Skip to content

Add @expo/code-review-cli - #58021

Draft
Abbondanzo wants to merge 4 commits into
react:mainfrom
Abbondanzo:add-expo-code-review-muse-spark
Draft

Add @expo/code-review-cli#58021
Abbondanzo wants to merge 4 commits into
react:mainfrom
Abbondanzo:add-expo-code-review-muse-spark

Conversation

@Abbondanzo

@Abbondanzo Abbondanzo commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Summary:

This adds an AI code review bot to React Native. It leaves a single comment on PRs with findings from three reviewers (correctness, security, consistency) and never blocks merging or auto-approves.

How it works:

  • Config lives in .expo-code-review/config.jsonc, shared prompts, and the three agent files. The model is meta/muse-spark-1.2 (Muse Spark) using META_API_KEY.
  • Three workflows: auto-review on pull_request, on-demand /review comment, and /dismiss to hide a finding. They check out the base commit and run the published @expo/code-review-cli via npx, so PR code is never executed.

What changed:

  • Added .expo-code-review/ with the config and prompts
  • Added .github/workflows/expo-code-review.yml, expo-code-review-command.yml, expo-code-review-dismiss.yml

The bot is wired but dormant until the META_API_KEY secret is set (from https://developer.meta.com/ai/, stored as EXPO_CODE_REVIEW_API_KEY and forwarded as META_API_KEY). It now only runs when you add the ai-review label.

Changelog:

[INTERNAL] [ADDED] - Add @expo/code-review-cli AI code review (Muse Spark)

Test Plan:

Tested locally on add-expo-code-review-muse-spark (Abbondanzo/react-native fork):

npx --yes @expo/code-review-cli init --token-env META_API_KEY
# set model to meta/muse-spark-1.2 in config.jsonc, workflows forward META_API_KEY from secrets.EXPO_CODE_REVIEW_API_KEY

ECR_EXPECTED_TOKEN_ENV=META_API_KEY ecr verify-config
# → OK — tokenEnv locked to META_API_KEY

ecr doctor
# → ✓ 3 agents (consistency, correctness, security), coordinator meta/muse-spark-1.2

ecr ref-check
# → 1 ref(s) across 6 files — all resolve

ecr review --json
# → correctly waits for META_API_KEY

CI is continue-on-error and pull-requests: write only. After the secret is set, adding ai-review on a PR triggers the review.

Scaffolded with `ecr init --token-env META_API_KEY`, model set to
`meta/muse-spark-1.2` with auth `meta/api-key/META_API_KEY`. Workflows
wired to META_API_KEY and ECR_EXPECTED_TOKEN_ENV, Claude CLI install step
removed per Muse-only setup. Verified locally: verify-config OK,
doctor 3 agents (consistency/correctness/security) + coordinator, ref-check OK,
review correctly gates on META_API_KEY.

Integration stops at credential — set META_API_KEY repo secret (Meta AI
developer portal) and optional ECR_VERSION/BRAVE_SEARCH_API_KEY to enable.
@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Aug 19, 2026
@Abbondanzo
Abbondanzo marked this pull request as draft August 19, 2026 18:32
@Abbondanzo Abbondanzo changed the title Add @expo/code-review-cli (Muse Spark / META_API_KEY) Add @expo/code-review-cli Aug 19, 2026
- Forward META_API_KEY from secrets.EXPO_CODE_REVIEW_API_KEY as you defined (env var stays META_API_KEY to match tokenEnv)
- Add continue-on-error to Guard step so initial PR that introduces .expo-code-review/ does not fail the job when base has no config (expected fail-closed, next PR will be first reviewed)
- Mirrored in command workflow
Set review.trigger to label so ecr ci self-gates to PRs
labeled ai-review (or ai-review:<agent>), with ai-review:skip
still winning. Keeps the workflow's coarse skip-label gate
as spin-up avoidance; real policy is now config-driven.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. p: Facebook Partner: Facebook Partner

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant