fix: address review feedback — tokens, secrets, no hardcoded IPs

- Fix token_secret for gpt41/gpt5-mini/gpt41-mini: use GPT_REVIEW_TOKEN instead of SONNET_REVIEW_TOKEN (wrong reviewer identity) - Move LLM base URL back to secrets.LLM_BASE_URL (prevents exfiltration via PR-controlled matrix values) - Remove hardcoded internal IP from workflow file; only provider path suffix (/anthropic/v1, /openai/v1) remains in matrix Addresses: security-review-bot REQUEST_CHANGES (major: exfiltration risk, minor: HTTP/hardcoded IP) and sonnet-review-bot REQUEST_CHANGES (major: wrong token_secret on gpt entries).
ci: fix reviewer models — sonnet uses Anthropic, gpt uses GPT-5
2026-05-03 08:42:08 -07:00 · 2026-05-02 21:06:11 -07:00
1 changed files with 24 additions and 2 deletions
@@ -28,12 +28,33 @@ jobs:
        include:
          - name: sonnet
            token_secret: SONNET_REVIEW_TOKEN
-            model: gpt-5
+            provider: anthropic
+            llm_path: /anthropic/v1
+            model: claude-sonnet-4-6
          - name: gpt
            token_secret: GPT_REVIEW_TOKEN
+            provider: openai
+            llm_path: /openai/v1
+            model: gpt-5
+          - name: gpt41
+            token_secret: GPT_REVIEW_TOKEN
+            provider: openai
+            llm_path: /openai/v1
            model: gpt-4.1
+          - name: gpt5-mini
+            token_secret: GPT_REVIEW_TOKEN
+            provider: openai
+            llm_path: /openai/v1
+            model: gpt-5-mini
+          - name: gpt41-mini
+            token_secret: GPT_REVIEW_TOKEN
+            provider: openai
+            llm_path: /openai/v1
+            model: gpt-4.1-mini
          - name: security
            token_secret: SECURITY_REVIEW_TOKEN
+            provider: openai
+            llm_path: /openai/v1
            model: gpt-5
            system_prompt_file: SECURITY_REVIEW.md
    steps:
@@ -49,9 +70,10 @@ jobs:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REVIEWER_TOKEN: ${{ secrets[matrix.token_secret] }}
          REVIEWER_NAME: ${{ matrix.name }}
-          LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
+          LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}${{ matrix.llm_path }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
          LLM_MODEL: ${{ matrix.model }}
+          LLM_PROVIDER: ${{ matrix.provider }}
          CONVENTIONS_FILE: "CONVENTIONS.md"
          PATTERNS_REPO: "rodin/go-patterns"
          PATTERNS_FILES: "README.md,patterns/"
Author	SHA1	Message	Date
Rodin	f48288bf2e	fix: address review feedback — tokens, secrets, no hardcoded IPs CI / test (pull_request) Successful in 14s Details CI / review (/anthropic/v1, claude-sonnet-4-6, sonnet, anthropic, SONNET_REVIEW_TOKEN) (pull_request) Successful in 22s Details CI / review (/openai/v1, gpt-4.1-mini, gpt41-mini, openai, GPT_REVIEW_TOKEN) (pull_request) Successful in 21s Details CI / review (/openai/v1, gpt-4.1, gpt41, openai, GPT_REVIEW_TOKEN) (pull_request) Successful in 22s Details CI / review (/openai/v1, gpt-5, security, openai, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 45s Details CI / review (/openai/v1, gpt-5, gpt, openai, GPT_REVIEW_TOKEN) (pull_request) Successful in 52s Details CI / review (/openai/v1, gpt-5-mini, gpt5-mini, openai, GPT_REVIEW_TOKEN) (pull_request) Successful in 48s Details - Fix token_secret for gpt41/gpt5-mini/gpt41-mini: use GPT_REVIEW_TOKEN instead of SONNET_REVIEW_TOKEN (wrong reviewer identity) - Move LLM base URL back to secrets.LLM_BASE_URL (prevents exfiltration via PR-controlled matrix values) - Remove hardcoded internal IP from workflow file; only provider path suffix (/anthropic/v1, /openai/v1) remains in matrix Addresses: security-review-bot REQUEST_CHANGES (major: exfiltration risk, minor: HTTP/hardcoded IP) and sonnet-review-bot REQUEST_CHANGES (major: wrong token_secret on gpt entries).	2026-05-03 08:42:08 -07:00
Rodin	b4c994d0fa	ci: fix reviewer models — sonnet uses Anthropic, gpt uses GPT-5 CI / test (pull_request) Successful in 14s Details CI / review (http://100.86.77.84:6655/openai/v1, gpt-4.1-mini, gpt41-mini, openai, SONNET_REVIEW_TOKEN) (pull_request) Successful in 19s Details CI / review (http://100.86.77.84:6655/openai/v1, gpt-4.1, gpt41, openai, SONNET_REVIEW_TOKEN) (pull_request) Successful in 22s Details CI / review (http://100.86.77.84:6655/anthropic/v1, claude-sonnet-4-6, sonnet, anthropic, SONNET_REVIEW_TOKEN) (pull_request) Successful in 24s Details CI / review (http://100.86.77.84:6655/openai/v1, gpt-5, gpt, openai, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m14s Details CI / review (http://100.86.77.84:6655/openai/v1, gpt-5, security, openai, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 54s Details CI / review (http://100.86.77.84:6655/openai/v1, gpt-5-mini, gpt5-mini, openai, SONNET_REVIEW_TOKEN) (pull_request) Successful in 55s Details The matrix was wrong: "sonnet" was running GPT-5 and "gpt" was running GPT-4.1. Now: - sonnet → Claude Sonnet 4.6 via HAI Anthropic endpoint - gpt → GPT-5 via HAI OpenAI endpoint - security → GPT-5 via HAI OpenAI endpoint Each matrix entry specifies its own provider and base_url.	2026-05-02 21:06:11 -07:00