feat: add GitHub Actions support #75
Closed
rodin
wants to merge 1 commits from
github-support into main
pull from: github-support
merge into: rodin:main
rodin:main
rodin:ci/cleanup
rodin:ci-selfreview-gate
rodin:issue-150
rodin:issue-157
rodin:issue-141
rodin:issue-154
rodin:review-bot-dev-loop
rodin:issue-143
rodin:issue-146
rodin:pr-153
rodin:review-bot-issue-130-work
rodin:issue-148
rodin:issue-139
rodin:issue-137
rodin:review-bot-fixes
rodin:review-bot-issue-133
rodin:review-bot-issue-130
rodin:issue-130
rodin:issue-123-work
rodin:issue-123
rodin:review-bot-issue-120
rodin:fix/125-readme-cli-example
rodin:issue-125
rodin:issue-124
rodin:issue-120
rodin:feature/github-support
rodin:review-bot-issue-116
rodin:review-bot-issue-115
rodin:review-bot-issue-114
rodin:review-bot-issue-96
rodin:review-bot-issue-107
rodin:review-bot-issue-82
rodin:review-bot-issue-95
rodin:review-bot-issue-92
rodin:review-bot-issue-94
rodin:review-bot-issue-81
rodin:review-bot-issue-91
rodin:review-bot-issue-97
rodin:issue-80-c-file-reader
rodin:issue-80-b-pr-reader
rodin:issue-80-a-client
rodin:review-bot-issue-80
rodin:review-bot-issue-87
rodin:review-bot-issue-79
rodin:review-bot-issue-84
rodin:review-bot-issue-78
rodin:issue-73
rodin:issue-70
rodin:issue-68
rodin:issue-66
rodin:issue-64
rodin:issue-60-remote-personas
rodin:issue-60
rodin:issue-57
rodin:allow-deps
rodin:feat/aicore-provider-v2
rodin:issue-51
rodin:ci/pr-ready-gate
rodin:fix/stale-commit-check
rodin:feat/aicore-provider
rodin:fix/response-body-truncation
rodin:fix/json-repair
rodin:fix/sonnet-reviewer
rodin:fix/consistent-path-escape
rodin:feat/inline-review-comments
rodin:feat/6-update-existing-review
rodin:fix/19-context-overflow
rodin:feat/18-anthropic-api
rodin:fix/url-escaping-and-shadow
rodin:fix/quick-wins
rodin:fix/context-and-encapsulation
rodin:docs/code-review-report
rodin:ci/release-workflow
Dismiss Review
Are you sure you want to dismiss this review?
No Label
self-reviewed
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: rodin/review-bot#75
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "github-support"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Adds GitHub Actions support alongside existing Gitea Actions.
Changes
.gitea/to.github/for GitHub Actions compatibility.github/workflowsto useGITHUB_SERVER_URL/GITHUB_REPOSITORYmain.goto accept bothGITEA_*andGITHUB_*env varsTesting
No breaking changes for existing Gitea users.
Original reviewSuperseded — see current review for up-to-date findings.
