Repository navigation
Add Robin PR review workflow - #8
VineeTagarwaL-code wants to merge 2 commits into
Conversation
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow keeps integration concise, explicitly declares token permissions, and forwards only named secrets rather than inheriting all secrets. However, the external reusable workflow is referenced through a mutable branch while receiving credentials and pull-request write access.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
Referencing the third-party workflow at @main allows upstream changes to execute without a change or review in this repository. On runs where secrets are available, that code receives LLM_API_KEY and a token with pull-request write permission, making an upstream compromise or unsafe update consequential.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency-update pull requests.
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow explicitly limits token permissions and passes named secrets rather than inheriting all repository secrets. However, it delegates execution to a mutable third-party workflow while granting access to an API key and pull-request write permissions.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
The reusable workflow is referenced by @main, so upstream changes can execute without any change or review in this repository. That workflow receives LLM_API_KEY and can use the granted pull-request write permission, making an upstream compromise or unsafe update consequential.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed pull requests.
|
Closing: Robin is for internal repos only. |
Adds the Robin review workflow, the same file used in interfaze, interfaze-landing and defaultmodel-landing. It needs the LLM_API_KEY, LLM_BASE_URL and LLM_MODEL repo secrets to run.