Skip to content

fix: add fork PR support, bounded diff, and explicit validation skip telemetry #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
factory-nizar wants to merge 1 commit into from
+2,144 −63
Closed

fix: add fork PR support, bounded diff, and explicit validation skip telemetry #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,7 +346,9 @@ runs:
GITHUB_EVENT_NAME: ${{ github.event_name }}
TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
IS_PR: ${{ github.event.issue.pull_request != null || github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review_comment' }}
DROID_SUCCESS: ${{ (steps.prepare.outputs.run_code_review == 'true' && ((steps.prepare_validator.outputs.validator_should_run == 'false' && steps.droid.outputs.conclusion == 'success') || (steps.prepare_validator.outputs.validator_should_run != 'false' && steps.droid_validator.outputs.conclusion == 'success'))) || (steps.prepare.outputs.run_code_review != 'true' && steps.droid.outputs.conclusion == 'success') }}
DROID_SUCCESS: ${{ (steps.prepare.outputs.run_code_review == 'true' && steps.prepare_validator.outputs.validator_should_run != 'false' && steps.droid_validator.outputs.conclusion == 'success') || (steps.prepare.outputs.run_code_review != 'true' && steps.droid.outputs.conclusion == 'success') }}
REVIEW_OUTCOME: ${{ steps.prepare_validator.outputs.review_outcome || (steps.droid_validator.outputs.conclusion == 'success' && 'succeeded') || 'failed' }}
VALIDATION_SKIP_REASON: ${{ steps.prepare_validator.outputs.validation_skip_reason || '' }}
TRIGGER_USERNAME: ${{ github.event.comment.user.login || github.event.issue.user.login || github.event.pull_request.user.login || github.event.sender.login || github.triggering_actor || github.actor || '' }}
PREPARE_SUCCESS: ${{ steps.prepare.outcome == 'success' }}
PREPARE_ERROR: ${{ steps.prepare.outputs.prepare_error || '' }}
Expand Down
28 changes: 14 additions & 14 deletions docs/gitlab-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,20 +77,20 @@ the `droid-review` job. Expect ~5-10 minutes for a typical change.

## Inputs

| Input | Default | Description |
| ---------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `automatic_review` | `"true"` | Run code review automatically on every MR pipeline. |
| `automatic_security_review` | `"false"` | Run a parallel security-focused subagent on every MR pipeline. Findings are prefixed `[security]` and posted alongside code-review comments. |
| `review_depth` | `"deep"` | `"deep"` (thorough) or `"shallow"` (fast). |
| `review_model` | `""` | Override the model. Empty = use depth preset. |
| `reasoning_effort` | `""` | Override reasoning effort. Empty = use depth preset. |
| `include_suggestions` | `"true"` | Include code suggestion blocks in review comments when the fix is high-confidence. |
| `security_block_on_critical` | `"true"` | Block merge on CRITICAL security findings. (Mirrors GitHub action; surface-level parity.) |
| `security_block_on_high` | `"false"` | Block merge on HIGH security findings. (Mirrors GitHub action; surface-level parity.) |
| `settings` | `""` | Droid Exec settings as a JSON string or a path to a JSON file. Merged into `~/.factory/droid/settings.json` before each `droid exec` call. |
| `org_guidelines_source` | `""` | Org-wide review guidelines source: a local file path on the runner, an http(s) URL to the raw markdown, a git clone URL ending in `.git`, or a GitLab project path (e.g. `my-group/review-guidelines`) cloned with `$CI_JOB_TOKEN`. Empty = disabled. |
| `org_guidelines_ref` | `""` | Git sources only: branch or tag of the org guidelines repo. Empty = default branch. |
| `org_guidelines_path` | `"review-guidelines.md"` | Git sources only: path of the guidelines markdown file inside the org guidelines repo. |
| Input | Default | Description |
| ---------------------------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `automatic_review` | `"true"` | Run code review automatically on every MR pipeline. |
| `automatic_security_review` | `"false"` | Run a parallel security-focused subagent on every MR pipeline. Findings are prefixed `[security]` and posted alongside code-review comments. |
| `review_depth` | `"deep"` | `"deep"` (thorough) or `"shallow"` (fast). |
| `review_model` | `""` | Override the model. Empty = use depth preset. |
| `reasoning_effort` | `""` | Override reasoning effort. Empty = use depth preset. |
| `include_suggestions` | `"true"` | Include code suggestion blocks in review comments when the fix is high-confidence. |
| `security_block_on_critical` | `"true"` | Block merge on CRITICAL security findings. (Mirrors GitHub action; surface-level parity.) |
| `security_block_on_high` | `"false"` | Block merge on HIGH security findings. (Mirrors GitHub action; surface-level parity.) |
| `settings` | `""` | Droid Exec settings as a JSON string or a path to a JSON file. Merged into `~/.factory/droid/settings.json` before each `droid exec` call. |
| `org_guidelines_source` | `""` | Org-wide review guidelines source: a local file path on the runner, an http(s) URL to the raw markdown, a git clone URL ending in `.git`, or a GitLab project path (e.g. `my-group/review-guidelines`) cloned with `$CI_JOB_TOKEN`. Empty = disabled. |
| `org_guidelines_ref` | `""` | Git sources only: branch or tag of the org guidelines repo. Empty = default branch. |
| `org_guidelines_path` | `"review-guidelines.md"` | Git sources only: path of the guidelines markdown file inside the org guidelines repo. |