Previous findings (commit
dd003c66)Sonnet Review
Summary
This PR adds GitHub Actions support alongside existing Gitea Actions by copying the workflow files to
.github/and updatingmain.goto fall back toGITHUB_SERVER_URL/GITHUB_REPOSITORYenv vars. The Go change is minimal and correct. CI passed.Findings
.github/actions/review/action.yml.github/for GitHub Actions. The comment is misleading for GitHub Actions users who encounter this file. Consider updating the comment to reflect dual-platform support..github/workflows/pr-ready-gate.ymlhttps://gitea.weiker.merather than usinggithub.server_url. This workflow will fail silently (curl will hit the Gitea instance) when running on GitHub.com, sincesecrets.RODIN_TOKENwon't be a valid GitHub token and the API path (/api/v1/) is Gitea-specific. If this workflow is intended to be a no-op on GitHub, that should be explicitly documented or the job should be conditioned on the server URL..github/workflows/ci.yml1.26, which does not exist yet (latest stable is 1.24.x as of mid-2025). This may causeactions/setup-goto fail or resolve to an unexpected version on GitHub Actions. Recommend pinning to a known stable version like1.24..github/actions/review/action.ymlREPOdefault for the binary download is hardcoded torodin/review-bot. When running on GitHub.com (mirrored asaweiker/ai-core-review-bot), the download will still attempt to fetch from the Gitea instance atgithub.server_url(which would behttps://github.com) using the Gitea API path/api/v1/repos/rodin/review-bot/releases. This will 404. The action works for Gitea runners but will break if actually invoked as a reusable action on GitHub.com. Consider documenting thatgitea-urlmust be explicitly set when using from GitHub.Recommendation
APPROVE — The Go code change in
main.gois correct and minimal — it simply addsGITHUB_SERVER_URLandGITHUB_REPOSITORYas fallback env vars with proper nesting, which is the right approach. CI passed. The main concern is thatpr-ready-gate.ymlhardcodes the Gitea API URL and will not function correctly on GitHub.com (it will either fail or silently do nothing useful). However, based on the PR description this is being pushed as a mirror toaweiker/ai-core-review-botfor testing, and the PR-ready-gate may be intentionally Gitea-only. The Go version1.26in ci.yml is a NIT sinceactions/setup-gomay handle non-existent versions gracefully or resolve to latest. Overall this is a reasonable infrastructure addition and can be approved with the expectation that GitHub-specific workflows (especially pr-ready-gate) may need adjustment after testing.Review by sonnet
Evaluated against
dd003c66@@ -0,0 +1,200 @@# This composite action is designed for Gitea Actions runners.[MINOR] The action comment says 'This composite action is designed for Gitea Actions runners' but this file is now in
.github/for GitHub Actions. The comment is misleading for GitHub Actions users who encounter this file. Consider updating the comment to reflect dual-platform support.@@ -0,0 +84,4 @@description: 'review-bot version to install (e.g. v0.1.0, defaults to latest)'required: falsedefault: 'latest'dry-run:[NIT] The
REPOdefault for the binary download is hardcoded torodin/review-bot. When running on GitHub.com (mirrored asaweiker/ai-core-review-bot), the download will still attempt to fetch from the Gitea instance atgithub.server_url(which would behttps://github.com) using the Gitea API path/api/v1/repos/rodin/review-bot/releases. This will 404. The action works for Gitea runners but will break if actually invoked as a reusable action on GitHub.com. Consider documenting thatgitea-urlmust be explicitly set when using from GitHub.@@ -0,0 +11,4 @@runs-on: ubuntu-24.04steps:- uses: actions/checkout@v4- uses: actions/setup-go@v5[NIT] Go version is specified as
1.26, which does not exist yet (latest stable is 1.24.x as of mid-2025). This may causeactions/setup-goto fail or resolve to an unexpected version on GitHub Actions. Recommend pinning to a known stable version like1.24.@@ -0,0 +20,4 @@# Remove ready label if presentcurl -sS -X DELETE \-H "Authorization: token $GITEA_TOKEN" \[MINOR] The Gitea API URL is hardcoded as
https://gitea.weiker.merather than usinggithub.server_url. This workflow will fail silently (curl will hit the Gitea instance) when running on GitHub.com, sincesecrets.RODIN_TOKENwon't be a valid GitHub token and the API path (/api/v1/) is Gitea-specific. If this workflow is intended to be a no-op on GitHub, that should be explicitly documented or the job should be conditioned on the server URL.Original reviewSuperseded — see current review for up-to-date findings.
Previous findings (commit
dd003c66)Security Review
Summary
The changes largely add GitHub Actions support and minor env var fallbacks, but the CI workflow introduces a high-risk secret exposure pattern. The review job runs code built from the pull request while injecting multiple secrets, allowing a malicious PR to exfiltrate them.
Findings
.github/workflows/ci.ymlRecommendation
REQUEST_CHANGES — Do not pass secrets into workflows that build and run untrusted pull request code. Mitigations:
Once the workflow is hardened to prevent secret exposure, the remaining changes appear reasonable from a security perspective.
