Repository navigation
Add Robin PR review workflow - #1
VineeTagarwaL-code wants to merge 2 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow declares explicit permissions and passes only named secrets rather than inheriting all repository secrets. However, the external reusable workflow is referenced through a mutable branch, allowing upstream changes to alter code that receives the API key and a write-capable token.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
Referencing the external reusable workflow with @main allows upstream updates to execute without review in this repository. That workflow receives LLM_API_KEY and pull-requests: write permission, so an upstream compromise could expose the key or modify pull requests.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency-update pull requests.
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow explicitly scopes token permissions and passes only named secrets to the reusable workflow. However, it delegates execution to a mutable third-party branch while providing an API key and pull-request write access, creating an avoidable supply-chain risk.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
The reusable workflow is referenced through @main, so upstream changes immediately affect future runs without a reviewed change in this repository. That upstream workflow receives LLM_API_KEY and can use the granted pull-request write permission; a compromised or unsafe upstream update could expose the credential or modify pull requests.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency changes.
|
Closing: Robin is for internal repos only. |
Adds the Robin review workflow, the same file used in interfaze, interfaze-landing and defaultmodel-landing. It needs the LLM_API_KEY, LLM_BASE_URL and LLM_MODEL repo secrets to run.