shadow.yml

# Shadow PR review bot — installed via reusable workflow at sudsali/shadow.
# See https://github.com/sudsali/shadow for docs and security model.
name: Shadow

# Embed the PR/issue number in the run name. The reusable workflow's run-name
# is ignored when invoked via workflow_call — only the caller's template
# applies. This is what lets the rate-limit gate (BOT_MAX_RUNS_PER_HOUR) match
# prior runs for issue/issue_comment events, where the workflow_run record
# has no `pull_requests` array to match on.
run-name: "Shadow #${{ github.event.pull_request.number || github.event.issue.number || inputs.pr_number }}"

on:
  pull_request_target:
    types: [opened, reopened, synchronize]
  issues:
    types: [opened, reopened]
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      pr_number:
        required: true
        description: "PR number to review"
      dry_run:
        type: boolean
        default: false
      shadow_ref:
        default: v0
        description: "Pin to a Shadow release (v0 or commit SHA)"

permissions:
  contents: read
  id-token: write
  pull-requests: write
  issues: write

jobs:
  shadow:
    uses: sudsali/shadow/.github/workflows/shadow-review.yml@v0
    with:
      pr_number: ${{ inputs.pr_number }}
      dry_run: ${{ inputs.dry_run && 'true' || 'false' }}
      shadow_ref: ${{ inputs.shadow_ref || 'v0' }}
    secrets:
      AWS_ROLE_ARN: ${{ secrets.AWS_ROLE_ARN }}
      GUARDRAIL_ID: ${{ secrets.GUARDRAIL_ID }}
      GUARDRAIL_VERSION: ${{ secrets.GUARDRAIL_VERSION }}