Review by security
Evaluated against
dd003c66@@ -0,0 +52,4 @@GITHUB_SERVER_URL: ${{ github.server_url }}GITHUB_REPOSITORY: ${{ github.repository }}PR_NUMBER: ${{ github.event.pull_request.number }}REVIEWER_TOKEN: ${{ secrets[matrix.token_secret] }}[MAJOR] Secrets are provided to a pull_request job that builds and executes code from the PR (e.g., REVIEWER_TOKEN and multiple AICORE_* secrets). A malicious PR could modify the code to exfiltrate these secrets. Best practice is to avoid using secrets in workflows that run untrusted PR code.
Original reviewSuperseded — see current review for up-to-date findings.
Previous findings (commit
dd003c66)Gpt Review
Summary
The Go code change to accept GITHUB_* env vars is straightforward and fine, but the new GitHub Actions workflows and composite action are wired to Gitea-specific endpoints while defaulting to GitHub server URLs. As written, key workflows (review, release, and the composite action’s version resolution) will fail or be no-ops on GitHub. These are correctness issues that block expected GitHub support.
Findings
.github/workflows/ci.yml.github/workflows/release.yml.github/actions/review/action.yml.github/workflows/pr-ready-gate.yml.github/actions/review/action.yml.github/workflows/release.ymlcmd/review-bot/main.goRecommendation
REQUEST_CHANGES — The Go change to support GITHUB_* environment fallbacks looks good. However, the GitHub Actions additions currently default to GitHub server URLs while invoking Gitea-specific APIs, which will break on GitHub. To proceed:
After these fixes, the workflows should function reliably on GitHub. The Go change itself does not need modifications.
Review by gpt
Evaluated against
dd003c66@@ -0,0 +65,4 @@required: falsedefault: ''patterns-repo:description: 'Comma-separated repos with language patterns (e.g. rodin/elixir-patterns,rodin/phoenix-conventions)'[MINOR] Input docs say repo defaults to current, but Determine version sets REPO to "${{ inputs.repo || 'rodin/review-bot' }}". This contradicts the description and may download binaries from the wrong repo by default. Align the default and docs (prefer defaulting to the current repository).
@@ -0,0 +111,4 @@- name: Determine versionid: versionshell: bashrun: |[MAJOR] Determine version step defaults GITEA_URL to github.server_url and queries "${GITEA_URL}/api/v1/repos/${REPO}/releases" (Gitea API). On GitHub (https://github.com) this fails. Make gitea-url required when targeting Gitea releases or add logic to detect GitHub vs Gitea and call the correct API.
@@ -0,0 +50,4 @@- name: Run ${{ matrix.name }} reviewenv:GITHUB_SERVER_URL: ${{ github.server_url }}GITHUB_REPOSITORY: ${{ github.repository }}[MAJOR] The review job sets GITHUB_SERVER_URL to github.server_url and runs ./review-bot, which initializes a Gitea client using this URL. GitHub’s REST API is not Gitea-compatible, so PR metadata/diff retrieval will fail on GitHub. Either set GITEA_URL to your Gitea instance (if targeting Gitea) or implement/use a GitHub client path.
@@ -0,0 +17,4 @@AUTHOR=${{ github.event.pull_request.user.login }}READY_LABEL_ID=38SELF_REVIEWED_LABEL_ID=37[MINOR] Workflow targets Gitea API using GitHub PR number and repository. PR numbers generally won’t match across GitHub and Gitea, so operations will likely be no-ops. Consider gating this workflow to only run where the PR exists (or map PR numbers), or explicitly document that it manipulates the Gitea mirror.
@@ -0,0 +51,4 @@echo "Release for ${VERSION} already exists, fetching existing..."curl -sSf -o /tmp/release_response.json \-H "Authorization: token ${GITEA_TOKEN}" \"${GITEA_URL}/api/v1/repos/${REPO}/releases/tags/${VERSION}"[MAJOR] Release step uses GITEA_URL="${{ github.server_url }}" and calls /api/v1 (Gitea API). On GitHub this endpoint is invalid; release creation and asset upload will fail. If releases are intended on GitHub, switch to GitHub’s Releases API (api.github.com/repos/:owner/:repo/releases) or use actions like actions/create-release. If releases are intended on Gitea, set GITEA_URL explicitly to the Gitea server.
@@ -0,0 +80,4 @@"${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" \| python3 -c "import json,sys,os; name=os.environ['ASSET_NAME']; assets=json.load(sys.stdin); print(next((str(a['id']) for a in assets if a['name']==name),''))" 2>/dev/null)if [ -n "$EXISTING_ID" ]; then[NIT] The upload script uses jq for URL-encoding without ensuring it’s present. ubuntu-24.04 runners typically include jq, but adding an explicit install or a pure-shell URL-encode avoids environment dependence.
@@ -54,8 +54,8 @@ func main() {logFormat := flag.String("log-format", envOrDefault("LOG_FORMAT", "text"), "Log output format: text or json")verbosity := flag.String("verbosity", envOrDefault("LOG_VERBOSITY", "info"), "Log verbosity: debug, info, warn, error")[NIT] The fallback to GITHUB_SERVER_URL/GITHUB_REPOSITORY is fine, but note that the client remains Gitea-specific. Consider clarifying in help text that GitHub support requires pointing to a Gitea-compatible API or implementing a GitHub client path.
Review Findings Addressed
Commit
29ab19caddresses all review findings:MAJOR (4 fixed)
security-review: Added fork protection to ci.yml review job with
github.event.pull_request.head.repo.full_name == github.repositorycheck. Added security comment explaining the trust model.gpt-review #1: Changed ci.yml to set
GITHUB_SERVER_URLto explicithttps://gitea.weiker.mesince reviews are posted to Gitea, not GitHub.gpt-review #2: Changed release.yml to use explicit Gitea URL instead of
github.server_url.gpt-review #3: Changed action.yml
gitea-urlinput default from empty (fallback togithub.server_url) to explicithttps://gitea.weiker.me. All internal uses now rely on this default.MINOR (4 fixed)
sonnet-review #1: Updated action.yml header comment to reflect dual-platform support (Gitea Actions + GitHub Actions).
sonnet-review #2: Added comment to pr-ready-gate.yml explaining the intentional hardcoded Gitea URL.
gpt-review #4: Added comment to pr-ready-gate.yml about PR number matching assumption between GitHub mirror and Gitea.
gpt-review #5: Updated action.yml repo input description to say it defaults to
rodin/review-botfor version lookup, matching actual code behavior.Original reviewSuperseded — see current review for up-to-date findings.
Previous findings (commit
29ab19c9)Sonnet Review
Summary
This PR adds GitHub Actions support by creating
.github/workflow files and updatingmain.goto acceptGITHUB_*env vars as fallbacks forGITEA_*vars. The changes are well-structured, CI passes, and the design is sound.Findings
.github/actions/review/action.ymlGITHUB_REPOSITORYenv var is set to `${{ inputs.repo.github/workflows/pr-ready-gate.yml# 38 = ready, 37 = self-reviewed) would improve maintainability..github/workflows/ci.yml1.26is specified. As of early 2025, Go 1.26 is not yet released (latest stable is 1.23/1.24). Ifactions/setup-goresolves this to a future version that doesn't exist yet, the job would fail. This likely works today if setup-go tolerates forward-looking versions, but it's worth confirming and possibly pinning to a released version. (The Gitea CI presumably already uses this same version and passes, so this may be a non-issue in practice.)Recommendation
APPROVE — The PR is well-implemented. The core Go change (two-line
envOrDefaultfallback chain forGITEA_URL/GITEA_REPO→GITHUB_SERVER_URL/GITHUB_REPOSITORY) is minimal and correct. The workflow files are clearly commented about the intentional Gitea-posting-from-GitHub design. The one MINOR concern worth addressing before relying heavily on the composite action is theGITHUB_REPOSITORYfallback inaction.yml— if a caller omitsrepo, the bot will silently target the wrong Gitea repo. This is low-risk for the described use case (aweiker's mirror explicitly sets the Gitea repo), but could surprise future users of the action. The other findings are documentation/robustness nits. Approve with the suggestion to address therepofallback logic.Review by sonnet
Evaluated against
29ab19c9@@ -0,0 +160,4 @@fiif [ "$EXPECTED" != "$ACTUAL" ]; thenecho "Error: checksum mismatch!" >&2echo " Expected: $EXPECTED" >&2[MINOR] The
GITHUB_REPOSITORYenv var is set to${{ inputs.repo || github.repository }}. When running from GitHub Actions on the mirror repo,github.repositorywould beaweiker/ai-core-review-bot(or similar), notrodin/review-bot. This means ifinputs.repois not explicitly provided, the review-bot would try to post to the wrong Gitea repository. The composite action'srepoinput has no default (default: ''), which means the fallback togithub.repositoryis always in play when callers don't passrepo. This could silently produce incorrect behavior rather than a clear error. Consider either makingreporequired or defaulting it torodin/review-botto match the documented intent.@@ -0,0 +9,4 @@jobs:test:runs-on: ubuntu-24.04steps:[NIT] Go version
1.26is specified. As of early 2025, Go 1.26 is not yet released (latest stable is 1.23/1.24). Ifactions/setup-goresolves this to a future version that doesn't exist yet, the job would fail. This likely works today if setup-go tolerates forward-looking versions, but it's worth confirming and possibly pinning to a released version. (The Gitea CI presumably already uses this same version and passes, so this may be a non-issue in practice.)@@ -0,0 +20,4 @@AUTHOR=${{ github.event.pull_request.user.login }}READY_LABEL_ID=38SELF_REVIEWED_LABEL_ID=37[MINOR] Label IDs 38 and 37 are hardcoded without explanation. If the Gitea instance label IDs ever change (e.g., after a data migration or re-creation), this silently does nothing. The comment explains WHY we use Gitea but not WHY these specific numeric IDs are correct. A brief comment naming which labels these IDs correspond to (e.g.,
# 38 = ready, 37 = self-reviewed) would improve maintainability.Self-review: PASS
No issues found — ready for human review.
Coherence:
Fit:
gitea.weiker.mein several places (README.md, .gitea/workflows/).gitea/directory is intentionally different from.github/- one runs on Gitea (wheregithub.server_urlis already Gitea), one runs on GitHub (where it's GitHub's URL)Solution:
github.event.pull_request.head.repo.full_name == github.repositoryis the standard GitHub Actions patternhttps://gitea.weiker.meis appropriate since this is a repo-specific tool, not a general-purpose actionCompleteness:
Original reviewSuperseded — see current review for up-to-date findings.
Previous findings (commit
29ab19c9)Gpt Review
Summary
The changes cleanly add GitHub Actions support while preserving existing Gitea behavior. The Go change correctly falls back to GITHUB_* env vars, and the new workflows/composite action appear sound. I found a few minor issues around cache key robustness and a potentially unused input, but nothing blocking.
Findings
.github/actions/review/action.yml.github/actions/review/action.yml.github/workflows/release.ymljqto URL-encode asset names but doesn't ensurejqis installed. While Ubuntu runners often include jq, it's safer to either install it explicitly or replace this with a Python-based encoding to avoid environment drift.Recommendation
APPROVE — Overall, this PR achieves its goal of adding GitHub Actions support alongside Gitea with minimal and clear changes. The Go code update to fall back to GITHUB_SERVER_URL and GITHUB_REPOSITORY is straightforward and safe. Please consider hardening the composite action cache key by including the gitea-url and repo so the correct binary is always used, or verify checksums even on cache hits. Also, either plumb the update-existing behavior through to the application or remove the input from the action to keep behavior consistent with configuration. Optionally, ensure jq is present in the release workflow or switch to a Python-based URL encoding for resilience. With these small adjustments, the setup will be more robust; as-is, it's acceptable to merge.
Review by gpt
Evaluated against
29ab19c9@@ -0,0 +101,4 @@required: falsedefault: ''persona-file:description: 'Path to custom persona JSON file'[MINOR] The cache key for the downloaded binary only uses the version (review-bot-linux-amd64-${{ steps.version.outputs.version }}). If inputs.gitea-url or inputs.repo differ between runs but the tag is the same, a stale or wrong binary could be reused without checksum revalidation. Consider including gitea-url and repo in the cache key or validating checksum on cache hits.
@@ -0,0 +166,4 @@fichmod +x "${{ runner.temp }}/review-bot"echo "Installed review-bot ${VERSION} (checksum verified)"[MINOR] The environment variable UPDATE_EXISTING is set from the action input, but the main program (cmd/review-bot/main.go) does not currently read or honor this flag. Either wire this through as a flag/env in the application or remove the input to avoid confusion.
@@ -0,0 +83,4 @@if [ -n "$EXISTING_ID" ]; thenecho " Asset ${filename} already exists (id=${EXISTING_ID}), deleting..."curl -sSf -X DELETE \[MINOR] The release job uses
jqto URL-encode asset names but doesn't ensurejqis installed. While Ubuntu runners often include jq, it's safer to either install it explicitly or replace this with a Python-based encoding to avoid environment drift.Original reviewSuperseded — see current review for up-to-date findings.
Previous findings (commit
29ab19c9)Security Review
Summary
The changes add GitHub Actions support and adapt environment variable handling to work across Gitea and GitHub. CI passed and the modifications do not introduce direct exploitable vulnerabilities, though there are a few defense-in-depth improvements recommended around binary download hardening and network timeouts.
Findings
.github/actions/review/action.yml.github/actions/review/action.yml.github/actions/review/action.yml.github/workflows/release.yml.github/workflows/pr-ready-gate.ymlRecommendation
APPROVE — Overall the PR is sound and CI has passed. To harden security, consider: (1) pinning the binary download source to a trusted repo/host and/or verifying signatures with a trusted key rather than checksums fetched from the same source, and avoid allowing untrusted overrides to gitea-url and repo for the composite action; (2) adding explicit network timeouts (e.g., --connect-timeout and --max-time) to all curl calls in the composite action and release workflow to prevent runner hangs (DoS); and (3) in the PR ready gate workflow, JSON-encoding dynamic values for defense in depth. These are defense-in-depth improvements and do not block merging.
Review by security
Evaluated against
29ab19c9@@ -0,0 +116,4 @@GITEA_URL="${{ inputs.gitea-url }}"REPO="${{ inputs.repo || 'rodin/review-bot' }}"if [ "${{ inputs.version }}" = "latest" ]; thenVERSION=$(curl -sSf "${GITEA_URL}/api/v1/repos/${REPO}/releases?limit=1" \[MINOR] curl invocations lack explicit timeouts, which could lead to hung jobs and potential denial-of-service on runners if the endpoint stalls. Add --connect-timeout and --max-time to bound network operations.
@@ -0,0 +144,4 @@VERSION="${{ steps.version.outputs.version }}"BINARY="review-bot-linux-amd64"curl -sSfL "${GITEA_URL}/${REPO}/releases/download/${VERSION}/${BINARY}" \[MINOR] The action downloads and executes a binary based on user-provided inputs (gitea-url and repo), and verifies integrity using checksums fetched from the same source. If an untrusted workflow configuration can change these inputs, this allows executing arbitrary code with workflow secrets. Pin the source repository/host, or verify signatures with a trusted key, and avoid allowing untrusted overrides for repo/host.
@@ -0,0 +146,4 @@curl -sSfL "${GITEA_URL}/${REPO}/releases/download/${VERSION}/${BINARY}" \-o "${{ runner.temp }}/review-bot"curl -sSfL "${GITEA_URL}/${REPO}/releases/download/${VERSION}/checksums.txt" \[MINOR] Additional curl downloads of the binary and checksums also lack explicit timeouts. Apply connection and overall timeouts to these requests to prevent job hangs.
@@ -0,0 +37,4 @@curl -sS -X PATCH \-H "Authorization: token $GITEA_TOKEN" \-H "Content-Type: application/json" \-d "{\"assignees\": [\"${AUTHOR}\"]}" \[NIT] The JSON payload in the curl PATCH command inlines the AUTHOR variable directly. While GitHub usernames are restricted to safe characters, using a robust JSON encoder or printf %q-style escaping would further reduce injection risk if assumptions change.
@@ -0,0 +42,4 @@REPO="rodin/review-bot"# Create release (or find existing one for this tag)HTTP_CODE=$(curl -s -o /tmp/release_response.json -w "%{http_code}" -X POST \[MINOR] Multiple curl API calls (creating/fetching releases and listing/uploading/deleting assets) do not set explicit timeouts, increasing risk of runner hangs. Add --connect-timeout and --max-time to these requests (and subsequent ones at lines ~53, ~79, ~86, ~91) to mitigate DoS via stalled endpoints.
