ci: add cora AI code review

[ajianaz]

Changes

• Add .github/actions/cora-review/ composite action

  • Downloads cora-cli binary from GitHub Releases (no Rust build needed)
  • Fetches LLM secrets (CORA_API_KEY, CORA_BASE_URL, CORA_MODEL) via Infisical OIDC
  • Runs cora review on PR diff → SARIF output
  • Uploads SARIF to GitHub Code Scanning
  • Posts formatted PR comment (grouped by severity)
  • Blocks PR on error-level findings

• Update .github/workflows/ci.yml

  • Add cora-review job (runs after check/fmt/clippy/test)
  • Only triggers on pull_request events
  • Required permissions: security-events, pull-requests, id-token

Requirements

• Secret INFISICAL_IDENTITY_ID must be set in repo secrets ✅ (already configured)
• Infisical project github-actions / env prod must have: CORA_API_KEY, CORA_BASE_URL, CORA_MODEL

Notes

• Same action synced to cora-cli repo for consistency
• Default version: v0.1.1 (configurable via cora-version input)
• Default base branch: origin/develop (configurable via base-branch input)

Summary by CodeRabbit

• Chores
  • Added automated AI code review integration to the CI pipeline that analyzes pull request changes, generates detailed reports, and provides summary comments.
  • Updated workflow permissions to support the new code review functionality.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR introduces automated AI-powered code review by adding a new composite GitHub Action that runs cora-cli on PR diffs, generates a SARIF report, uploads results to Code Scanning, posts a summary comment, and blocks the workflow if error-level issues are found. The action is then integrated into the CI pipeline with explicit permissions and job dependencies.

Changes

Cora AI Code Review Integration

Layer / File(s)	Summary
Action interface and inputs .github/actions/cora-review/action.yml	Declares composite action metadata and configurable inputs: base branch, severity, CLI version, Infisical credentials (identity, project, environment, domain), and GitHub token.
CLI setup and review execution .github/actions/cora-review/action.yml	Detects runner OS architecture, downloads and extracts cora-cli release binary to /usr/local/bin, then executes cora review command with base branch and severity flags to generate SARIF output.
SARIF processing and result reporting .github/actions/cora-review/action.yml	Uploads SARIF to GitHub Code Scanning; parses SARIF results and builds severity-grouped summary table; posts new or updates existing PR comment with status and issue details; performs blocking check by parsing SARIF for level: "error" and failing the workflow if any are found.
CI workflow permissions and job integration .github/workflows/ci.yml	Adds explicit workflow-level permissions for contents (read), security-events (write), pull-requests (write), and id-token (write); defines cora-review job gated to pull_request events, depending on existing CI jobs, and invoking the local cora-review action with secrets.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related issues

• Publish cora-review as GitHub Marketplace action cora-code#47: This PR introduces the composite action .github/actions/cora-review/action.yml that the referenced issue proposes publishing as a reusable Marketplace action.

Poem

🐰 A rabbit hops through CI gates,
With cora-cli at the ready—
Code review flows through SARIF states,
Comments posted, workflow steady.
Error checks block the gate so tight,
Our tests now shine with AI light! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: add cora AI code review' directly and clearly describes the main change: adding a new CI component for AI code review.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/cora-review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🔍 Cora AI Code Review

✅ No issues found. Code looks good!

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (2)

.github/actions/cora-review/action.yml (2)

88-92: ⚡ Quick win

inputs.github-token is not actually applied to the Octokit client.

actions/github-script authenticates its github client via the github-token input (default ${{ github.token }}), not the GH_TOKEN env var. As written, the token passed into the action is ignored and the default job token is used. To honor the input, pass it through with.github-token.

♻️ Proposed fix

       uses: actions/github-script@v7
-      env:
-        GH_TOKEN: ${{ inputs.github-token }}
       with:
+        github-token: ${{ inputs.github-token }}
         script: |

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/cora-review/action.yml around lines 88 - 92, The
github-script step currently sets GH_TOKEN in env but does not pass the
inputs.github-token into the actions/github-script client, so the Octokit
instance will use the default job token; update the step that uses
actions/github-script@v7 to include with.github-token: ${{ inputs.github-token
}} (and remove or keep the GH_TOKEN env var as desired) so the `github` client
inside the `script` block is authenticated with the provided input rather than
the default token.

---

60-60: ⚡ Quick win

Use curl -fsSL so a failed download fails loudly.

Without --fail, an HTTP error (e.g., 404 for a missing release asset) returns a success exit code and pipes an HTML error page into tar. -S also restores error messages that -s suppresses.

♻️ Proposed fix

-        curl -sL "https://github.com/ajianaz/cora-cli/releases/download/${{ inputs.cora-version }}/${ASSET}-${{ inputs.cora-version }}.tar.gz" | tar xz -C /usr/local/bin cora
+        curl -fsSL "https://github.com/ajianaz/cora-cli/releases/download/${{ inputs.cora-version }}/${ASSET}-${{ inputs.cora-version }}.tar.gz" | tar xz -C /usr/local/bin cora

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/cora-review/action.yml at line 60, Replace the curl
invocation used to download the cora tarball so that HTTP errors cause a
non-zero exit; specifically update the command that pipes to tar (the line
invoking curl and tar extracting "cora") to use curl -fsSL instead of -sL (i.e.,
add --fail and --show-error flags) so failed downloads fail loudly and error
output is preserved.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/cora-review/action.yml:
- Around line 176-185: The inline Python invoked in the ERRORS assignment always
raises IndentationError because its lines are indented; de-indent the script
passed to python3 -c so the first character of each Python line is at column 0
(or replace the inline -c snippet with a heredoc/EOF call) so the try/except can
execute and catch parse/runtime errors; specifically update the python3 -c
invocation that reads cora-results.sarif (the ERRORS=$(python3 -c "..." ...)
block) so the JSON-parsing try/except is not indented and returns the actual
count of results with level == "error" instead of always falling back to 0.

