awesome-kubernetes/.github/workflows/07.1.pr_guardian.yml

name: 07.1. PR Guardian AI

on:
  pull_request:
    types: [opened, synchronize]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR number to analyze'
        required: false
        type: string

# Cancel superseded Guardian runs when a PR is updated (saves CI minutes + Gemini calls).
concurrency:
  group: pr-guardian-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  agentic-presubmit:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.ref || github.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}

      - name: Python Environment
        uses: actions/setup-python@v6
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --no-cache-dir pydantic PyGithub httpx fake-useragent pytz python-dotenv pyyaml tenacity

      - name: Run PR Guardian Analysis
        # Advisory gate: the Guardian is an AI heuristic that can misattribute
        # pre-existing lines or mischaracterize a PR. It always posts its findings
        # as a PR comment, but a non-zero exit must NOT show the PR as a blocking
        # red ❌. continue-on-error keeps the check green while preserving the comment.
        continue-on-error: true
        env:
          GEMINI_API_KEY_1: ${{ secrets.GEMINI_API_KEY_1 }}
          GEMINI_API_KEY_2: ${{ secrets.GEMINI_API_KEY_2 }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.inputs.pr_number || github.event.pull_request.number }}
          PYTHONPATH: ${{ github.workspace }}
        run: |
          python src/pr_guardian.py

      - name: Commit Auto-Corrections
        if: always() && github.event_name == 'pull_request'
        run: |
          git config --global user.name "nubenetes-bot"
          git config --global user.email "bot@nubenetes.com"
          # NOTE: v2-docs/ is deliberately excluded. It is generated by
          # src/v2_optimizer.py (single source of truth); re-formatting it here
          # caused a perpetual cosmetic develop<->master drift (see pr_guardian.py).
          git add docs/ README.md data/inventory.yaml data/inventory.sql src/memory/
          if ! git diff --cached --quiet; then
            git commit -m "style(cleaner): auto-correcting formatting & URL normalization"
            git push origin HEAD:${{ github.event.pull_request.head.ref }} || echo "⚠️ Push failed (likely fork permission limit)."
          else
            echo "No formatting changes to commit."
          fi