## Org-wide review guidelines

Expand Down
24 changes: 24 additions & 0 deletions gitlab/examples/variants/mapped-variables.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# Variant: CI/CD variables that are not named FACTORY_API_KEY / GITLAB_TOKEN
#
# Drop at `factory/droid-review.yml` (replacing the default example) when
# your project already stores these credentials under different names.
#
# Mapping only works when the two names DIFFER. Never write
# `GITLAB_TOKEN: $GITLAB_TOKEN`: GitLab treats a variable that references
# itself as a circular reference, leaves it unexpanded, and the job
# receives the literal string `$GITLAB_TOKEN`. Variables that already have
# the expected names need no `variables:` block at all — every job
# inherits them.

include:
- project: "factory-components/droid-action"
ref: main
file: "/templates/droid-review.yml"
inputs:
automatic_review: "true"
review_depth: "deep"

droid-review:
variables:
FACTORY_API_KEY: $FACTORY_AI_KEY_SHARED
GITLAB_TOKEN: $DROID_REVIEW_BOT_TOKEN
27 changes: 27 additions & 0 deletions gitlab/examples/variants/monorepo-paths.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Variant: only review the parts of a monorepo that matter
#
# Drop at `factory/droid-review.yml`. Overriding `rules:` replaces the
# component's own rule, so the `merge_request_event` condition has to be
# repeated here — without it the job would try to run on branch pipelines,
# where there is no MR to review and prepare exits as a no-op.
#
# `stage:` must name a stage that exists in your `.gitlab-ci.yml`
# `stages:` list. `review` below is an example; the component defaults to
# `test`.

include:
- project: "factory-components/droid-action"
ref: main
file: "/templates/droid-review.yml"
inputs:
automatic_review: "true"
review_depth: "deep"
stage: "review"

droid-review:
rules:
- if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
changes:
- "services/api/**/*"
- "services/worker/**/*"
- "packages/shared/**/*"
24 changes: 24 additions & 0 deletions gitlab/examples/variants/on-demand.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# Variant: review only when someone asks for it
#
# Drop at `factory/droid-review.yml`. The job appears in every MR pipeline
# but waits for a click in the pipeline view, so reviews cost nothing until
# a human wants one — useful while trialling Droid on a busy project.
#
# `allow_failure: true` keeps a failed or unrun review from turning the MR
# pipeline red. Drop it once you want review failures to be blocking.
#
# Keep `automatic_review: "true"`: it controls whether the job reviews when
# it runs, while `when: manual` controls whether it runs at all. Setting the
# input to "false" would make the manual job a no-op.

include:
- project: "factory-components/droid-action"
ref: main
file: "/templates/droid-review.yml"
inputs:
automatic_review: "true"
review_depth: "deep"

droid-review:
when: manual
allow_failure: true
26 changes: 26 additions & 0 deletions gitlab/examples/variants/security-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# Variant: code review plus a parallel security reviewer
#
# Drop at `factory/droid-review.yml`. Adds a security-focused subagent that
# runs alongside the regular review; its findings are prefixed
# `[security]` and posted as inline comments like any other finding, and
# the tracking note gains a security badge.
#
# `security_block_on_*` exist for parity with the GitHub action and are
# accepted here, but nothing in the GitLab path enforces them yet: CRITICAL
# and HIGH findings are reported as comments, not merge blockers. To gate
# merges today, use GitLab's own controls (a required approval rule, or a
# job that fails on the finding counts in `.droid-debug/`).
#
# Security review adds a second reviewer pass, so expect the job to take
# roughly 1.5-2x as long as review alone.

include:
- project: "factory-components/droid-action"
ref: main
file: "/templates/droid-review.yml"
inputs:
automatic_review: "true"
review_depth: "deep"
automatic_security_review: "true"
security_block_on_critical: "true"
security_block_on_high: "false"
34 changes: 34 additions & 0 deletions gitlab/examples/variants/self-managed.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Variant: self-managed GitLab
#
# Drop at `factory/droid-review.yml`. `include: project:` only resolves
# projects on the same GitLab instance, so a self-managed instance needs a
# mirror of droid-action (import it once, then pull updates on whatever
# cadence you like).
#
# Two refs point at that mirror and should match:
# * `include: ref:` — where the component YAML is read from at pipeline
# creation time.
# * `droid_action_ref` — what the job clones at runtime.
# Pin both to a tag so a mirror update cannot change review behaviour
# mid-sprint.
#
# Runners need egress to your instance and to app.factory.ai (the Droid CLI
# installer and API). Everything else is fetched from the mirror.
#
# The job clones `droid_action_repo` with no credentials, which works for
# the public gitlab.com default. A private mirror needs either Internal
# visibility (any signed-in user, including the runner) or the CI job token
# form below, with your review project added to the mirror's
# Settings → CI/CD → "Token Access" allowlist:
#
# droid_action_repo: "https://gitlab-ci-token:$CI_JOB_TOKEN@gitlab.example.com/tools/droid-action.git"

include:
- project: "tools/droid-action" # your mirror's path
ref: "v1.0.0"
file: "/templates/droid-review.yml"
inputs:
automatic_review: "true"
review_depth: "deep"
droid_action_repo: "https://gitlab.example.com/tools/droid-action.git"
droid_action_ref: "v1.0.0"
Loading
Loading