feat(review): prompt_file_pattern + self-checkout guideline discovery

[chouetz]

Summary

• Adds prompt_file_pattern (glob-based guideline discovery, mutually exclusive with prompt_file), with the discovery/scoping logic extracted to src/guidelines.js and exposed as a standalone bin/find-guidelines.js CLI for reuse from other repos (e.g. datadog-agent's local dda review task).
• Replaces the scan.js/guidelines.js heredocs in the workflow with a self-checkout of this action's own repo pinned to job.workflow_sha, so the scripts are require()'d directly instead of duplicated inline in the YAML.

Test plan (this PR is the test)

• ai-review.yml on this branch points at itself (@feat/prompt-file-pattern) and uses prompt_file_pattern: '**/codereview_guideline.md' instead of prompt_file, to exercise both new mechanisms end-to-end via a real /dd-review run.
• fibonacci.py has an intentional off-by-one bug for the reviewer to catch.
• Will comment /dd-review after opening and watch whether prepare's new self-checkout step (job.workflow_repository/job.workflow_sha) actually resolves — this is a very recently shipped GitHub Actions feature and actionlint doesn't even recognize it yet, so this PR is the real verification.

🤖 Generated with Claude Code

[chouetz]

/dd-review

[chouetz]

/dd-review

[github-actions]

AI review by Claude - workflow run

Review summary

The change is well-structured and thoroughly tested: the prompt_file/prompt_file_pattern mutual-exclusivity guard, path-traversal protection, directory-prefix scoping, and built-in fallback are all preserved from the previous inline implementation and now shared between the workflow and the new find-guidelines CLI. The self-checkout of the action's own repo at job.workflow_sha is a sound way to avoid duplicating scan.js/guidelines.js, and its trust equivalence to the workflow file itself is accurate (the SHA is resolved from the caller's pinned uses: ref, not from PR content).

One genuine but low-severity issue: discoverPatternFiles returns matches in fs.readdirSync order, which is not guaranteed to be sorted. This makes the order of aggregated guidelines (and thus guidelinesBody) filesystem-dependent, unlike the explicit prompt_file list whose order is user-controlled. The docs claim the two inputs behave identically w.r.t. scoping, but pattern-discovered ordering is non-deterministic. Sorting the result would make output reproducible and also happens to place root-level guides first. This does not affect functional correctness of what gets included, only ordering.

Verdict: patch is correct. The feature works as designed and is well tested; the only finding is a non-blocking determinism nit. Confidence: 0.82.

[chouetz]

/dd-review

[github-actions]

AI review by Claude - workflow run

Review verdict: patch is incorrect

The workflow changes (adding prompt_file_pattern, extracting src/guidelines.js/src/scan.js via self-checkout, the find-guidelines CLI, and the accompanying tests) are well-structured, internally consistent, and thoroughly tested. The glob translation, scoping rule, mutual-exclusivity gating, and fallback behavior all look correct.

However, the newly added fibonacci.py (a fixture added in this PR to exercise the self-checkout review path) contains an off-by-one bug that makes its output wrong for the sequence it claims to compute. Since the file is introduced by this patch and produces incorrect results, the patch is incorrect.

Confidence: 0.9

[github-actions]

Off-by-one: for a 0-indexed sequence (as the docstring states: fib(0)=0, fib(1)=1, fib(2)=1, fib(3)=2), this loop iterates n-1 times and returns fib(n-1). fibonacci(1) returns 0 (should be 1) and fibonacci(3) returns 1 (should be 2). The loop must run n times.

Suggested change

	for _ in range(n - 1):
	for _ in range(n):

[chouetz]

/dd-review

[github-actions]

AI review by Claude - workflow run

Review verdict: patch is correct

This PR adds a prompt_file_pattern glob input (mutually exclusive with prompt_file), extracts guideline discovery/scoping/aggregation into a shared, well-tested src/guidelines.js, exposes it as a find-guidelines CLI, and replaces the inlined scan.js heredoc with a pinned self-checkout (job.workflow_sha) + cp.

I verified the following and found no actionable issues:

• Glob → regex (globToRegExp) correctly handles **/, **, *, ?, and literal-escapes metacharacters; consistent with the test matrix.
• Walk-up discovery (discoverGuidelinesForChangedFiles) is equivalent to discoverPatternFiles + isInScope. The only theoretical divergence — isInScope's f === dir branch not being mirrored — is unreachable, since a changed-file path cannot also be a directory that contains a guideline.
• Sparse-checkout with the pattern uses non-cone gitignore matching (matches root + nested), and existsSync guards keep the walk-up safe when intermediate dirs aren't materialized.
• Self-checkout + cp: both src/scan.js and src/guidelines.js exist, so staging won't fail; the module-resolution anchor package.json is preserved.
• Mutual exclusivity is enforced consistently in the gate, buildGuidelines, and the CLI, with matching exit-code semantics.
• Pattern-mode reads are contained within trustedDir (paths come from directory listings; symlinks are excluded via entry.isFile()).
• README, actionlint ignore, workflow input definitions, and the prompt.md→codereview_guideline.md rename are internally consistent, and this repo's own root-level guide still always applies (no behavior regression).

Confidence: 0.85