feat: ACNA-4515 add pr-reviewer workflow#129
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🤖 PR Reviewer
The workflow is well-structured with clear gate logic and security-conscious permission checks. A few minor robustness and security concerns exist around comment body matching, the use of @main for an external reusable workflow, and potential injection risk from environment variables passed into shell conditionals.
📝 4 suggestion(s) - Please review inline comments below.
💡 How to re-trigger
Comment /review or /pr-reviewer on this PR
| if: | | ||
| (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) || | ||
| (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && | ||
| (github.event.comment.body == '/review' || github.event.comment.body == '/pr-reviewer')) |
There was a problem hiding this comment.
Exact string matching on comment body is fragile — comments with trailing newlines, spaces, or carriage returns (common from some clients) will silently not match. Consider using a contains() or trimming approach. Also, this check runs before the collaborator gate, so any user can trigger the check job just by commenting (even if they're denied in the gate). This is low-risk but worth noting.
| (github.event.comment.body == '/review' || github.event.comment.body == '/pr-reviewer')) | |
| (github.event.comment.body == '/review' || github.event.comment.body == '/pr-reviewer' || | |
| startsWith(github.event.comment.body, '/review | |
| ') || startsWith(github.event.comment.body, '/pr-reviewer | |
| ')) |
| # Intentionally require admin or maintain; write collaborators are excluded to | ||
| # limit who can trigger potentially expensive/sensitive review automation. | ||
| if [ "$PERM" = "admin" ] || [ "$PERM" = "maintain" ]; then | ||
| DATA=$(gh api repos/$GITHUB_REPOSITORY/pulls/$ISSUE_NUMBER) |
There was a problem hiding this comment.
The gh api call uses $GITHUB_REPOSITORY directly in a shell string. While this value is set by GitHub Actions and is generally safe, using it unquoted inside a path segment in a shell command is a best-practice risk. Prefer quoting or using the --repo flag.
| DATA=$(gh api repos/$GITHUB_REPOSITORY/pulls/$ISSUE_NUMBER) | |
| PERM=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$COMMENT_USER_LOGIN/permission" --jq '.permission' 2>/dev/null || echo "none") |
| if [ "$PERM" = "admin" ] || [ "$PERM" = "maintain" ]; then | ||
| DATA=$(gh api repos/$GITHUB_REPOSITORY/pulls/$ISSUE_NUMBER) | ||
| echo "allowed=true" >> $GITHUB_OUTPUT | ||
| echo "pr_number=$ISSUE_NUMBER" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
Same quoting concern for the pulls API call — quote the URL to prevent word splitting.
| echo "pr_number=$ISSUE_NUMBER" >> $GITHUB_OUTPUT | |
| DATA=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$ISSUE_NUMBER") |
| review: | ||
| needs: check | ||
| if: needs.check.outputs.allowed == 'true' | ||
| uses: adobe/aio-reusable-workflows/.github/workflows/pr-review.yml@main |
There was a problem hiding this comment.
Pinning an external reusable workflow to @main is a supply-chain security risk. A compromised or unintended change to the main branch of adobe/aio-reusable-workflows could affect this workflow. Pin to a specific SHA or at minimum a release tag.
| uses: adobe/aio-reusable-workflows/.github/workflows/pr-review.yml@main | |
| uses: adobe/aio-reusable-workflows/.github/workflows/pr-review.yml@<commit-sha-or-tag> |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
chsrimanaswi
dismissed
github-actions[bot]’s stale review
Proposed changes not required
2 participants
Description
Adds an AI-powered PR reviewer workflow that automatically reviews pull requests using Claude via AWS Bedrock. Triggers on PR open/reopen/synchronize and on
/reviewor/pr-reviewercomments by admins or maintainers.Related Issue
ACNA-4515
Motivation and Context
Reduces code review toil by providing automated first-pass reviews with inline suggestions. Part of a broader rollout across App Builder repos.
How Has This Been Tested?
Tested end-to-end in
adobe/generator-aio-app— workflow triggers correctly on PR events and/reviewcomments, posts inline suggestions and summary reviews viagithub-actions[bot].Screenshots (if appropriate):
N/A
Types of changes
Checklist: