Fix PR Review Automation for cross-repository PRs (#571)

* Add PR review automation workflow and script

closes #559

* Improve PR review automation with better error handling and permissions

* Update PR review automation to use pull_request_target event for improved security

* Fix PR automation to handle cross-repo references correctly

- Use SHA instead of ref names to avoid 404 errors
- Handle head content from source repo and base from target repo
- Add better error handling and debugging info
- Prevent workflow failures when API check fails

scripts/pr-review-automation.js

@@ -15,6 +15,10 @@ async function run() {
     console.log(`PR author: ${pr.user.login}`);
     console.log(`Head repo: ${pr.head.repo.full_name}`);
     console.log(`Base repo: ${pr.base.repo.full_name}`);
+    console.log(`Head SHA: ${pr.head.sha}`);
+    console.log(`Base SHA: ${pr.base.sha}`);
+    console.log(`Head ref: ${pr.head.ref}`);
+    console.log(`Base ref: ${pr.base.ref}`);
 
   const filesChanged = await octokit.rest.pulls.listFiles({
     owner,
@@ -82,18 +86,22 @@ async function run() {
 }
 
 async function checkForNewApiLinks(owner, repo, pr) {
+  try {
+    // For pull_request_target, we need to get content from the correct repositories
+    // Base content from the target repository (upstream)
     const baseRes = await octokit.rest.repos.getContent({
       owner,
       repo,
       path: "README.md",
-    ref: pr.base.ref,
+      ref: pr.base.sha, // Use SHA instead of ref name
     });
 
+    // Head content from the source repository (could be a fork)
     const headRes = await octokit.rest.repos.getContent({
-    owner,
+      owner: pr.head.repo.owner.login,
-    repo,
+      repo: pr.head.repo.name,
       path: "README.md",
-    ref: pr.head.ref,
+      ref: pr.head.sha, // Use SHA instead of ref name
     });
 
     const decode = (res) =>
@@ -123,6 +131,10 @@ async function checkForNewApiLinks(owner, repo, pr) {
     }
 
     return newLinks;
+  } catch (error) {
+    console.error("Error checking for new API links:", error);
+    return []; // Return empty array on error to avoid breaking the workflow
+  }
 }
 
 run().catch((error) => {