Автономний AI-ревʼюер коду в GitHub Pull Requests

[ Разработчик ] -> (Push & PR) -> [ GitHub Event (pull_request) ]
                                            |
                                            v
[ GitHub Actions Runner ] -> (Fetch Diff) -> [ Сборка контекста (Diff + AGENTS.md) ]
                                            |
                                            v
[ LLM API (Claude/GPT-4) ] <- (Анализ логики)
            |
            v
[ GitHub REST API ] -> (Post Inline Comments) -> [ Pull Request Interface ]

import * as core from '@actions/core';
import * as github from '@actions/github';
import { OpenAI } from 'openai';

async function run() {
    try {
        const token = core.getInput('github-token', { required: true });
        const openaiKey = core.getInput('openai-key', { required: true });
        const octokit = github.getOctokit(token);
        const openai = new OpenAI({ apiKey: openaiKey });

        const context = github.context;
        if (!context.payload.pull_request) {
            core.setFailed('This action runs only on pull_request events.');
            return;
        }

        const prNumber = context.payload.pull_request.number;
        const repo = context.repo;

        // 1. Получаем список измененных файлов и их diff
        const { data: files } = await octokit.rest.pulls.listFiles({
            ...repo,
            pull_number: prNumber,
        });

        for (const file of files) {
            if (file.status === 'removed' || !file.patch) continue;

            // 2. Формируем промпт для LLM
            const prompt = `
            Review the following code diff for the file ${file.filename}.
            Focus on:
            1. Security vulnerabilities (SQLi, XSS).
            2. Best practices and solid principles.
            3. Typescript/PHP strictness.
            Respond in JSON array format:
            [{ "line": <line_number>, "body": "<comment_text>" }]
            If the code looks good, return an empty array [].
            Diff:
            ${file.patch}
            `;

            const completion = await openai.chat.completions.create({
                model: 'gpt-4o',
                messages: [{ role: 'user', content: prompt }],
                response_format: { type: 'json_object' } // Принудительный JSON
            });

            const content = completion.choices[0].message.content || '{"reviews":[]}';
            const { reviews } = JSON.parse(content);

            // 3. Публикуем комментарии к конкретным строкам (Inline comments)
            for (const review of reviews) {
                await octokit.rest.pulls.createReviewComment({
                    ...repo,
                    pull_number: prNumber,
                    commit_id: context.payload.pull_request.head.sha,
                    path: file.filename,
                    body: `🤖 **AI Reviewer:**\n${review.body}`,
                    line: review.line,
                    side: 'RIGHT'
                });
            }
        }
    } catch (error: any) {
        core.setFailed(error.message);
    }
}

run();

name: AI Code Review
on: [pull_request]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - name: Run AI Reviewer
        uses: ./path-to-custom-action
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          openai-key: ${{ secrets.OPENAI_API_KEY }}