Can't access LAN IP using domain when lockdown #218
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🏂 Code Review | |
| # from: github.com/alibaba/open-code-review/tree/5829539379e/examples/github_actions/ocr-review.yml | |
| # Conditional concurrency group. | |
| # | |
| # GitHub Actions evaluates concurrency BEFORE job-level if-conditions. With a | |
| # flat group (ocr-<pr_number>), every comment on the PR — even an unrelated | |
| # conversation reply that will be skipped — enters the same group and, because | |
| # cancel-in-progress is true, cancels any in-progress review. The result: a | |
| # single normal comment kills a running review, and you see "two runs, one | |
| # cancelled" in the Actions tab. | |
| # | |
| # Fix: matching events (PR events + /open-code-review comments) share a per-PR | |
| # group so a new review cancels any stale one for the same PR. Non-matching | |
| # comments land in a unique noop-<run_id> group that can never collide with a | |
| # real review, so they are skipped instantly without disrupting anything. | |
| concurrency: | |
| group: >- | |
| ${{ | |
| ( | |
| github.event_name == 'pull_request_target' | |
| || ( | |
| github.event_name == 'issue_comment' | |
| && github.event.issue.pull_request | |
| && github.event.comment.user.type != 'Bot' | |
| && ( | |
| github.event.comment.author_association == 'MEMBER' | |
| || github.event.comment.author_association == 'OWNER' | |
| || github.event.comment.author_association == 'COLLABORATOR' | |
| ) | |
| && ( | |
| startsWith(github.event.comment.body, '/open-code-review') | |
| || startsWith(github.event.comment.body, '@open-code-review') | |
| || startsWith(github.event.comment.body, '/ocr') | |
| ) | |
| ) | |
| ) | |
| && format('ocr-{0}', github.event.pull_request.number || github.event.issue.number) | |
| || format('noop-{0}', github.run_id) | |
| }} | |
| cancel-in-progress: true | |
| on: | |
| # Use pull_request_target instead of pull_request so that secrets are | |
| # available even for PRs from forks. This is safe because the reusable | |
| # action only reads the diff and does not execute any code from the PR. | |
| # too expensive, commenting it for now. | |
| # pull_request_target: | |
| # types: [opened, synchronize, reopened] | |
| issue_comment: | |
| types: [created] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| code-review: | |
| name: 🧭 OCR | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 100 | |
| # Run on PR events, or on human-authored comments starting with trigger | |
| # keywords. Bot comments are excluded as a safety net: GITHUB_TOKEN already | |
| # suppresses events from bot-posted comments, but a PAT/App token would not. | |
| # issue_comment triggers are further gated on author_association so only | |
| # MEMBER/OWNER/COLLABORATOR users can spend LLM quota via re-review. | |
| if: | | |
| github.event_name == 'pull_request_target' | |
| || ( | |
| github.event_name == 'issue_comment' | |
| && github.event.issue.pull_request | |
| && github.event.comment.user.type != 'Bot' | |
| && ( | |
| github.event.comment.author_association == 'MEMBER' | |
| || github.event.comment.author_association == 'OWNER' | |
| || github.event.comment.author_association == 'COLLABORATOR' | |
| ) | |
| && ( | |
| startsWith(github.event.comment.body, '/open-code-review') | |
| || startsWith(github.event.comment.body, '@open-code-review') | |
| ) | |
| ) | |
| steps: | |
| - name: 🦚 Context | |
| id: pr-context | |
| if: github.event_name == 'issue_comment' | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 | |
| with: | |
| script: | | |
| // For issue_comment events, resolve PR base/head so the action | |
| // can review the right diff (issue_comment has no top-level | |
| // pull_request payload fields). | |
| const prNumber = context.issue.number; | |
| const { data: pullRequest } = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: prNumber | |
| }); | |
| const isClosed = pullRequest.state === 'closed'; | |
| core.setOutput('is_closed', isClosed ? 'true' : 'false'); | |
| // Always use the branch name — the action's internal | |
| // actions/checkout fetches all branches, so origin/<branch> | |
| // resolves naturally via refs/remotes/origin/<branch>. The old | |
| // bare-SHA approach caused empty diffs because git can't resolve | |
| // origin/<sha> without a named ref (FETCH_HEAD is not one). | |
| core.setOutput('base_ref', pullRequest.base.ref); | |
| // Also expose the SHA for the rare deleted-branch fallback in | |
| // the prepare step. | |
| core.setOutput('base_sha', pullRequest.base.sha); | |
| core.setOutput('head_sha', pullRequest.head.sha); | |
| # Supply-chain hardening: this job holds secrets, so every action here | |
| # is pinned by full commit SHA (github-script, checkout, and the OCR | |
| # action itself). First-party actions are pinned too; a mutable tag | |
| # in a secrets-bearing pull_request_target job is an injection vector. | |
| # | |
| # Strategy for closed PRs: always pass base.ref (the branch name) to | |
| # the OCR action — its internal actions/checkout fetches all branches, | |
