bot_review.yml

name: "Bot: Review"

# Reusable workflow called by diffusers_bot.yml for `/diffusers-bot review`.
#
# A thin, VPN-side relay to the Serge GitHub App hosted at
# https://serge.huggingface.tech/. The App's /webhook endpoint sits behind a VPN
# that GitHub's own webhook delivery cannot reach, so a runner inside the VPN
# re-delivers the triggering comment event to the App.
#
# The relay reproduces a genuine GitHub App webhook delivery:
#   - body: the original event payload with `installation.id` injected (the App
#     needs it to mint an installation token; Actions payloads omit it) and the
#     `/diffusers-bot review` mention rewritten to the `@askserge` mention the
#     App matches on
#   - X-Hub-Signature-256: HMAC-SHA256 of that exact body using the App's
#     webhook secret (verified at webapp.py:_verify_webhook_signature)
#   - X-GitHub-Event: the original event name (issue_comment / pull_request_review_comment)
#
# All reviewing, diff fetching and comment posting happens server-side under the
# App identity, so this job needs no checkout and no write permissions.

on:
  workflow_call:
    secrets:
      SERGE_WEBHOOK_SECRET:
        required: true
      SERGE_INSTALLATION_ID:
        required: true

permissions: {}

jobs:
  relay:
    permissions: {}
    name: Relay to Serge
    concurrency:
      group: diffusers-bot-review-${{ github.event.issue.number || github.event.pull_request.number }}
      cancel-in-progress: false
    runs-on:
      group: aws-general-8-plus
    steps:
      - name: Relay event to the Serge GitHub App
        env:
          WEBHOOK_URL: https://serge.huggingface.tech/webhook
          # App webhook secret — must match the App's GITHUB_WEBHOOK_SECRET.
          WEBHOOK_SECRET: ${{ secrets.SERGE_WEBHOOK_SECRET }}
          # Installation id of the Serge App on this repo. Not sensitive, but the
          # App requires it in the payload to obtain an installation token.
          INSTALLATION_ID: ${{ secrets.SERGE_INSTALLATION_ID }}
          EVENT_NAME: ${{ github.event_name }}
          DELIVERY_ID: ${{ github.run_id }}-${{ github.run_attempt }}
        run: |
          set -euo pipefail

          if [ -z "${WEBHOOK_SECRET}" ]; then
            echo "::error::SERGE_WEBHOOK_SECRET secret is not set" >&2
            exit 1
          fi
          if [ -z "${INSTALLATION_ID}" ]; then
            echo "::error::SERGE_INSTALLATION_ID secret is not set" >&2
            exit 1
          fi

          # Inject installation.id and translate the mention, compact form.
          # The signed bytes and the POSTed bytes must be byte-identical, so we
          # write the body to a file and reuse it for both the HMAC and the POST.
          jq -c --argjson iid "${INSTALLATION_ID}" \
            '. + {installation: {id: $iid}} | .comment.body |= sub("/diffusers-bot review"; "@askserge")' \
            "${GITHUB_EVENT_PATH}" > payload.json

          SIG="sha256=$(openssl dgst -sha256 -hmac "${WEBHOOK_SECRET}" payload.json | awk '{print $NF}')"

          HTTP_CODE=$(curl --silent --show-error --fail-with-body \
            --output response.txt --write-out '%{http_code}' \
            --connect-timeout 10 --max-time 60 \
            --request POST "${WEBHOOK_URL}" \
            --header "Content-Type: application/json" \
            --header "X-GitHub-Event: ${EVENT_NAME}" \
            --header "X-GitHub-Delivery: ${DELIVERY_ID}" \
            --header "X-Hub-Signature-256: ${SIG}" \
            --data-binary @payload.json) || {
              echo "::error::Failed to deliver event to Serge App (HTTP ${HTTP_CODE:-000})" >&2
              cat response.txt >&2 || true
              exit 1
            }

          echo "Serge App responded with HTTP ${HTTP_CODE}"
          cat response.txt