Review file

Optional `model` input. Defaults move to the mid tiers, `claude-sonnet-5` and `gpt-5.6-terra`, since a run follows a fixed template plus the project's checks; a workflow can still pass a bigger model.

Reviewed-on: #6
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

action.yml

@@ -20,10 +20,20 @@ inputs:
   bot-token:
     description: API key or token for the selected bot
     required: false
+  model:
+    description: >-
+      Model for the selected bot. Defaults to `claude-sonnet-5` or
+      `gpt-5.6-terra`, the mid tiers, which cover reviews and fixes.
+    required: false
 
 runs:
   using: composite
   steps:
+    # The agent works on the event's commit with full history, as the author.
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        token: ${{ inputs.author-token }}
     # This step assumes this is `node:24-bookworm` container.
     - name: Install dependencies
       shell: bash
@@ -35,6 +45,7 @@ runs:
         ACTION_PATH: ${{ gitea.action_path }}
         BOT_TYPE: ${{ inputs.bot-type }}
         BOT_TOKEN: ${{ inputs.bot-token }}
+        MODEL: ${{ inputs.model }}
         GITEA_API_URL: ${{ gitea.api_url }}
         GITEA_REPOSITORY: ${{ gitea.repository }}
         GITEA_TOKEN: ${{ inputs.author-token }}

prompt.md

@@ -13,17 +13,37 @@ response ends, so background monitors, scheduled wake-ups, and queued tasks
 never resume. Never promise future action and never claim to be waiting on a
 notification.
 
+The repository is checked out in the working directory at the event's commit,
+the head of the pull request when there is one, with full history and the
+author's push credentials. Read the code there, run its checks and tests when
+they bear on the task, and push from there.
+
 For a `pull_request` event, review the PR without changing code, using the
 `requesting-code-review` skill from superpowers: run its code reviewer template
-against the PR's base and head, and make its complete output your final response
+against the PR's base and head. Run the project's checks on the head and treat a
-instead of the short comment style above. Check the whole repository against the
+failure as at least Important. Check the whole repository against the code rules
-code rules at the end of this prompt, not only the diff; a violation is at least
+at the end of this prompt, not only the diff; a violation is at least Important
-Important even when the diff did not cause it. Your final response is posted as
+even when the diff did not cause it. Write the complete review, and nothing
-a pull request review from the bot account: it requests changes when it mentions
+else, to the file `${REVIEW_PATH}`: it is posted verbatim as a pull request
-`@bot` and approves otherwise, so the assessment instructs `@bot` to make the
+review from the bot account, and your final response is not posted at all. The
-fixes exactly when it is not `Yes`, and Minor issues alone never block. For UI
+file's first line must be exactly the template's verdict and nothing else:
-changes, check that the result is aligned, clean, and pixel-perfect, and that
+`Yes`, `No`, or `With fixes`. `Yes` approves and the other two request changes;
-included screenshots prove the intended result was achieved.
+any other first line is posted as a plain comment, which wastes the run. Minor
+issues alone never block, and neither does a finding the author has answered in
+the comment history below as intended or a false alarm, once the code or docs
+make that clear. When the verdict is not `Yes`, the second line names what must
+change in one line, addressed to the author; the author's own agent picks the
+fixes up, so never ask `@bot` to make them. For UI changes, check that the
+result is aligned, clean, and pixel-perfect, and that included screenshots prove
+the intended result was achieved.
+
+The review must read at a glance: everything outside `<details>` blocks totals
+under 512 bytes. Only core information stays visible: the verdict, the summary
+line, and the section headings. Anything verbose goes into a `<details>` block
+whose `<summary>` is a few words, such as the `file:line` and title of an issue
+with the what, why, and how inside; the same for each strength, each
+recommendation, the reasoning, and any compliance notes. Details blocks are
+top-level, never inside a list item, because Gitea breaks them there.
 
 For an `issue_comment` or `pull_request_review_comment` event, treat the `body`
 in the triggering comment payload below as the user's exact instruction.

run.ts

@@ -20,6 +20,13 @@ const EVENT = env("EVENT_NAME");
 const AUTHOR_TOKEN = env("GITEA_TOKEN");
 const REVIEWER_TOKEN = env("REVIEWER_TOKEN");
 const RULES_PATH = "repos/commons/code-rules/raw/README.md";
+// The mid tiers: a run follows a fixed template and the project's checks.
+const DEFAULT_MODELS: Record<string, string> = {
+  claude: "claude-sonnet-5",
+  codex: "gpt-5.6-terra",
+};
+const model = (bot: string): string =>
+  Deno.env.get("MODEL") || DEFAULT_MODELS[bot];
 
 // The reviewer token is withheld so the agent cannot approve as the bot.
 const { REVIEWER_TOKEN: _, ...agentEnv } = Deno.env.toObject();
@@ -52,19 +59,26 @@ async function postComment(body: string): Promise<void> {
   });
 }
 
-// A pull request event is a review request, so the response becomes a review:
+// A pull request event is a review request, so the review is posted instead
-// changes are requested when the agent asked @bot to fix something, a failed
+// of the response. It comes through a file, because a final chat message picks
-// run only comments, and anything else approves.
+// up narration while a file's first line is written on purpose. That line is
+// the verdict; anything unexpected only comments, never approves.
+const REVIEW_PATH = `${await Deno.makeTempDir()}/review.md`;
+const VERDICTS: Record<string, string> = {
+  Yes: "APPROVED",
+  No: "REQUEST_CHANGES",
+  "With fixes": "REQUEST_CHANGES",
+};
+
 async function postResult(body: string): Promise<void> {
   if (EVENT !== "pull_request") return postComment(body);
-  const event = body.includes("@bot")
+  const review = await Deno.readTextFile(REVIEW_PATH).catch(() => {
-    ? "REQUEST_CHANGES"
+    throw new Error(`no review was written to ${REVIEW_PATH}`);
-    : body.startsWith("Bot failed:")
+  });
-    ? "COMMENT"
+  const [verdict] = review.split("\n", 1);
-    : "APPROVED";
   await gitea(REVIEWER_TOKEN, `repos/${REPO}/pulls/${INDEX}/reviews`, {
-    body: stripAnsi(body),
+    body: stripAnsi(review),
-    event,
+    event: VERDICTS[verdict.trim()] ?? "COMMENT",
   });
 }
 
@@ -109,6 +123,7 @@ async function renderPrompt(): Promise<string> {
     GITEA_API_URL: API,
     GITEA_REPOSITORY: REPO,
     ISSUE_INDEX: INDEX,
+    REVIEW_PATH,
   };
   const template = await Deno.readTextFile(
     new URL("prompt.md", import.meta.url),
@@ -122,10 +137,9 @@ async function renderPrompt(): Promise<string> {
 async function runClaude(prompt: string): Promise<string> {
   const token = Deno.env.get("BOT_TOKEN");
   if (!token) {
-    await postComment(
+    throw new Error(
       "Run `claude setup-token` locally and set the `bot-token` action input.",
     );
-    Deno.exit(1);
   }
   await installSuperpowers("claude");
   const claude = new Deno.Command("claude", {
@@ -133,7 +147,7 @@ async function runClaude(prompt: string): Promise<string> {
       "--print",
       "--dangerously-skip-permissions",
       "--model",
-      "claude-fable-5",
+      model("claude"),
       "--output-format",
       "stream-json",
       "--verbose",
@@ -144,7 +158,7 @@ async function runClaude(prompt: string): Promise<string> {
     clearEnv: true,
     stdout: "piped",
   }).spawn();
-  let result = "Bot failed: no result";
+  let result: { result?: string; subtype: string } | undefined;
   // Print events as they stream so the runner does not kill the job as a zombie.
   const lines = claude.stdout
     .pipeThrough(new TextDecoderStream())
@@ -156,12 +170,13 @@ async function runClaude(prompt: string): Promise<string> {
       const text = part.thinking ?? part.text ?? part.name;
       if (text) console.log(text);
     }
-    if (event.type === "result") {
+    if (event.type === "result") result = event;
-      result = event.result ?? `Bot failed: ${event.subtype}`;
-    }
   }
   await claude.status;
-  return result;
+  if (result?.result === undefined) {
+    throw new Error(`claude ended with ${result?.subtype ?? "no result"}`);
+  }
+  return result.result;
 }
 
 // Posts the device code so a human can finish the login on the persisted home.
@@ -197,7 +212,7 @@ async function runCodex(prompt: string): Promise<string> {
     args: [
       "exec",
       "--model",
-      "gpt-5.5",
+      model("codex"),
       "--dangerously-bypass-approvals-and-sandbox",
       "--output-last-message",
       file,
@@ -212,9 +227,14 @@ async function runCodex(prompt: string): Promise<string> {
   return await Deno.readTextFile(file);
 }
 
-await configureGitAuthor();
+try {
-const prompt = await renderPrompt();
+  await configureGitAuthor();
-const result = env("BOT_TYPE") === "claude"
+  const prompt = await renderPrompt();
-  ? await runClaude(prompt)
+  const result = env("BOT_TYPE") === "claude"
-  : await runCodex(prompt);
+    ? await runClaude(prompt)
-await postResult(result);
+    : await runCodex(prompt);
+  await postResult(result);
+} catch (error) {
+  await postComment(`Bot failed: ${error}`);
+  throw error;
+}