feat(integrations): add Zep MemoryStore for Strands Agents #115
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Codex PR Auto Review | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, ready_for_review, reopened] | |
| concurrency: | |
| group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-permission: | |
| # Secretless preflight: restrict paid, secret-bearing reviews to PR | |
| # authors with write access. A same-repo head check alone is not enough | |
| # on a public repository -- anyone can open a PR from an existing | |
| # upstream branch without push access -- so the author's repository | |
| # permission is verified explicitly. We don't gate on author_association | |
| # because private org membership reports as CONTRIBUTOR in event | |
| # payloads, which silently skips every review. | |
| if: >- | |
| github.event.pull_request.draft == false && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| github.event.pull_request.user.type != 'Bot' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| outputs: | |
| authorized: ${{ steps.check.outputs.authorized }} | |
| steps: | |
| - name: Check author repository permission | |
| id: check | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 | |
| with: | |
| github-token: ${{ github.token }} | |
| script: | | |
| const { data } = await github.rest.repos.getCollaboratorPermissionLevel({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| username: context.payload.pull_request.user.login, | |
| }); | |
| const authorized = ["admin", "maintain", "write"].includes(data.permission); | |
| core.info(`Author permission: ${data.permission} (authorized: ${authorized})`); | |
| core.setOutput("authorized", authorized ? "true" : "false"); | |
| review: | |
| needs: check-permission | |
| if: needs.check-permission.outputs.authorized == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| final_message: ${{ steps.codex.outputs.final-message }} | |
| steps: | |
| # Keep PR-controlled files out of the working tree. In particular, this | |
| # ensures the prompt and repository instructions come from the trusted | |
| # base revision even though this job receives OPENAI_API_KEY. | |
| - name: Checkout trusted base | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| # Download the PR as inert text rather than importing its untrusted Git | |
| # objects into the secret-bearing review job. | |
| - name: Download pull request diff | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| REPOSITORY: ${{ github.repository }} | |
| run: | | |
| set -euo pipefail | |
| mkdir -p .codex-review | |
| gh api \ | |
| -H "Accept: application/vnd.github.v3.diff" \ | |
| "repos/${REPOSITORY}/pulls/${PR_NUMBER}" \ | |
| > .codex-review/pr.diff | |
| test -s .codex-review/pr.diff | |
| - name: Run Codex review | |
| id: codex | |
| continue-on-error: true | |
| uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1 | |
| with: | |
| openai-api-key: ${{ secrets.OPENAI_API_KEY }} | |
| prompt-file: .github/codex/prompts/review.md | |
| permission-profile: ":read-only" | |
| post-review: | |
| needs: review | |
| if: needs.review.outputs.final_message != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write | |
| steps: | |
| - name: Post Codex review | |
| continue-on-error: true | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 | |
| env: | |
| CODEX_REVIEW: ${{ needs.review.outputs.final_message }} | |
| with: | |
| github-token: ${{ github.token }} | |
| script: | | |
| const maxLength = 60_000; | |
| let body = process.env.CODEX_REVIEW; | |
| if (body.length > maxLength) { | |
| body = `${body.slice(0, maxLength)}\n\n_Review truncated by the workflow._`; | |
| } | |
| await github.rest.pulls.createReview({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.payload.pull_request.number, | |
| event: "COMMENT", | |
| body, | |
| }); |