action.yml

name: "Cortex Code Action"
description: "AI code review for data teams, powered by Cortex Code"

branding:
  icon: "git-pull-request"
  color: "blue"

inputs:
  snowflake_private_key:
    description: "Snowflake private key PEM (from GitHub secret)"
    required: true
  snowflake_account:
    description: "Snowflake account identifier (e.g. myorg-myaccount)"
    required: true
  snowflake_user:
    description: "Snowflake username"
    required: true
  snowflake_role:
    description: "Snowflake role to use in CI (use minimal privilege, not ACCOUNTADMIN)"
    required: false
    default: "PUBLIC"
  snowflake_warehouse:
    description: "Snowflake warehouse"
    required: false
    default: "COMPUTE_WH"
  snowflake_database:
    description: "Default Snowflake database"
    required: false
    default: ""
  snowflake_schema:
    description: "Default Snowflake schema"
    required: false
    default: ""
  trigger_phrase:
    description: "Phrase that triggers the action in comments"
    required: false
    default: "@cortex"
  prompt_file:
    description: |
      Path(s) to instruction files, one per line. Files are read in order and
      concatenated. Paths are relative to the repository root.
      Example (multiline):
        .github/instructions/base.md
        .github/instructions/dbt-rules.md
    required: false
    default: ""
  prompt:
    description: "Additional instructions appended after prompt_file content (if any)"
    required: false
    default: ""
  max_turns:
    description: "Maximum agentic turns (capped at 15 regardless of this value)"
    required: false
    default: "5"
  mode:
    description: "Execution mode: auto (detect from event), review, mention, fix"
    required: false
    default: "auto"
  permissions:
    description: "Tool permissions: read-only (default) or read-write (enables auto-fix commits)"
    required: false
    default: "read-only"
  track_progress:
    description: "Post a sticky progress comment that updates in real-time"
    required: false
    default: "true"
  model:
    description: "Cortex model to use (auto selects the best available)"
    required: false
    default: "auto"
  github_token:
    description: "GitHub token for posting comments and commits"
    required: false
    default: "${{ github.token }}"

outputs:
  comment_id:
    description: "ID of the posted review comment"
    value: ${{ steps.run.outputs.comment_id }}

runs:
  using: "composite"
  steps:
    - name: Setup Bun
      uses: oven-sh/setup-bun@v2
      with:
        bun-version: "1.3.13"

    - name: Install Cortex Code CLI
      shell: bash
      run: |
        curl -LsS https://ai.snowflake.com/static/cc-scripts/install.sh | sh
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"

    - name: Setup Snowflake connection
      shell: bash
      env:
        SNOWFLAKE_PRIVATE_KEY_RAW: ${{ inputs.snowflake_private_key }}
        SNOWFLAKE_ACCOUNT: ${{ inputs.snowflake_account }}
        SNOWFLAKE_USER: ${{ inputs.snowflake_user }}
        SNOWFLAKE_ROLE: ${{ inputs.snowflake_role }}
        SNOWFLAKE_WAREHOUSE: ${{ inputs.snowflake_warehouse }}
        SNOWFLAKE_DATABASE: ${{ inputs.snowflake_database }}
        SNOWFLAKE_SCHEMA: ${{ inputs.snowflake_schema }}
      run: |
        mkdir -p ~/.snowflake
        printf '%s\n' "${SNOWFLAKE_PRIVATE_KEY_RAW}" > ~/.snowflake/rsa_key.p8
        chmod 600 ~/.snowflake/rsa_key.p8
        {
          echo '[default]'
          echo "account = \"${SNOWFLAKE_ACCOUNT}\""
          echo "user = \"${SNOWFLAKE_USER}\""
          echo 'authenticator = "SNOWFLAKE_JWT"'
          echo 'private_key_path = "~/.snowflake/rsa_key.p8"'
          echo "role = \"${SNOWFLAKE_ROLE}\""
          echo "warehouse = \"${SNOWFLAKE_WAREHOUSE}\""
          [ -n "${SNOWFLAKE_DATABASE}" ] && echo "database = \"${SNOWFLAKE_DATABASE}\""
          [ -n "${SNOWFLAKE_SCHEMA}" ] && echo "schema = \"${SNOWFLAKE_SCHEMA}\""
        } > ~/.snowflake/connections.toml
        chmod 600 ~/.snowflake/connections.toml

    - name: Install action dependencies
      shell: bash
      working-directory: ${{ github.action_path }}
      run: bun install --frozen-lockfile --production

    - name: Run Cortex Code Action
      id: run
      shell: bash
      working-directory: ${{ github.action_path }}
      env:
        INPUT_TRIGGER_PHRASE: ${{ inputs.trigger_phrase }}
        INPUT_PROMPT_FILE: ${{ inputs.prompt_file }}
        INPUT_PROMPT: ${{ inputs.prompt }}
        INPUT_MAX_TURNS: ${{ inputs.max_turns }}
        INPUT_MODE: ${{ inputs.mode }}
        INPUT_PERMISSIONS: ${{ inputs.permissions }}
        INPUT_TRACK_PROGRESS: ${{ inputs.track_progress }}
        INPUT_MODEL: ${{ inputs.model }}
        GITHUB_TOKEN: ${{ inputs.github_token }}
        GITHUB_EVENT_NAME: ${{ github.event_name }}
        GITHUB_EVENT_PATH: ${{ github.event_path }}
        GITHUB_REPOSITORY: ${{ github.repository }}
        GITHUB_SHA: ${{ github.sha }}
      run: bun run src/entrypoints/run-cortex.ts