Provide a way to integrate/configure googleapis/code-suggester so openrewrite diff is displayed as GitHub PR suggestions

[vlsi]

What problem are you trying to solve?

It would be nice if OpenRewrite suggestions could be displayed as PR suggestions in GitHub UI.

Describe the solution you'd like

• "check style workflow" executes OpenRewrite, produces a diff/patch/whatever file as workflow artifact
• A separate on: workflow_run: types: completed workflow picks up the attached patch artifact and calls https://github.com/googleapis/code-suggester to create code suggestions

A dedicated on: workflow_run workflow would be able to access secrets, so it would be relatively secure, and it would not allow PR builds to access secrets.

Unfortunately, the current googleapis/code-suggester does not support comments for suggestions. In other words, it creates only ```suggestion ... ``` comment, and it would probably be great to pass extra information like the rule name to the message.

For instance, ErrorProne's messages include a link with detailed explanation and the summary:

ERROR: example/myproject/BUILD:29:1: Java compilation in rule '//example/myproject:hello'
ShortSet.java:6: error: [CollectionIncompatibleType] Argument 'i - 1' should not be passed to this method;
its type int is not compatible with its collection's type argument Short
      s.remove(i - 1);
              ^
    (see http://errorprone.info/bugpattern/CollectionIncompatibleType)

OpenRewrite could probably add a link to the rule documentation so the users could know the intention behind the rule.

Additional context

• Add class without license header timtebeek/code-suggester-action-reproducer#1
• Print patch produced by rewriteDryRun to build console so users can understand violations when running in CI rewrite-gradle-plugin#255
• https://docs.github.com/en/rest/pulls/reviews?apiVersion=2022-11-28#create-a-review-for-a-pull-request
• INFRA-25352: Provide user / personal access token for a user that could add PR suggestions for automatic code reviews

[vlsi]

It looks like pull requests=read and write should be enough for the action to create suggestions.
Unfortunately, it would imply the commenter user would have permission to merge PRs.

Here's a screenshot from New fine-grained personal access token page:

[koppor]

As far as I understand reviewdog, it supports diff as input, which should be enough to send the patch file to the API and then one has the suggestions?

It can even made be more simpler - if the diff is existing in the working tree: https://github.com/reviewdog/action-suggester

(I put that as TODO on my list; I wanted to share fast, because we made good experiences in the context of checkstyle with reviewdog)

[timtebeek]

Thanks for the helpful link @koppor; hadn't come across reviewdog before, and seems a convenient option for other platforms than GitHub indeed. For now I'd started to work with code-suggester in these two PRs, and will expand that with recipe runs:

• Automatically review PRs gh-automation#48
• Automatically review PRs rewrite-migrate-java#402

That approach helpfully hides the implementation details in a shared workflow, such that we can always switch as needed. I'd for now considered this something to use on the OpenRewrite repositories itself, but we can look at opening that up as an action ourselves in the future as well. Input & help welcome. :)

[timtebeek]

As part of openrewrite/gh-automation#45 we now have two new workflows that together review PRs:
The first one receives a PR and runs recipes, while the second comments any changes found as code suggestions.

• https://github.com/openrewrite/gh-automation/blob/main/.github/workflows/receive-pr.yml
• https://github.com/openrewrite/gh-automation/blob/main/.github/workflows/comment-pr.yml

An example of such automated review comments can be seen here openrewrite/rewrite-testing-frameworks#343 (review)

We're likely to refine and expand this approach still, but I believe this is a good first step to show how this can be achieved. We don't yet insert accompanying comments, and that's perhaps indeed not supported by code-suggester, but good enough for use on our own PRs for now.

Further input and suggestions welcome, but I think we've achieved enough to close this issue already; I'll monitor any comments that arrive still, and can reopen if needed.