Repository navigation
Add Robin PR review workflow - #121
VineeTagarwaL-code wants to merge 2 commits into
Conversation
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow keeps review orchestration centralized and explicitly declares permissions and forwarded secrets. However, the reusable workflow is referenced through a mutable branch while receiving an API key and pull-request write access.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
Using the external reusable workflow at @main allows upstream changes to execute without a corresponding reviewed change in this repository. On runs where credentials are available, compromised or unintended upstream code could access LLM_API_KEY and use the granted pull-request write permission.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency changes.
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow keeps integration concise by delegating review logic to a reusable workflow and explicitly declaring permissions and secrets. However, referencing the external workflow's mutable main branch allows upstream changes to execute with the supplied API key and pull-request write permission without a change in this repository.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
The external reusable workflow is referenced at @main while receiving LLM_API_KEY and a token with pull-request write permission. Any upstream branch change, including a compromised update, can change the code running with those credentials without local review.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency-update pull requests.
|
Closing: Robin is for internal repos only. |
Adds the Robin review workflow, the same file used in interfaze, interfaze-landing and defaultmodel-landing. It needs the LLM_API_KEY, LLM_BASE_URL and LLM_MODEL repo secrets to run.