Gadfly: agentic adversarial PR reviewer (initial extraction)
Standalone, Docker-packaged extraction of the agentic PR reviewer that runs in Gitea Actions: reads the checked-out repo with read-only tools (read_file/grep/ find_files/get_diff), verifies findings before reporting, two-pass review + adversarial recheck, posts one labeled comment per model. Advisory only. - cmd/gadfly: reviewer binary (majordomo + Ollama Cloud), zero deps beyond stdlib + majordomo - entrypoint.sh: container brains — trigger gating, PR clone, model loop (logic out of YAML) - Dockerfile: multi-stage; build-time module token never reaches the final image - .gitea/workflows/build-image.yml: tag v* → build & push image - examples/: ~15-line consumer stub - system prompt genericized + hardened to re-derive constants/formulas (semantic bugs) Vibe-coded with Claude Code; see README disclosure. Advisory, never blocks merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Steve Dudenhoeffer
+135
@@ -0,0 +1,135 @@
|
||||
#!/usr/bin/env bash
|
||||
# Gadfly container entrypoint.
|
||||
#
|
||||
# This is the brains that used to live in the Gitea Actions workflow YAML. A
|
||||
# consuming repo only commits a ~15-line stub workflow that runs this image and
|
||||
# passes the event context as env; ALL the gating, cloning, model-looping and
|
||||
# comment I/O happens here, so the stub stays dumb (act_runner has weak YAML
|
||||
# expression support — keep logic in the image, not the workflow).
|
||||
#
|
||||
# What it does:
|
||||
# 1. Decides whether this event should trigger a review (draft skip, comment
|
||||
# trigger phrase + allowed-user gate, PR detection). Non-triggers exit 0.
|
||||
# 2. Acknowledges a comment trigger with a 👀 reaction.
|
||||
# 3. Shallow-clones the PR's head branch (the agentic reviewer reads the
|
||||
# checked-out tree to VERIFY findings, not just the diff).
|
||||
# 4. Runs the gadfly reviewer once per configured model via run.sh, which
|
||||
# upserts one labeled PR comment per model.
|
||||
#
|
||||
# Advisory only: it never blocks a merge. Config/usage errors exit non-zero;
|
||||
# everything review-related is posted as a comment, never a failed check.
|
||||
#
|
||||
# Env (set by the consumer's stub workflow from the github.* context):
|
||||
# GITEA_API https://HOST/api/v1/repos/OWNER/REPO (required)
|
||||
# GITEA_TOKEN built-in Actions token (posts comments) (required)
|
||||
# OLLAMA_CLOUD_API_KEY Ollama Cloud key; empty => "not configured" notice
|
||||
# EVENT_NAME pull_request | issue_comment | workflow_dispatch (required)
|
||||
# PR pull request number (required)
|
||||
# PR_BRANCH head branch (github.head_ref); empty => fetched from API
|
||||
# IS_DRAFT 'true' on a draft PR => skipped
|
||||
# COMMENT_BODY comment text (issue_comment only)
|
||||
# COMMENT_ID comment id, for the 👀 reaction (issue_comment only)
|
||||
# ACTOR github.actor (the user who triggered)
|
||||
# Optional config:
|
||||
# OLLAMA_REVIEW_MODELS comma-separated model ids (default below)
|
||||
# GADFLY_TRIGGER_PHRASE comment phrase that triggers a re-review (default "@gadfly review")
|
||||
# GADFLY_ALLOWED_USERS comma-separated usernames allowed to comment-trigger;
|
||||
# empty => fall back to "is a repo collaborator"
|
||||
set -uo pipefail
|
||||
|
||||
DEFAULT_MODELS="qwen3-coder:480b-cloud,gpt-oss:120b-cloud"
|
||||
TRIGGER_PHRASE="${GADFLY_TRIGGER_PHRASE:-@gadfly review}"
|
||||
SCRIPTS_DIR="/app/scripts"
|
||||
WORKDIR="${WORKDIR:-/tmp/gadfly}"
|
||||
|
||||
log() { echo "[gadfly] $*" >&2; }
|
||||
die() { log "ERROR: $*"; exit 1; }
|
||||
|
||||
: "${GITEA_API:?GITEA_API required}"
|
||||
: "${GITEA_TOKEN:?GITEA_TOKEN required}"
|
||||
: "${PR:?PR required}"
|
||||
: "${EVENT_NAME:?EVENT_NAME required}"
|
||||
|
||||
API() { curl -fsS --connect-timeout 20 --max-time 30 -H "Authorization: token ${GITEA_TOKEN}" "$@"; }
|
||||
|
||||
# --- is the commenter allowed to trigger a re-review? ----------------------
|
||||
actor_allowed() {
|
||||
local actor="$1"
|
||||
[ -z "$actor" ] && return 1
|
||||
if [ -n "${GADFLY_ALLOWED_USERS:-}" ]; then
|
||||
local IFS=','