| # so `origin/<branch>` resolves naturally via refs/remotes/origin/<branch>. | |
| # The old approach (base.sha for closed PRs) failed because git can't | |
| # resolve `origin/<sha>` without a named ref; FETCH_HEAD is not one. | |
| # | |
| # Edge case: if the base branch was deleted after merge (rare), the | |
| # action's fetch fails and merge-base falls back to HEAD_SHA (empty | |
| # diff). The prepare step detects this via ls-remote, falls back to | |
| # the base SHA, and creates refs/origin/<sha> so git DWIM (rule 2: | |
| # refs/<refname>) resolves it. This namespace survives the action's | |
| # checkout: refs/heads/* are deleted (prepareExistingDirectory), | |
| # refs/remotes/origin/* and refs/tags/* are pruned (--prune fetch), | |
| # but refs/origin/* is untouched. | |
| - name: ⬇️ Checkout (shallow — prepare step needs a git remote) | |
| if: github.event_name == 'issue_comment' && steps.pr-context.outputs.is_closed == 'true' | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: 🌉 Prepare closed-PR reviews | |
| id: prepare | |
| if: github.event_name == 'issue_comment' && steps.pr-context.outputs.is_closed == 'true' | |
| shell: bash | |
| env: | |
| BASE_REF: ${{ steps.pr-context.outputs.base_ref }} | |
| BASE_SHA: ${{ steps.pr-context.outputs.base_sha }} | |
| HEAD_SHA: ${{ steps.pr-context.outputs.head_sha }} | |
| PR_NUM: ${{ github.event.pull_request.number || github.event.issue.number }} | |
| run: | | |
| set -eux | |
| # Fork PRs: the head may live in a deleted fork. Fetch the PR's | |
| # pull/<n>/head ref (advertised on the base repo, persistent after | |
| # close) so the head objects are present for the action's merge-base | |
| # and diff. | |
| if [ -n "${PR_NUM}" ]; then | |
| git fetch origin "pull/${PR_NUM}/head" 2>/dev/null || true | |
| fi | |
| git fetch origin "${HEAD_SHA}" 2>/dev/null || true | |
| # Base branch deleted after merge — rare. Fall back to the base | |
| # SHA. The action's `git fetch origin <sha>` only writes | |
| # FETCH_HEAD (not a named ref), so `git merge-base origin/<sha>` | |
| # can't resolve it. We create refs/origin/<sha> instead: git | |
| # DWIM rule 2 (refs/<refname>) resolves origin/<sha>. | |
| # | |
| # This must NOT be refs/heads/origin/<sha>: the action's internal | |
| # checkout deletes ALL local branches (prepareExistingDirectory). | |
| # refs/remotes/origin/<sha> would be pruned by its --prune fetch. | |
| # refs/origin/<sha> is outside every namespace checkout mutates. | |
| echo "::warning::base branch '${BASE_REF}' deleted on origin; falling back to SHA ${BASE_SHA}" | |
| git fetch origin "${BASE_SHA}" 2>/dev/null || true | |
| if git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then | |
| git update-ref "refs/origin/${BASE_SHA}" "${BASE_SHA}" | |
| echo "Created refs/origin/${BASE_SHA} as DWIM fallback" | |
| echo "base_ref=${BASE_SHA}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "::error::base SHA ${BASE_SHA} not fetchable; review may produce an empty diff" | |
| # Check whether the base branch still exists on origin. For the | |
| # common case (main, develop, release/*) it does, and the action's | |
| # own checkout creates refs/remotes/origin/<branch> which makes | |
| # `git merge-base origin/<branch> <head>` work naturally. | |
| if git ls-remote --exit-code --heads origin "${BASE_REF}" >/dev/null 2>&1; then | |
| echo "Base branch '${BASE_REF}' exists on origin" | |
| echo "base_ref=${BASE_REF}" >> "$GITHUB_OUTPUT" | |
| fi | |
| fi | |
| if git cat-file -e "${HEAD_SHA}^{commit}" 2>/dev/null; then | |
| echo "Head ${HEAD_SHA} resolved" | |
| else | |
| echo "::warning::head SHA ${HEAD_SHA} not yet resolved; the action's fork-safe fetch will retry" | |
| fi | |
| - name: 🐦🔥 Review | |
| uses: alibaba/open-code-review@e78474478f168a8009bd3b12334a87a2c985819d # v1.8.4 | |
| with: | |
| llm_url: ${{ secrets.OCR_LLM_URL }} | |
| llm_auth_token: ${{ secrets.OCR_LLM_AUTH_TOKEN }} | |
| llm_model: ${{ vars.OCR_LLM_MODEL }} | |
| llm_use_anthropic: ${{ vars.OCR_LLM_USE_ANTHROPIC }} | |
| # turn on thinking mode as expected by anthropic api | |
| llm_extra_body: '${{ vars.OCR_LLM_EXTRA_BODY }}' | |
| # For issue_comment triggers, pass the resolved refs; for | |
| # pull_request_target the action resolves them from the | |
| # event automatically: | |
| # github.com/alibaba/open-code-review/blob/5829539379e/action.yml#L208-L216 | |
| # | |
| # prepare.outputs.base_ref is set only for closed PRs: branch name | |
| # if the branch exists on origin, base SHA otherwise (with DWIM | |
| # fallback). For open PRs or pull_request_target, fall back to the | |
| # pr-context output (branch name). | |
| base_ref: ${{ steps.prepare.outputs.base_ref || steps.pr-context.outputs.base_ref }} | |
| head_sha: ${{ steps.pr-context.outputs.head_sha }} | |
| # Pin the npm CLI to the same release as the pinned action commit. | |
| # The action's own default is `latest` (action.yml install step: | |
| # npm install -g "@alibaba-group/open-code-review@${OCR_VERSION}"), | |
| # which could drift away from the action code at e7847447. | |
| ocr_version: 1.8.4 |