action.yml

name: "Droid Exec Action v1.0"
description: "Flexible GitHub automation platform with Droid. Auto-detects mode based on event type: PR reviews, @droid mentions, or custom automation."
branding:
  icon: "at-sign"
  color: "orange"

inputs:
  trigger_phrase:
    description: "The trigger phrase to look for in comments or issue body"
    required: false
    default: "@droid"
  assignee_trigger:
    description: "The assignee username that triggers the action (e.g. @droid)"
    required: false
  label_trigger:
    description: "The label that triggers the action (e.g. droid)"
    required: false
    default: "droid"
  allowed_bots:
    description: "Comma-separated list of allowed bot usernames, or '*' to allow all bots. Empty string (default) allows no bots."
    required: false
    default: ""
  allowed_non_write_users:
    description: "Comma-separated list of usernames to allow without write permissions, or '*' to allow all users. Only works when github_token input is provided. WARNING: Use with extreme caution - this bypasses security checks and should only be used for workflows with very limited permissions (e.g., issue labeling)."
    required: false
    default: ""

  # Droid Exec configuration
  settings:
    description: "Droid Exec settings as JSON string or path to settings JSON file"
    required: false
    default: ""

  # Auth configuration
  factory_api_key:
    description: "Factory API key (required for Droid Exec runtime)"
    required: true
  github_token:
    description: "GitHub token with repo and pull request permissions (optional if using GitHub App)"
    required: false

  droid_args:
    description: "Additional arguments to pass directly to Droid CLI"
    required: false
    default: ""
  additional_permissions:
    description: "Additional GitHub permissions to request (e.g., 'actions: read')"
    required: false
    default: ""
  use_sticky_comment:
    description: "Use just one comment to deliver issue/PR comments"
    required: false
    default: "false"
  track_progress:
    description: "Force tag mode with tracking comments for pull_request and issue events. Only applicable to pull_request (opened, synchronize, ready_for_review, reopened) and issue (opened, edited, labeled, assigned) events."
    required: false
    default: "false"
  automatic_review:
    description: "Automatically run the review flow for pull request contexts without requiring an explicit @droid review command. Only supported for PR-related events."
    required: false
    default: "false"
  automatic_security_review:
    description: "Automatically run the security review flow for pull request contexts without requiring an explicit @droid security command. Only supported for PR-related events."
    required: false
    default: "false"
  security_model:
    description: "Override the model used for security review (e.g., 'claude-sonnet-4-5-20250929', 'gpt-5.1-codex'). Only applies to security review flows."
    required: false
    default: ""
  security_severity_threshold:
    description: "Minimum severity to report in security reviews (critical, high, medium, low). Findings below this threshold will be filtered out."
    required: false
    default: "medium"
  security_block_on_critical:
    description: "Submit REQUEST_CHANGES review when critical severity findings are detected."
    required: false
    default: "true"
  security_block_on_high:
    description: "Submit REQUEST_CHANGES review when high severity findings are detected."
    required: false
    default: "false"
  security_notify_team:
    description: "GitHub team to @mention on critical findings (e.g., '@org/security-team')."
    required: false
    default: ""
  security_scan_schedule:
    description: "Enable scheduled security scans. Set to 'true' for schedule events to trigger full repository scans."
    required: false
    default: "false"
  security_scan_days:
    description: "Number of days of commits to scan for scheduled security scans. Only applies when security_scan_schedule is enabled."
    required: false
    default: "7"
  review_depth:
    description: "Review depth preset: 'shallow' (fast, uses kimi-k2-0711) or 'deep' (thorough, uses gpt-5.2 with high reasoning). Defaults to deep. Setting review_model or reasoning_effort explicitly overrides the preset values."
    required: false
    default: "deep"
  review_model:
    description: "Override the model used for code review (e.g., 'claude-sonnet-4-5-20250929', 'gpt-5.1-codex'). If empty, the model is determined by review_depth."
    required: false
    default: ""
  reasoning_effort:
    description: "Override reasoning effort for review flows (passed to Droid Exec as --reasoning-effort). If empty, determined by review_depth (shallow=default, deep=high)."
    required: false
    default: ""
  include_suggestions:
    description: "Include code suggestion blocks in review comments when the fix is high-confidence. Set to 'false' to disable suggestions."
    required: false
    default: "true"
  review_candidates_path:
    description: "Path to write review candidates JSON (pass 1 of the two-pass review)."
    required: false
    default: "${{ runner.temp }}/droid-prompts/review_candidates.json"
  review_validated_path:
    description: "Path to write review validated JSON (pass 2 of the two-pass review)."
    required: false
    default: "${{ runner.temp }}/droid-prompts/review_validated.json"
  fill_model:
    description: "Override the model used for PR description fill (e.g., 'claude-sonnet-4-5-20250929', 'gpt-5.1-codex'). Only applies to fill flows."
    required: false
    default: ""
  experimental_allowed_domains:
    description: "Restrict network access to these domains only (newline-separated). If not set, no restrictions are applied. Provider domains are auto-detected."
    required: false
    default: ""
  path_to_droid_executable:
    description: "Optional path to a custom Droid CLI executable. If provided, skips automatic installation and uses this executable instead. WARNING: Using an older version may cause problems if the action begins taking advantage of new Droid Exec features. This input is typically not needed unless you're debugging something specific or have unique needs in your environment."
    required: false
    default: ""
  path_to_bun_executable:
    description: "Optional path to a custom Bun executable. If provided, skips automatic Bun installation and uses this executable instead. WARNING: Using an incompatible version may cause problems if the action requires specific Bun features. This input is typically not needed unless you're debugging something specific or have unique needs in your environment."
    required: false
    default: ""
  show_full_output:
    description: "Show full JSON output from Droid Exec. WARNING: This outputs ALL Droid messages including tool execution results which may contain secrets, API keys, or other sensitive information. These logs are publicly visible in GitHub Actions. Only enable for debugging in non-sensitive environments."
    required: false
    default: "false"