In @.github/workflows/ci.yml:
- Around line 13-17: Top-level workflow permissions are too broad: remove
elevated permissions (security-events: write, pull-requests: write, id-token:
write) from the global permissions block and restrict it to read-only (e.g.,
keep contents: read); ensure the specific job cora-review continues to declare
the needed write permissions in its own permissions block (the existing
cora-review permissions at lines 73-77) so only that job gets elevated rights.

---

Nitpick comments:
In @.github/actions/cora-review/action.yml:
- Around line 88-92: The github-script step currently sets GH_TOKEN in env but
does not pass the inputs.github-token into the actions/github-script client, so
the Octokit instance will use the default job token; update the step that uses
actions/github-script@v7 to include with.github-token: ${{ inputs.github-token
}} (and remove or keep the GH_TOKEN env var as desired) so the `github` client
inside the `script` block is authenticated with the provided input rather than
the default token.
- Line 60: Replace the curl invocation used to download the cora tarball so that
HTTP errors cause a non-zero exit; specifically update the command that pipes to
tar (the line invoking curl and tar extracting "cora") to use curl -fsSL instead
of -sL (i.e., add --fail and --show-error flags) so failed downloads fail loudly
and error output is preserved.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5bd552fb-a988-4fd6-88c0-acbe492088e3

📥 Commits

Reviewing files that changed from the base of the PR and between 0a21453 and 0f0646b.

📒 Files selected for processing (2)

• .github/actions/cora-review/action.yml
• .github/workflows/ci.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Blocking check is non-functional: the inline Python always raises IndentationError.

The code passed to python3 -c is indented (10 leading spaces per line), so the first statement raises IndentationError: unexpected indent at parse time — before the try/except can run, so it cannot be caught. 2>/dev/null hides the error and || echo "0" forces ERRORS=0, meaning the PR is never blocked on error-level findings (the primary purpose of this action). De-indent the script to column 0.

🐛 Proposed fix

-          ERRORS=$(python3 -c "
-          import json, sys
-          try:
-            data = json.load(open('cora-results.sarif'))
-            results = data.get('runs', [{}])[0].get('results', [])
-            errors = [r for r in results if r.get('level') == 'error']
-            print(len(errors))
-          except:
-            print(0)
-          " 2>/dev/null || echo "0")
+          ERRORS=$(python3 -c "
+import json
+try:
+    data = json.load(open('cora-results.sarif'))
+    results = data.get('runs', [{}])[0].get('results', [])
+    errors = [r for r in results if r.get('level') == 'error']
+    print(len(errors))
+except Exception:
+    print(0)
+" 2>/dev/null || echo "0")

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	ERRORS=$(python3 -c "
	import json, sys
	try:
	data = json.load(open('cora-results.sarif'))
	results = data.get('runs', [{}])[0].get('results', [])
	errors = [r for r in results if r.get('level') == 'error']
	print(len(errors))
	except:
	print(0)
	" 2>/dev/null || echo "0")
	ERRORS=$(python3 -c "
	import json
	try:
	data = json.load(open('cora-results.sarif'))
	results = data.get('runs', [{}])[0].get('results', [])
	errors = [r for r in results if r.get('level') == 'error']
	print(len(errors))
	except Exception:
	print(0)
	" 2>/dev/null || echo "0")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/cora-review/action.yml around lines 176 - 185, The inline
Python invoked in the ERRORS assignment always raises IndentationError because
its lines are indented; de-indent the script passed to python3 -c so the first
character of each Python line is at column 0 (or replace the inline -c snippet
with a heredoc/EOF call) so the try/except can execute and catch parse/runtime
errors; specifically update the python3 -c invocation that reads
cora-results.sarif (the ERRORS=$(python3 -c "..." ...) block) so the
JSON-parsing try/except is not indented and returns the actual count of results
with level == "error" instead of always falling back to 0.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Scope elevated permissions to the job, not the whole workflow.

security-events, pull-requests, and id-token: write at the top level are granted to every job (check, fmt, clippy, test, build) even though only cora-review needs them — and cora-review already declares its own permissions block (Lines 73-77). Restrict the workflow default to read-only to follow least privilege.

🔒️ Proposed fix

 permissions:
   contents: read
-  security-events: write
-  pull-requests: write
-  id-token: write

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 15-15: overly broad permissions (excessive-permissions): security-events: write is overly broad at the workflow level

(excessive-permissions)

---

[error] 16-16: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level

(excessive-permissions)

---

[error] 17-17: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level

(excessive-permissions)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 13 - 17, Top-level workflow
permissions are too broad: remove elevated permissions (security-events: write,
pull-requests: write, id-token: write) from the global permissions block and
restrict it to read-only (e.g., keep contents: read); ensure the specific job
cora-review continues to declare the needed write permissions in its own
permissions block (the existing cora-review permissions at lines 73-77) so only
that job gets elevated rights.