Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions .github/workflows/ai-review.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: AI Review

on:
pull_request:
types: [opened, reopened, synchronize, edited, ready_for_review]
push:
branches: [master]
workflow_dispatch:
inputs:
pr_number:
description: PR number to review (leave blank to review a commit)
required: false
commit_sha:
description: Commit SHA to review (leave blank when using PR number)
required: false

jobs:
ai-review:
uses: jitsucom/github-workflows/.github/workflows/ai-review.yml@1.4.20260416
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uses: is pinned to the mutable tag 1.4.20260416. Because this job also uses secrets: inherit, a tag move in the source repo could execute unexpected code with your inherited secrets/tokens. Pin this to a full commit SHA instead (and optionally document the intended release tag in a comment).

secrets: inherit
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

secrets: inherit forwards all available secrets to an external reusable workflow. Prefer explicitly passing only the minimum required secrets to reduce blast radius if the called workflow is compromised or changed unexpectedly.

with:
review_instructions: >-
Focus on Go correctness, concurrency bugs, and MongoDB protocol handling.
Skip style nitpicks.
pr_number: ${{ inputs.pr_number }}
commit_sha: ${{ inputs.commit_sha }}
Loading