outputs:
  github_token:
    description: "The GitHub token used by the action (Droid App token if available)"
    value: ${{ steps.prepare.outputs.github_token }}

runs:
  using: "composite"
  steps:
    - name: Install Bun
      if: inputs.path_to_bun_executable == ''
      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # https://github.com/oven-sh/setup-bun/releases/tag/v2.0.2
      with:
        bun-version: 1.2.11

    - name: Setup Custom Bun Path
      if: inputs.path_to_bun_executable != ''
      shell: bash
      run: |
        echo "Using custom Bun executable: ${{ inputs.path_to_bun_executable }}"
        # Add the directory containing the custom executable to PATH
        BUN_DIR=$(dirname "${{ inputs.path_to_bun_executable }}")
        echo "$BUN_DIR" >> "$GITHUB_PATH"

    - name: Install Dependencies
      shell: bash
      run: |
        cd ${GITHUB_ACTION_PATH}
        bun install

    - name: Prepare action
      id: prepare
      shell: bash
      run: |
        bun run ${GITHUB_ACTION_PATH}/src/entrypoints/prepare.ts
      env:
        FACTORY_API_KEY: ${{ inputs.factory_api_key }}
        TRIGGER_PHRASE: ${{ inputs.trigger_phrase }}
        ASSIGNEE_TRIGGER: ${{ inputs.assignee_trigger }}
        LABEL_TRIGGER: ${{ inputs.label_trigger }}
        OVERRIDE_GITHUB_TOKEN: ${{ inputs.github_token }}
        ALLOWED_BOTS: ${{ inputs.allowed_bots }}
        ALLOWED_NON_WRITE_USERS: ${{ inputs.allowed_non_write_users }}
        GITHUB_RUN_ID: ${{ github.run_id }}
        USE_STICKY_COMMENT: ${{ inputs.use_sticky_comment }}
        DEFAULT_WORKFLOW_TOKEN: ${{ github.token }}
        TRACK_PROGRESS: ${{ inputs.track_progress }}
        AUTOMATIC_REVIEW: ${{ inputs.automatic_review }}
        AUTOMATIC_SECURITY_REVIEW: ${{ inputs.automatic_security_review }}
        SECURITY_MODEL: ${{ inputs.security_model }}
        SECURITY_SEVERITY_THRESHOLD: ${{ inputs.security_severity_threshold }}
        SECURITY_BLOCK_ON_CRITICAL: ${{ inputs.security_block_on_critical }}
        SECURITY_BLOCK_ON_HIGH: ${{ inputs.security_block_on_high }}
        SECURITY_NOTIFY_TEAM: ${{ inputs.security_notify_team }}
        SECURITY_SCAN_SCHEDULE: ${{ inputs.security_scan_schedule }}
        SECURITY_SCAN_DAYS: ${{ inputs.security_scan_days }}
        REVIEW_DEPTH: ${{ inputs.review_depth }}
        REVIEW_MODEL: ${{ inputs.review_model }}
        REASONING_EFFORT: ${{ inputs.reasoning_effort }}
        REVIEW_CANDIDATES_PATH: ${{ inputs.review_candidates_path }}
        REVIEW_VALIDATED_PATH: ${{ inputs.review_validated_path }}
        FILL_MODEL: ${{ inputs.fill_model }}
        ADDITIONAL_PERMISSIONS: ${{ inputs.additional_permissions }}
        DROID_ARGS: ${{ inputs.droid_args }}
        INCLUDE_SUGGESTIONS: ${{ inputs.include_suggestions }}
        ALL_INPUTS: ${{ toJson(inputs) }}