|
||||
for u in $GADFLY_ALLOWED_USERS; do
|
||||
[ "$(echo "$u" | tr -d '[:space:]')" = "$actor" ] && return 0
|
||||
done
|
||||
return 1
|
||||
fi
|
||||
# No explicit allow-list: allow anyone with collaborator (write) access.
|
||||
local code
|
||||
code="$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 20 --max-time 30 \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" "${GITEA_API}/collaborators/${actor}")"
|
||||
[ "$code" = "204" ]
|
||||
}
|
||||
|
||||
# --- trigger gating --------------------------------------------------------
|
||||
case "$EVENT_NAME" in
|
||||
workflow_dispatch)
|
||||
log "manual dispatch for PR #${PR}" ;;
|
||||
pull_request)
|
||||
if [ "${IS_DRAFT:-false}" = "true" ]; then
|
||||
log "PR #${PR} is a draft; skipping"; exit 0
|
||||
fi
|
||||
log "new/updated PR #${PR}" ;;
|
||||
issue_comment)
|
||||
case "${COMMENT_BODY:-}" in
|
||||
*"$TRIGGER_PHRASE"*) : ;;
|
||||
*) log "comment does not contain trigger phrase ${TRIGGER_PHRASE}; skipping"; exit 0 ;;
|
||||
esac
|
||||
if ! actor_allowed "${ACTOR:-}"; then
|
||||
log "actor '${ACTOR:-}' not allowed to trigger; skipping"; exit 0
|
||||
fi
|
||||
# Must be a comment on a PR, not a plain issue.
|
||||
if ! API "${GITEA_API}/pulls/${PR}" >/dev/null 2>&1; then
|
||||
log "issue #${PR} is not a pull request; skipping"; exit 0
|
||||
fi
|
||||
# Acknowledge with 👀.
|
||||
if [ -n "${COMMENT_ID:-}" ]; then
|
||||
curl -s -X POST -H "Authorization: token ${GITEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
"${GITEA_API}/issues/comments/${COMMENT_ID}/reactions" -d '{"content":"eyes"}' >/dev/null 2>&1 || true
|
||||
fi
|
||||
log "comment-triggered review for PR #${PR} by ${ACTOR:-?}" ;;
|
||||
*)
|
||||
log "event '${EVENT_NAME}' not handled; skipping"; exit 0 ;;
|
||||
esac
|
||||
|
||||
# --- resolve head branch ---------------------------------------------------
|
||||
BRANCH="${PR_BRANCH:-}"
|
||||
if [ -z "$BRANCH" ]; then
|
||||
BRANCH="$(API "${GITEA_API}/pulls/${PR}" | jq -r '.head.ref // ""')"
|
||||
fi
|
||||
[ -z "$BRANCH" ] && die "could not determine PR #${PR} head branch"
|
||||
|
||||
# --- clone the PR's checked-out tree (shallow) -----------------------------
|
||||
HOST="${GITEA_API%%/api/v1/*}" # https://host
|
||||
REPO_PATH="${GITEA_API##*/api/v1/repos/}" # owner/repo
|
||||
CLONE_URL="https://token:${GITEA_TOKEN}@${HOST#https://}/${REPO_PATH}.git"
|
||||
REPO_DIR="${WORKDIR}/repo"
|
||||
rm -rf "$REPO_DIR"; mkdir -p "$WORKDIR"
|
||||
log "cloning ${REPO_PATH} @ ${BRANCH}"
|
||||
git clone --depth=1 --branch "$BRANCH" "$CLONE_URL" "$REPO_DIR" 2>/dev/null \
|
||||
|| die "clone of ${REPO_PATH}@${BRANCH} failed"
|
||||
|
||||
# --- review once per model -------------------------------------------------
|
||||
MODELS="${OLLAMA_REVIEW_MODELS:-$DEFAULT_MODELS}"
|
||||
log "models: ${MODELS}"
|
||||
IFS=',' read -ra ARR <<< "$MODELS" || true
|
||||
for raw in "${ARR[@]}"; do
|
||||
m="$(echo "$raw" | tr -d '[:space:]')"
|
||||
[ -z "$m" ] && continue
|
||||
log "::: reviewing with ${m}"
|
||||
PROVIDER=ollama \
|
||||
MODEL="$m" \
|
||||
GADFLY_BIN="/usr/local/bin/gadfly" \
|
||||
GADFLY_REPO_DIR="$REPO_DIR" \
|
||||
bash "${SCRIPTS_DIR}/run.sh" || log "model ${m} failed (continuing)"
|
||||
done
|
||||
log "done"
|
||||
Reference in New Issue
Block a user