Repository navigation
Add Robin PR review workflow - #88
VineeTagarwaL-code wants to merge 2 commits into
Conversation
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow explicitly scopes token permissions and forwards only named secrets rather than inheriting all secrets. However, the external reusable workflow is referenced by a mutable branch, allowing upstream changes to alter code that receives the LLM credentials and pull-request write access without a change to this repository.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
The third-party reusable workflow is loaded from @main while receiving LLM secrets and pull-request write permission. An upstream compromise or unreviewed branch update could change the executed workflow and expose credentials or misuse that permission.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency updates.
🏹 Robin✅ Review done. I flagged 1 thing worth a look. Push fixes whenever you like, then comment Robin v2.8.0 · yoeven/robin@main (e75fa54) · diff-only review (model has no tool support) |
There was a problem hiding this comment.
🏹 Robin
Heads up: this is a point-in-time review. Push fixes freely, then comment
/robinwhenever you want another pass.
Summary
The workflow is concise, declares permissions explicitly, and forwards only named secrets rather than inheriting all repository secrets. However, it delegates execution to a mutable third-party branch while granting access to an API key and pull-request write permissions.
Robin — the Robin Hood of code review. Free for every PR.
|
|
||
| jobs: | ||
| review: | ||
| uses: yoeven/robin/.github/workflows/review.yml@main |
There was a problem hiding this comment.
Robin —
The reusable workflow is referenced through @main, so upstream changes can execute without any change or review in this repository. That workflow receives LLM_API_KEY and a token with pull-request write permissions, making an upstream compromise capable of exposing the key or modifying pull requests.
Recommendation: Pin the reusable workflow to a reviewed full commit SHA and update that pin through reviewed dependency-update pull requests.
|
Closing: Robin is for internal repos only. |
Adds the Robin review workflow, the same file used in interfaze, interfaze-landing and defaultmodel-landing. It needs the LLM_API_KEY, LLM_BASE_URL and LLM_MODEL repo secrets to run.