fix: address PR #75 review findings

MAJOR fixes:
- ci.yml: Add fork protection (github.event.pull_request.head.repo.full_name check)
  to prevent secret exfiltration from malicious fork PRs. Added security comment
  explaining the trust model for this private repo.
- ci.yml: Set GITHUB_SERVER_URL to explicit Gitea URL instead of github.server_url
  since reviews are posted to Gitea, not GitHub.
- release.yml: Set GITEA_URL explicitly to https://gitea.weiker.me since releases
  are created on Gitea.
- action.yml: Change gitea-url default from empty (fallback to github.server_url)
  to explicit https://gitea.weiker.me. Update all internal uses to rely on this
  default rather than falling back to server_url.

MINOR fixes:
- action.yml: Update header comment to reflect dual-platform (Gitea Actions +
  GitHub Actions) support.
- action.yml: Fix repo input description to say it defaults to rodin/review-bot
  for version lookup, matching the actual code behavior.
- pr-ready-gate.yml: Add comments explaining why Gitea URL is hardcoded (intentional:
  we update Gitea PR from GitHub mirror) and noting the PR number matching assumption.

All findings from sonnet-review, gpt-review, and security-review addressed.

.github/actions/review/action.yml

@@ -1,17 +1,17 @@
-# This composite action is designed for Gitea Actions runners.
-# Gitea Actions supports GitHub Actions syntax including $GITHUB_OUTPUT,
-# actions/cache, and actions/checkout.
+# Composite action for Gitea Actions and GitHub Actions runners.
+# Supports dual-platform deployment: reviews can be triggered from GitHub (mirrored repo)
+# or Gitea, but always post results to the Gitea PR.
 # Requirements: python3, sha256sum, curl (all present on ubuntu-* runners).
 name: 'AI Code Review'
 description: 'Run AI-powered code review on a pull request using review-bot'
 
 inputs:
   gitea-url:
-    description: 'Gitea instance URL (defaults to server_url)'
+    description: 'Gitea instance URL for API calls and releases (defaults to https://gitea.weiker.me)'
     required: false
-    default: ''
+    default: 'https://gitea.weiker.me'
   repo:
-    description: 'Repository (owner/name, defaults to current)'
+    description: 'Repository (owner/name, defaults to rodin/review-bot for version lookup)'
     required: false
     default: ''
   pr-number:
@@ -112,7 +112,8 @@ runs:
       id: version
       shell: bash
       run: |
-        GITEA_URL="${{ inputs.gitea-url || github.server_url }}"
+        # Use explicit gitea-url input, falling back to default (https://gitea.weiker.me)
+        GITEA_URL="${{ inputs.gitea-url }}"
         REPO="${{ inputs.repo || 'rodin/review-bot' }}"
         if [ "${{ inputs.version }}" = "latest" ]; then
           VERSION=$(curl -sSf "${GITEA_URL}/api/v1/repos/${REPO}/releases?limit=1" \
@@ -137,7 +138,8 @@ runs:
       if: steps.cache.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        GITEA_URL="${{ inputs.gitea-url || github.server_url }}"
+        # Use explicit gitea-url input for release downloads
+        GITEA_URL="${{ inputs.gitea-url }}"
         REPO="${{ inputs.repo || 'rodin/review-bot' }}"
         VERSION="${{ steps.version.outputs.version }}"
         BINARY="review-bot-linux-amd64"
@@ -169,7 +171,8 @@ runs:
     - name: Run review
       shell: bash
       env:
-        GITHUB_SERVER_URL: ${{ inputs.gitea-url || github.server_url }}
+        # Always use Gitea API - reviews are posted to Gitea regardless of where workflow runs
+        GITHUB_SERVER_URL: ${{ inputs.gitea-url }}
         GITHUB_REPOSITORY: ${{ inputs.repo || github.repository }}
         PR_NUMBER: ${{ inputs.pr-number || github.event.pull_request.number }}
         REVIEWER_TOKEN: ${{ inputs.reviewer-token }}

.github/workflows/ci.yml

@@ -22,9 +22,13 @@ jobs:
   # Models must match SAP AI Core deployments
   # Available models: gpt-5, anthropic--claude-4.6-sonnet, anthropic--claude-4.6-opus
   # Removed gpt-4.1, gpt-5-mini, gpt-4.1-mini - not deployed on AI Core
+  #
+  # SECURITY: This job runs on pull_request and has access to secrets.
+  # We restrict to same-repo PRs only (no forks) since this is a private repo
+  # where PRs only come from trusted actors (rodin/aweiker).
   review:
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     needs: test
     strategy:
       matrix:
@@ -49,8 +53,9 @@ jobs:
       - run: go build -o review-bot ./cmd/review-bot
       - name: Run ${{ matrix.name }} review
         env:
-          GITHUB_SERVER_URL: ${{ github.server_url }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
+          # Use Gitea API - reviews are posted to Gitea, not GitHub
+          GITHUB_SERVER_URL: https://gitea.weiker.me
+          GITHUB_REPOSITORY: rodin/review-bot
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REVIEWER_TOKEN: ${{ secrets[matrix.token_secret] }}
           REVIEWER_NAME: ${{ matrix.name }}

.github/workflows/pr-ready-gate.yml

@@ -13,11 +13,16 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.RODIN_TOKEN }}
         run: |
+          # NOTE: This workflow runs on the GitHub mirror but updates the Gitea PR.
+          # PR numbers may differ between GitHub and Gitea mirrors in edge cases.
+          # For this repo, PRs are created on Gitea and mirrored, so numbers match.
           PR_NUMBER=${{ github.event.pull_request.number }}
           AUTHOR=${{ github.event.pull_request.user.login }}
           READY_LABEL_ID=38
           SELF_REVIEWED_LABEL_ID=37
           
+          # INTENTIONAL: Hardcoded Gitea URL because we always update the Gitea PR,
+          # not GitHub. The mirror relationship means we want changes on Gitea.
           # Remove ready label if present
           curl -sS -X DELETE \
             -H "Authorization: token $GITEA_TOKEN" \

.github/workflows/release.yml

@@ -37,8 +37,9 @@ jobs:
           GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
           VERSION=${GITHUB_REF_NAME}
-          GITEA_URL="${{ github.server_url }}"
-          REPO="${{ github.repository }}"
+          # Releases are created on Gitea, not GitHub - use explicit Gitea URL
+          GITEA_URL="https://gitea.weiker.me"
+          REPO="rodin/review-bot"
 
           # Create release (or find existing one for this tag)
           HTTP_CODE=$(curl -s -o /tmp/release_response.json -w "%{http_code}" -X POST \