From 821120618795d411101deccf6af11cf41f36a119 Mon Sep 17 00:00:00 2001
From: Charles Bochet <charlesBochet@users.noreply.github.com>
Date: Tue, 28 Jul 2026 15:47:37 +0200
Subject: [PATCH] ci(pr-review): single PR review dispatcher (#23418)

rm
---
 .../workflows/pr-auto-review-dispatch.yaml    | 35 --------
 .github/workflows/pr-review-dispatch.yaml     | 82 +++++++++++++++++++
 2 files changed, 82 insertions(+), 35 deletions(-)
 delete mode 100644 .github/workflows/pr-auto-review-dispatch.yaml
 create mode 100644 .github/workflows/pr-review-dispatch.yaml

diff --git a/.github/workflows/pr-auto-review-dispatch.yaml b/.github/workflows/pr-auto-review-dispatch.yaml
deleted file mode 100644
index 5813d03570..0000000000
--- a/.github/workflows/pr-auto-review-dispatch.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: PR Review Dispatch
-
-on:
-  pull_request_target:
-    types: [ready_for_review, synchronize]
-
-permissions: {}
-
-concurrency:
-  group: pr-review-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  dispatch:
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Mint ci-privileged dispatch token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
-          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
-          owner: twentyhq
-          repositories: ci-privileged
-          permission-actions: write
-
-      - name: Dispatch to ci-privileged
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          gh workflow run pr-review.yaml --repo twentyhq/ci-privileged --ref main \
-            -f pr_number="$PR_NUMBER"
diff --git a/.github/workflows/pr-review-dispatch.yaml b/.github/workflows/pr-review-dispatch.yaml
new file mode 100644
index 0000000000..5a2d6e39fd
--- /dev/null
+++ b/.github/workflows/pr-review-dispatch.yaml
@@ -0,0 +1,82 @@
+name: PR Review Dispatch
+run-name: "PR Review Dispatch (${{ github.event_name }})"
+
+on:
+  pull_request_target:
+    types: [ready_for_review, synchronize, labeled]
+  issue_comment:
+    types: [created]
+
+permissions: {}
+
+concurrency:
+  group: pr-review-dispatch-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+
+jobs:
+  dispatch:
+    if: >
+      (github.event_name == 'pull_request_target' && github.event.action != 'labeled' && github.event.pull_request.draft == false) ||
+      (github.event_name == 'pull_request_target' && github.event.action == 'labeled' && startsWith(github.event.label.name, 'pr-review-')) ||
+      (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && startsWith(github.event.comment.body, '/pr-review') && contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), github.event.comment.author_association))
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Resolve target + checks
+        id: resolve
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          ACTION: ${{ github.event.action }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          LABEL_NAME: ${{ github.event.label.name }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          set -euo pipefail
+          allowed="security triage standard"
+          is_valid() { printf '%s\n' $allowed | grep -qx "$1"; }
+
+          if [ "$EVENT_NAME" = "issue_comment" ]; then
+            NUM="$ISSUE_NUMBER"
+            CHECK=$(printf '%s' "$COMMENT_BODY" | sed -nE 's#^/pr-review[[:space:]]+([a-z]+).*#\1#p' | head -1)
+            CHECKS="${CHECK:-standard}"
+          elif [ "$ACTION" = "labeled" ]; then
+            NUM="$PR_NUMBER"
+            CHECKS="${LABEL_NAME#pr-review-}"
+          else
+            NUM="$PR_NUMBER"
+            CHECKS="security,triage"
+          fi
+
+          ok=true
+          IFS=',' read -ra parts <<< "$CHECKS"
+          for p in "${parts[@]}"; do is_valid "$p" || ok=false; done
+
+          if [ "$ok" = true ] && [ -n "$NUM" ]; then
+            echo "pr_number=$NUM" >> "$GITHUB_OUTPUT"
+            echo "checks=$CHECKS" >> "$GITHUB_OUTPUT"
+            echo "dispatch=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "dispatch=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Mint ci-privileged dispatch token
+        if: steps.resolve.outputs.dispatch == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
+          private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
+          owner: twentyhq
+          repositories: ci-privileged
+          permission-actions: write
+
+      - name: Dispatch to ci-privileged
+        if: steps.resolve.outputs.dispatch == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ steps.resolve.outputs.pr_number }}
+          CHECKS: ${{ steps.resolve.outputs.checks }}
+        run: |
+          gh workflow run pr-review.yaml --repo twentyhq/ci-privileged --ref main \
+            -f pr_number="$PR_NUMBER" -f checks="$CHECKS"