ci: add trusted-contributor AI PR review#15
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0ea1ab89fd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| echo "author=${{ github.event.pull_request.user.login }}" | ||
| echo "base_ref=${{ github.event.pull_request.base.ref }}" | ||
| echo "head_repo=${{ github.event.pull_request.head.repo.full_name }}" | ||
| echo "head_ref=${{ github.event.pull_request.head.ref }}" |
There was a problem hiding this comment.
In the pull_request path this writes the PR branch name directly into the generated shell script before Bash executes it. GitHub allows branch names with shell metacharacters such as $, so a branch like feat$(curl${IFS}...) can run arbitrary commands in this step before the trusted gate while GH_TOKEN is present. Pass these event fields through env/JSON and write them with printf/Python instead of interpolating them into shell.
Useful? React with 👍 / 👎.
| A section whose only content is `_None._` (case-insensitive) is empty. | ||
| """ | ||
| findings: dict[str, list[str]] = {"P0": [], "P1": [], "P2": []} | ||
| matches = list(_SECTION_RE.finditer(review_md)) |
There was a problem hiding this comment.
Here a response with no matching headings leaves matches empty and returns zero findings, and verdict_from_findings then treats that as clean; the same happens for P0 text that is not a bullet. If Claude is truncated, refuses, or otherwise deviates from the requested format, the workflow can label and auto-approve without a valid review. Treat missing/malformed required sections as a failed or skipped review instead.
Useful? React with 👍 / 👎.
| ) | ||
| else: | ||
| set_output("trusted_auto_approve", "skipped-author") | ||
| else: |
There was a problem hiding this comment.
After a PR has once been labeled ai-review-passed, a later synchronize run with P0 findings only reaches this skipped-p0 output and never removes the existing label. The PR will still display the pass label next to a blocking AI review, so the label's status is backwards until someone removes it manually; remove PASS_LABEL on non-clean verdicts.
Useful? React with 👍 / 👎.
1 participant
Summary
ai-review-passed, and approve only when there are zero P0 findings.Safety
git diff; it is not executed with secrets.AI_REVIEW_TRUSTED_AUTHORS.AI_REVIEW_APPROVER_TOKEN; without it the workflow still reviews/comments but skips approval.Required config
AI_REVIEW_TRUSTED_AUTHORS.ANTHROPIC_API_KEYfor AI review.AI_REVIEW_APPROVER_TOKENfor trusted-author approve.Test plan
.github/ai_pr_review.pydry-run with a clean mocked review from the source template.