29ab19c94dtodd003c66d5Sonnet Review
Summary
This PR adds GitHub Actions support by copying the
.gitea/workflow structure to.github/and updatingmain.goto fall back toGITHUB_SERVER_URL/GITHUB_REPOSITORYenvironment variables when Gitea-specific ones are absent. The changes are minimal, correct, and non-breaking for existing Gitea users. CI passed.Findings
.github/actions/review/action.yml.github/and intended to run on GitHub Actions as well. The comment is misleading for GitHub Actions users who discover this action..github/workflows/pr-ready-gate.ymlhttps://gitea.weiker.me) are Gitea-specific and will silently no-op (via `.github/workflows/ci.yml1.26which does not yet exist (current latest stable is 1.24.x). This may causeactions/setup-goto fail on github.com if it cannot resolve the version, whereas Gitea's runner may be more lenient. Consider pinning to an actual released version or usingstable..github/actions/review/action.ymlDetermine versionstep hardcodesREPOas'rodin/review-bot'for the download source. On GitHub, this repo may not exist or be accessible, meaning theInstall review-botstep would fail for GitHub Actions users trying to use this composite action from the public mirror. This is likely intentional (the composite action is primarily for Gitea) but deserves a comment.Recommendation
APPROVE — The core change in
main.gois correct and idiomatic — using nestedenvOrDefaultcalls to fall back from Gitea-specific to GitHub-specific environment variables is clean and backward-compatible. The workflow files are valid YAML and structurally correct for their intended environments. The MINOR findings are documentation/clarity issues rather than functional bugs; the NIT about Go version 1.26 is worth fixing if this repo is actually being mirrored to github.com and CI needs to pass there. Overall this is a safe, well-scoped change that achieves its goal.Review by sonnet
Evaluated against
dd003c66@@ -0,0 +1,200 @@# This composite action is designed for Gitea Actions runners.[MINOR] The comment at the top says 'This composite action is designed for Gitea Actions runners' but the file is now in
.github/and intended to run on GitHub Actions as well. The comment is misleading for GitHub Actions users who discover this action.@@ -0,0 +97,4 @@required: falsedefault: ''persona:description: 'Built-in persona name (security, architect, docs)'[NIT] The
Determine versionstep hardcodesREPOas'rodin/review-bot'for the download source. On GitHub, this repo may not exist or be accessible, meaning theInstall review-botstep would fail for GitHub Actions users trying to use this composite action from the public mirror. This is likely intentional (the composite action is primarily for Gitea) but deserves a comment.@@ -0,0 +11,4 @@runs-on: ubuntu-24.04steps:- uses: actions/checkout@v4- uses: actions/setup-go@v5[NIT] Go version is set to
1.26which does not yet exist (current latest stable is 1.24.x). This may causeactions/setup-goto fail on github.com if it cannot resolve the version, whereas Gitea's runner may be more lenient. Consider pinning to an actual released version or usingstable.@@ -0,0 +21,4 @@# Remove ready label if presentcurl -sS -X DELETE \-H "Authorization: token $GITEA_TOKEN" \"https://gitea.weiker.me/api/v1/repos/${{ github.repository }}/issues/${PR_NUMBER}/labels/${READY_LABEL_ID}" || true[MINOR] The label IDs (READY_LABEL_ID=38, SELF_REVIEWED_LABEL_ID=37) and the hardcoded Gitea URL (
https://gitea.weiker.me) are Gitea-specific and will silently no-op (via|| true) on GitHub Actions. This is acceptable for now since the workflow is a Gitea-only feature, but it means the workflow is essentially a dead stub on GitHub. A comment explaining this would reduce confusion.Security Review
Summary
Changes add GitHub Actions support and environment fallbacks without introducing clear security vulnerabilities. Secrets are handled via environment variables, downloads are over HTTPS with checksum verification, and input parsing/validation logic in Go remains safe.
Recommendation
APPROVE — CI passed and the changes appear security-conscious: no hardcoded secrets, no dangerous deserialization, and sensible validation for workspace paths and reviewer names. The composite action verifies checksums and avoids logging sensitive values. As a defense-in-depth improvement for future work, consider pinning versions explicitly in workflows and limiting the source host for binary downloads where feasible, or using signed artifacts. Otherwise, this PR is good to merge.
