Repository navigation
Add Robin PR review workflow - #81
VineeTagarwaL-code wants to merge 2 commits into
Conversation
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow explicitly scopes token permissions and passes only named secrets rather than inheriting all repository secrets. However, it delegates execution to a mutable third-party workflow reference while granting access to an API key and pull-request write permissions.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
Referencing the external reusable workflow at @main allows upstream changes to execute without a reviewed change in this repository. That workflow receives LLM_API_KEY and a token with pull-request write permissions, so a compromised or malicious upstream update could expose the secret or modify pull requests.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency updates.
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow keeps the integration concise and explicitly limits token permissions and forwarded secrets. However, it executes a third-party reusable workflow from a mutable branch while granting access to an API key and pull-request write permissions.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
Referencing the external workflow at @main allows upstream changes to execute without any change or review in this repository. That workflow receives LLM_API_KEY and a token with pull-request write permission, so an upstream compromise could expose the key or modify pull requests.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed pull requests.
|
Closing: Robin is for internal repos only. |
Adds the Robin review workflow, the same file used in interfaze, interfaze-landing and defaultmodel-landing. It needs the LLM_API_KEY, LLM_BASE_URL and LLM_MODEL repo secrets to run.