coderabbit-threads-resolved.yml

# Fail when CodeRabbit left unresolved, non-outdated PR review threads.
#
# Required on `master` (branch ruleset) as check name:
#   coderabbit-threads-resolved
#
# Why: the CodeRabbit App status only means "review finished", not "findings cleared".
# This job is the merge gate for CodeRabbit. SonarCloud is its own App (no bridge WF).
#
# After resolving threads without a new push, re-run via workflow_dispatch (pr_number).

name: CodeRabbit Threads Resolved

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  pull_request_review:
    types: [submitted, dismissed]
  check_run:
    types: [completed]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to evaluate (required when dispatching manually)"
        required: true
        type: string

concurrency:
  group: coderabbit-threads-${{ github.event.pull_request.number || github.event.inputs.pr_number || github.sha }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

jobs:
  coderabbit-threads-resolved:
    name: coderabbit-threads-resolved
    if: >
      github.event_name != 'check_run' ||
      contains(github.event.check_run.name, 'CodeRabbit')
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Require CodeRabbit review threads resolved
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT_NAME: ${{ github.event_name }}
          PR_NUMBER_INPUT: ${{ github.event.inputs.pr_number || '' }}
          PR_NUMBER_EVENT: ${{ github.event.pull_request.number || '' }}
          HEAD_SHA_PR: ${{ github.event.pull_request.head.sha || '' }}
          HEAD_SHA_CHECK: ${{ github.event.check_run.head_sha || '' }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail

          PR_NUMBER="${PR_NUMBER_INPUT:-}"
          case "$EVENT_NAME" in
            pull_request|pull_request_review)
              PR_NUMBER="${PR_NUMBER_EVENT}"
              HEAD_SHA="$HEAD_SHA_PR"
              ;;
            check_run)
              HEAD_SHA="$HEAD_SHA_CHECK"
              ;;
            workflow_dispatch)
              HEAD_SHA="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq .head.sha)"
              ;;
            *)
              HEAD_SHA="${GITHUB_SHA}"
              ;;
          esac

          if [[ -z "${PR_NUMBER}" && -n "${HEAD_SHA:-}" ]]; then
            PR_NUMBER="$(
              gh api "repos/${REPO}/commits/${HEAD_SHA}/pulls" \
                --jq '.[0].number // empty' 2>/dev/null || true
            )"
          fi

          if [[ -z "${PR_NUMBER}" ]]; then
            echo "::notice::No PR for this event; nothing to gate."
            exit 0
          fi

          echo "Evaluating CodeRabbit threads on PR #${PR_NUMBER}"

          OWNER="${REPO%/*}"
          NAME="${REPO#*/}"
          QUERY='query($owner:String!, $repo:String!, $number:Int!, $cursor:String) {
            repository(owner:$owner, name:$repo) {
              pullRequest(number:$number) {
                reviewThreads(first:100, after:$cursor) {
                  pageInfo { hasNextPage endCursor }
                  nodes {
                    isResolved
                    isOutdated
                    comments(first:1) {
                      nodes { author { login } url body }
                    }
                  }
                }
              }
            }
          }'

          ALL_NODES='[]'
          CURSOR=""
          while true; do
            ARGS=(-f query="$QUERY" -F owner="$OWNER" -F repo="$NAME" -F number="$PR_NUMBER")
            if [[ -n "$CURSOR" ]]; then
              ARGS+=(-f cursor="$CURSOR")
            else
              ARGS+=(-F cursor=null)
            fi
            RESPONSE="$(gh api graphql "${ARGS[@]}")"
            if ! echo "$RESPONSE" | jq -e '
              ((.errors // []) | length == 0) and
              (.data.repository.pullRequest.reviewThreads as $threads |
                ($threads.nodes | type) == "array" and
                ($threads.pageInfo.hasNextPage | type) == "boolean" and
                all($threads.nodes[];
                  (.isResolved | type) == "boolean" and
                  (.isOutdated | type) == "boolean" and
                  (.comments.nodes | type) == "array" and
                  (.comments.nodes | length) > 0))' >/dev/null; then
              echo "::error::Could not read complete review threads. Retry this check; do not treat it as approval."
              exit 1
            fi
            PAGE_NODES="$(echo "$RESPONSE" | jq -c '.data.repository.pullRequest.reviewThreads.nodes // []')"
            ALL_NODES="$(jq -cn --argjson a "$ALL_NODES" --argjson b "$PAGE_NODES" '$a + $b')"
            HAS_NEXT="$(echo "$RESPONSE" | jq -r '.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage')"
            CURSOR="$(echo "$RESPONSE" | jq -r '.data.repository.pullRequest.reviewThreads.pageInfo.endCursor // empty')"
            if [[ "$HAS_NEXT" == "true" && -z "$CURSOR" ]]; then
              echo "::error::Review thread pagination is incomplete. Retry this check."
              exit 1
            fi
            [[ "$HAS_NEXT" == "true" ]] || break
          done

          OPEN_JSON="$(
            echo "$ALL_NODES" | jq -c '
              [.[]?
               | select(.isResolved == false and .isOutdated == false)
               | select(
                   ((.comments.nodes[0].author.login // "") | ascii_downcase)
                   | contains("coderabbit")
                 )
               | {
                   author: (.comments.nodes[0].author.login // "unknown"),
                   url: (.comments.nodes[0].url // ""),
                   preview: (
                     (.comments.nodes[0].body // "")
                     | gsub("\r"; "")
                     | split("\n")
                     | map(select(length > 0))
                     | .[0] // ""
                     | .[0:160]
                   )
                 }
              ]
            '
          )"

          COUNT="$(echo "$OPEN_JSON" | jq 'length')"
          if ! [[ "$COUNT" =~ ^[0-9]+$ ]]; then
            echo "::error::Could not count review threads. Retry this check."
            exit 1
          fi
          echo "open_coderabbit_threads=${COUNT}"
          if [[ "$COUNT" -gt 0 ]]; then
            echo "### Unresolved CodeRabbit review threads (${COUNT})"
            echo "$OPEN_JSON" | jq -r '.[] | "- **@\(.author)**: \(.preview)\n  \(.url)"'
            echo "::error::${COUNT} unresolved CodeRabbit review thread(s) on PR #${PR_NUMBER}"
            echo "Address each finding, mark the thread Resolved, then re-run this workflow or push."
            exit 1
          fi

          echo "All CodeRabbit review threads are resolved (or outdated)."