref }} | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| TRIGGER_COMMENT_ID: ${{ github.event.comment.id }} | |
| MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations | |
| DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }} | |
| RUNNER_TEMP: ${{ runner.temp }} | |
| # The agent's working tree AND the .bot/ lookup root. run.py resolves | |
| # the config at <REPO_ROOT>/.bot/config.yaml. The engine has NO path | |
| # default — it fails with a clear error if this is unset — so it MUST be | |
| # set (we check out at the workspace root, not the driver-repo layout's | |
| # `internal-repo/`). (`TEST_REPO_ROOT` is the deprecated alias.) | |
| REPO_ROOT: ${{ github.workspace }} | |
| run: | | |
| git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" | |
| python -m databricks_bot_engine.engineer_bot.run --phase followup \ | |
| --system-prompt "$GITHUB_WORKSPACE/.bot/prompts/engineer-followup/system.md" |