Rodin
29ab19c94d
PR Ready Gate / clear-labels (pull_request) Successful in 2s
CI / test (pull_request) Successful in 18s
CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 39s
CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m32s
CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 3m18s
MAJOR fixes: - ci.yml: Add fork protection (github.event.pull_request.head.repo.full_name check) to prevent secret exfiltration from malicious fork PRs. Added security comment explaining the trust model for this private repo. - ci.yml: Set GITHUB_SERVER_URL to explicit Gitea URL instead of github.server_url since reviews are posted to Gitea, not GitHub. - release.yml: Set GITEA_URL explicitly to https://gitea.weiker.me since releases are created on Gitea. - action.yml: Change gitea-url default from empty (fallback to github.server_url) to explicit https://gitea.weiker.me. Update all internal uses to rely on this default rather than falling back to server_url. MINOR fixes: - action.yml: Update header comment to reflect dual-platform (Gitea Actions + GitHub Actions) support. - action.yml: Fix repo input description to say it defaults to rodin/review-bot for version lookup, matching the actual code behavior. - pr-ready-gate.yml: Add comments explaining why Gitea URL is hardcoded (intentional: we update Gitea PR from GitHub mirror) and noting the PR number matching assumption. All findings from sonnet-review, gpt-review, and security-review addressed.
75 lines
2.7 KiB
YAML
75 lines
2.7 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
types: [opened, synchronize]
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
- run: go test ./...
|
|
- run: go vet ./...
|
|
- run: go build -o review-bot ./cmd/review-bot
|
|
|
|
# Self-review using native SAP AI Core provider
|
|
# Models must match SAP AI Core deployments
|
|
# Available models: gpt-5, anthropic--claude-4.6-sonnet, anthropic--claude-4.6-opus
|
|
# Removed gpt-4.1, gpt-5-mini, gpt-4.1-mini - not deployed on AI Core
|
|
#
|
|
# SECURITY: This job runs on pull_request and has access to secrets.
|
|
# We restrict to same-repo PRs only (no forks) since this is a private repo
|
|
# where PRs only come from trusted actors (rodin/aweiker).
|
|
review:
|
|
runs-on: ubuntu-24.04
|
|
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
|
|
needs: test
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- name: sonnet
|
|
token_secret: SONNET_REVIEW_TOKEN
|
|
model: anthropic--claude-4.6-sonnet
|
|
- name: gpt
|
|
token_secret: GPT_REVIEW_TOKEN
|
|
model: gpt-5
|
|
- name: security
|
|
token_secret: SECURITY_REVIEW_TOKEN
|
|
model: gpt-5
|
|
patterns_repo: rodin/security-patterns
|
|
patterns_files: "."
|
|
system_prompt_file: SECURITY_REVIEW.md
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
- run: go build -o review-bot ./cmd/review-bot
|
|
- name: Run ${{ matrix.name }} review
|
|
env:
|
|
# Use Gitea API - reviews are posted to Gitea, not GitHub
|
|
GITHUB_SERVER_URL: https://gitea.weiker.me
|
|
GITHUB_REPOSITORY: rodin/review-bot
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
REVIEWER_TOKEN: ${{ secrets[matrix.token_secret] }}
|
|
REVIEWER_NAME: ${{ matrix.name }}
|
|
LLM_PROVIDER: aicore
|
|
LLM_MODEL: ${{ matrix.model }}
|
|
AICORE_CLIENT_ID: ${{ secrets.AICORE_CLIENT_ID }}
|
|
AICORE_CLIENT_SECRET: ${{ secrets.AICORE_CLIENT_SECRET }}
|
|
AICORE_AUTH_URL: ${{ secrets.AICORE_AUTH_URL }}
|
|
AICORE_API_URL: ${{ secrets.AICORE_API_URL }}
|
|
AICORE_RESOURCE_GROUP: ${{ secrets.AICORE_RESOURCE_GROUP }}
|
|
CONVENTIONS_FILE: "CONVENTIONS.md"
|
|
PATTERNS_REPO: ${{ matrix.patterns_repo || 'rodin/go-patterns' }}
|
|
PATTERNS_FILES: ${{ matrix.patterns_files || 'README.md,patterns/' }}
|
|
LLM_TIMEOUT: "600"
|
|
SYSTEM_PROMPT_FILE: ${{ matrix.system_prompt_file }}
|
|
run: ./review-bot
|