Review by security
Evaluated against
dd003c66Gpt Review
Summary
The Go code change to accept GITHUB_* fallbacks is small and idiomatic, but the overall GitHub Actions integration mixes GitHub context with Gitea-specific APIs and clients. As written, the review and release workflows will attempt to talk to GitHub using Gitea endpoints, which will fail outside your Gitea instance. Please separate provider handling or adjust URLs and clients accordingly.
Findings
cmd/review-bot/main.go.github/workflows/ci.yml.github/workflows/release.yml.github/actions/review/action.yml.github/workflows/pr-ready-gate.ymlRecommendation
REQUEST_CHANGES — The Go code change itself is fine, but the current approach conflates GitHub context with Gitea-specific APIs and clients, which will break when running on GitHub. To resolve:
These changes will make the GitHub Actions integration reliable and align the bot's API usage with the actual hosting provider.
Review by gpt
Evaluated against
dd003c66@@ -0,0 +88,4 @@description: 'Print review to stdout instead of posting'required: falsedefault: 'false'update-existing:[MINOR] The composite action constructs download and release URLs assuming a Gitea server (e.g., /api/v1 and /releases/download paths). If this action is intended to run on GitHub, it should detect the provider and use GitHub's API for version discovery and asset downloads; otherwise document it as Gitea-only to avoid confusion.
@@ -0,0 +46,4 @@- uses: actions/setup-go@v5with:go-version: '1.26'- run: go build -o review-bot ./cmd/review-bot[MAJOR] The review job sets GITHUB_SERVER_URL and GITHUB_REPOSITORY and runs ./review-bot, which will use those to target a Gitea client. On GitHub PRs this points to github.com and will not match Gitea APIs, leading to failures when fetching PRs/diffs and posting reviews. Pass a real Gitea URL if the bot should review on Gitea, or implement a GitHub path.
@@ -0,0 +20,4 @@# Remove ready label if presentcurl -sS -X DELETE \-H "Authorization: token $GITEA_TOKEN" \[MINOR] This job calls a hardcoded Gitea instance (https://gitea.weiker.me) using GitHub event data. On GitHub PRs, the PR number and repo may not exist on that instance, which could fail the job. Consider scoping this job to your Gitea environment or guarding it with conditions so it doesn't run (or fail) on GitHub.
@@ -0,0 +45,4 @@-H "Authorization: token ${GITEA_TOKEN}" \-H "Content-Type: application/json" \"${GITEA_URL}/api/v1/repos/${REPO}/releases" \-d "{\"tag_name\": \"${VERSION}\", \"name\": \"${VERSION}\", \"body\": \"Release ${VERSION}\", \"draft\": false, \"prerelease\": false}")[MAJOR] Release step uses GITEA_URL="${{ github.server_url }}" and then calls "${GITEA_URL}/api/v1/repos/.../releases". On GitHub, server_url is https://github.com (GitHub releases live at api.github.com and use different endpoints). This will not work on GitHub. Use GitHub's REST API (or an action like softprops/action-gh-release) when running on GitHub, and keep the Gitea API for Gitea.
@@ -54,8 +54,8 @@ func main() {logFormat := flag.String("log-format", envOrDefault("LOG_FORMAT", "text"), "Log output format: text or json")verbosity := flag.String("verbosity", envOrDefault("LOG_VERBOSITY", "info"), "Log verbosity: debug, info, warn, error")// CLI flags[MAJOR] Defaults now fall back to GITHUB_SERVER_URL/GITHUB_REPOSITORY for --gitea-url/--repo, but the bot constructs a Gitea client and calls Gitea v1 APIs. On GitHub, GITHUB_SERVER_URL is https://github.com and lacks /api/v1; this will cause API calls to fail. Either keep requiring explicit GITEA_URL/GITEA_REPO when targeting Gitea, or add a GitHub client and switch on provider.
Converting to long-lived feature branch. The workflows alone won't work without the VCS abstraction (#76).
Will merge as one unit when complete:
.github/workflowsgithub/client package (ported from strat fork)vcs/abstraction layercmd/review-botwiringBranch:
github-supportPull request closed