Skip to content

ci: adopt klein-cli AI review workflow #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fpt merged 1 commit into from
Jul 18, 2026
Merged

ci: adopt klein-cli AI review workflow #33

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/ai-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# AI code review, delegated to klein-cli's reusable workflow.
#
# Trust model: this uses `on: pull_request` (NOT pull_request_target) and the
# job is gated to same-repository branches below, so the API-key secret is only
# ever exposed to code from contributors who already have push access. Fork PRs
# get no secrets and are skipped.
name: AI Review

on:
pull_request:
types: [opened, synchronize, reopened]

permissions:
contents: read
pull-requests: write

jobs:
review:
if: github.event.pull_request.head.repo.full_name == github.repository
uses: fpt/klein-cli/.github/workflows/ai-review-reusable.yml@main

@github-actions github-actions Bot Jul 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[major] Pin the reusable workflow to an immutable commit SHA (and update that SHA deliberately, ideally with an automated dependency-update process) instead of @main.

Rationale

Verified this is the only implementation of the new review job, and it receives OPENAI_API_KEY plus pull-requests: write. Because @main is mutable, a change or compromise in the external repository can alter the workflow that runs with this repository's secret and write token, allowing secret exfiltration or unauthorized PR mutations without any change here.

with:
language: en
secrets:
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
Loading