    - name: Install Base Action Dependencies
      if: steps.prepare.outputs.contains_trigger == 'true'
      shell: bash
      run: |
        echo "Installing base-action dependencies..."
        cd ${GITHUB_ACTION_PATH}/base-action
        bun install
        echo "Base-action dependencies installed"
        cd -

    - name: Install Droid CLI
      if: steps.prepare.outputs.contains_trigger == 'true' && inputs.path_to_droid_executable == ''
      shell: bash
      run: |
        echo "Installing Droid CLI..."
        curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://app.factory.ai/cli | sh
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
        "$HOME/.local/bin/droid" --version

    - name: Setup Custom Droid Path
      if: steps.prepare.outputs.contains_trigger == 'true' && inputs.path_to_droid_executable != ''
      shell: bash
      run: |
        echo "Using custom Droid executable: ${{ inputs.path_to_droid_executable }}"
        DROID_DIR=$(dirname "${{ inputs.path_to_droid_executable }}")
        echo "$DROID_DIR" >> "$GITHUB_PATH"

    - name: Setup Custom Droids
      if: steps.prepare.outputs.contains_trigger == 'true'
      shell: bash
      run: |
        echo "Setting up custom droids..."
        mkdir -p ~/.factory/droids
        if [ -d "${GITHUB_ACTION_PATH}/.factory/droids" ]; then
          cp -r ${GITHUB_ACTION_PATH}/.factory/droids/* ~/.factory/droids/
          echo "Copied custom droids to ~/.factory/droids/"
          ls -la ~/.factory/droids/
        else
          echo "No custom droids found in action"
        fi

    - name: Setup Network Restrictions
      if: steps.prepare.outputs.contains_trigger == 'true' && inputs.experimental_allowed_domains != ''
      shell: bash
      run: |
        chmod +x ${GITHUB_ACTION_PATH}/scripts/setup-network-restrictions.sh
        ${GITHUB_ACTION_PATH}/scripts/setup-network-restrictions.sh
      env:
        EXPERIMENTAL_ALLOWED_DOMAINS: ${{ inputs.experimental_allowed_domains }}

    - name: Install Security Plugin
      if: steps.prepare.outputs.contains_trigger == 'true' && steps.prepare.outputs.install_security_skills == 'true'
      shell: bash
      run: |
        echo "Installing security-engineer plugin from factory-plugins marketplace..."
        droid plugin marketplace add https://github.com/Factory-AI/factory-plugins 2>/dev/null || true
        droid plugin install security-engineer@factory-plugins --scope user 2>/dev/null || {
          echo "Warning: Could not install security-engineer plugin. Security review may have limited functionality."
        }
        echo "Security plugin installation complete"

    - name: Run Droid Exec
      id: droid
      if: steps.prepare.outputs.contains_trigger == 'true'
      shell: bash
      run: |

        # Run the base-action
        bun run ${GITHUB_ACTION_PATH}/base-action/src/index.ts
      env:
        # Base-action inputs
        INPUT_PROMPT_FILE: ${{ runner.temp }}/droid-prompts/droid-prompt.txt
        INPUT_SETTINGS: ${{ inputs.settings }}
        INPUT_DROID_ARGS: ${{ steps.prepare.outputs.droid_args }}
        INPUT_MCP_TOOLS: ${{ steps.prepare.outputs.mcp_tools }}
        INPUT_EXPERIMENTAL_SLASH_COMMANDS_DIR: ${{ github.action_path }}/slash-commands
        INPUT_ACTION_INPUTS_PRESENT: ${{ steps.prepare.outputs.action_inputs_present }}
        INPUT_PATH_TO_DROID_EXECUTABLE: ${{ inputs.path_to_droid_executable }}
        INPUT_PATH_TO_BUN_EXECUTABLE: ${{ inputs.path_to_bun_executable }}
        INPUT_SHOW_FULL_OUTPUT: ${{ inputs.show_full_output }}

        # Model configuration
        GITHUB_TOKEN: ${{ steps.prepare.outputs.GITHUB_TOKEN }}
        NODE_VERSION: ${{ env.NODE_VERSION }}
        DETAILED_PERMISSION_MESSAGES: "1"
        FACTORY_API_KEY: ${{ inputs.factory_api_key }}

    - name: Prepare validator
      id: prepare_validator
      if: steps.prepare.outputs.contains_trigger == 'true' && steps.prepare.outputs.run_code_review == 'true'
      shell: bash
      run: |
        bun run ${GITHUB_ACTION_PATH}/src/entrypoints/prepare-validator.ts
      env:
        GITHUB_TOKEN: ${{ steps.prepare.outputs.github_token }}
        REVIEW_VALIDATED_PATH: ${{ inputs.review_validated_path }}
        REVIEW_CANDIDATES_PATH: ${{ inputs.review_candidates_path }}
        DROID_COMMENT_ID: ${{ steps.prepare.outputs.droid_comment_id }}
        REVIEW_DEPTH: ${{ inputs.review_depth }}
        REVIEW_MODEL: ${{ inputs.review_model }}
        REASONING_EFFORT: ${{ inputs.reasoning_effort }}
        INCLUDE_SUGGESTIONS: ${{ inputs.include_suggestions }}

    - name: Run Droid Exec (validator)
      id: droid_validator
      if: steps.prepare.outputs.contains_trigger == 'true' && steps.prepare.outputs.run_code_review == 'true'
      shell: bash
      run: |

        # Run the base-action
        bun run ${GITHUB_ACTION_PATH}/base-action/src/index.ts
      env:
        # Base-action inputs
        INPUT_PROMPT_FILE: ${{ runner.temp }}/droid-prompts/droid-prompt.txt
        INPUT_SETTINGS: ${{ inputs.settings }}
        INPUT_DROID_ARGS: ${{ steps.prepare_validator.outputs.droid_args }}
        INPUT_MCP_TOOLS: ${{ steps.prepare_validator.outputs.mcp_tools }}
        INPUT_EXPERIMENTAL_SLASH_COMMANDS_DIR: ${{ github.action_path }}/slash-commands
        INPUT_ACTION_INPUTS_PRESENT: ${{ steps.prepare.outputs.action_inputs_present }}
        INPUT_PATH_TO_DROID_EXECUTABLE: ${{ inputs.path_to_droid_executable }}
        INPUT_PATH_TO_BUN_EXECUTABLE: ${{ inputs.path_to_bun_executable }}
        INPUT_SHOW_FULL_OUTPUT: ${{ inputs.show_full_output }}

        # Model configuration
        GITHUB_TOKEN: ${{ steps.prepare.outputs.GITHUB_TOKEN }}
        NODE_VERSION: ${{ env.NODE_VERSION }}
        DETAILED_PERMISSION_MESSAGES: "1"
        FACTORY_API_KEY: ${{ inputs.factory_api_key }}

    - name: Update comment with job link
      if: steps.prepare.outputs.contains_trigger == 'true' && steps.prepare.outputs.droid_comment_id && always()
      shell: bash
      run: |
        bun run ${GITHUB_ACTION_PATH}/src/entrypoints/update-comment-link.ts
      env:
        REPOSITORY: ${{ github.repository }}
        PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
        DROID_COMMENT_ID: ${{ steps.prepare.outputs.droid_comment_id }}
        GITHUB_RUN_ID: ${{ github.run_id }}
        GITHUB_TOKEN: ${{ steps.prepare.outputs.GITHUB_TOKEN }}
        GITHUB_EVENT_NAME: ${{ github.event_name }}
        TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
        IS_PR: ${{ github.event.issue.pull_request != null || github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review_comment' }}
        DROID_SUCCESS: ${{ (steps.prepare.outputs.run_code_review == 'true' && steps.droid_validator.outputs.conclusion == 'success') || (steps.prepare.outputs.run_code_review != 'true' && steps.droid.outputs.conclusion == 'success') }}
        TRIGGER_USERNAME: ${{ github.event.comment.user.login || github.event.issue.user.login || github.event.pull_request.user.login || github.event.sender.login || github.triggering_actor || github.actor || '' }}
        PREPARE_SUCCESS: ${{ steps.prepare.outcome == 'success' }}
        PREPARE_ERROR: ${{ steps.prepare.outputs.prepare_error || '' }}
        USE_STICKY_COMMENT: ${{ inputs.use_sticky_comment }}
        TRACK_PROGRESS: ${{ inputs.track_progress }}
        AUTOMATIC_REVIEW: ${{ inputs.automatic_review }}
        AUTOMATIC_SECURITY_REVIEW: ${{ inputs.automatic_security_review }}

    - name: Collect .factory debug files
      if: always() && steps.prepare.outputs.contains_trigger == 'true'
      shell: bash
      run: |
        if [ -d "$HOME/.factory" ]; then
          cp -r "$HOME/.factory" "${{ runner.temp }}/.factory"
        fi

    - name: Upload debug artifacts
      if: always() && steps.prepare.outputs.contains_trigger == 'true'
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: droid-review-debug-${{ github.run_id }}
        path: |
          ${{ runner.temp }}/.factory/**
          ${{ runner.temp }}/droid-prompts/**
        include-hidden-files: true
        if-no-files-found: ignore
        retention-days: 7