From 0d2ce7d1b3449033ef61d4d74108cd91914fe077 Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Tue, 14 Apr 2026 13:47:55 -0400
Subject: [PATCH] fix(ci): restore trusted PR review dispatch

---
 .github/workflows/ai-review.yml               | 19 ++++++++++++++++++-
 .../scripts/github/ai-review-workflow.test.ts |  5 +++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index a6371c04..6a4f5289 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -15,6 +15,16 @@ on:
 concurrency:
   group: >-
     pr-agent-${{
+      github.event_name == 'workflow_dispatch' && format('dispatch-{0}', github.run_id) ||
+      (
+        github.event_name == 'issue_comment' && (
+          github.event.comment.body != '/review' ||
+          (
+            github.event.sender.type == 'Bot' &&
+            github.event.sender.login != 'github-actions[bot]'
+          )
+        )
+      ) && format('skip-{0}', github.run_id) ||
       github.event.pull_request.number ||
       github.event.issue.number ||
       github.event.inputs.pr_number ||
@@ -31,12 +41,19 @@ jobs:
       issues: write
 
     steps:
+      - name: Generate App Token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CCS_REVIEWER_APP_ID }}
+          private-key: ${{ secrets.CCS_REVIEWER_PRIVATE_KEY }}
+
       - name: Post /review command to the PR
         uses: actions/github-script@v7
         env:
           PR_NUMBER: ${{ github.event.inputs.pr_number }}
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const issue_number = Number(process.env.PR_NUMBER);
             if (!Number.isInteger(issue_number) || issue_number <= 0) {
diff --git a/tests/unit/scripts/github/ai-review-workflow.test.ts b/tests/unit/scripts/github/ai-review-workflow.test.ts
index 24028b52..09621948 100644
--- a/tests/unit/scripts/github/ai-review-workflow.test.ts
+++ b/tests/unit/scripts/github/ai-review-workflow.test.ts
@@ -20,6 +20,7 @@ describe('PR-Agent review lane migration', () => {
     expect(workflow).toContain('name: AI Code Review');
     expect(workflow).toContain('runs-on: [self-hosted, cliproxy]');
     expect(workflow).toContain('uses: qodo-ai/pr-agent');
+    expect(workflow).toContain('uses: actions/create-github-app-token@v1');
     expect(workflow).toContain('OPENAI.API_BASE');
     expect(workflow).toContain('OPENAI_KEY');
     expect(workflow).toContain('vars.AI_REVIEW_BASE_URL');
@@ -28,6 +29,10 @@ describe('PR-Agent review lane migration', () => {
     expect(workflow).toContain('github_action_config.auto_review');
     expect(workflow).toContain("github.event.comment.body == '/review'");
     expect(workflow).toContain('github.event.comment.author_association');
+    expect(workflow).toContain("format('skip-{0}', github.run_id)");
+    expect(workflow).toContain("format('dispatch-{0}', github.run_id)");
+    expect(workflow).toContain('CCS_REVIEWER_APP_ID');
+    expect(workflow).toContain('CCS_REVIEWER_PRIVATE_KEY');
     expect(workflow).not.toContain('uses: anthropics/claude-code-action@v1');
 
     expect(config).toContain('[config]');