Skip to content

ci: add AI code review #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vklimontovich wants to merge 4 commits into
base: master
Choose a base branch
from
Open

ci: add AI code review #1

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
629ef4c
ci: add AI code review workflow
vklimontovich Apr 16, 2026
2e850a5
fix: pass pr_number and commit_sha through to reusable workflow
vklimontovich Apr 16, 2026
44aed99
fix: update uses ref to jitsucom/github-workflows
vklimontovich Apr 16, 2026
a92c44e
ci: pin to jitsucom/github-workflows@1.4.20260416
vklimontovich Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/ai-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: AI Review

on:
pull_request:
types: [opened, reopened, synchronize, edited, ready_for_review]
push:
branches: [master]
workflow_dispatch:
inputs:
pr_number:
description: PR number to review (leave blank to review a commit)
required: false
commit_sha:
description: Commit SHA to review (leave blank when using PR number)
required: false

jobs:
ai-review:
uses: jitsucom/ai-review/.github/workflows/ai-review.yml@main

@jitsu-code-review jitsu-code-review Bot Apr 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uses: ...@main points to a mutable branch in an external repository. Because this job also passes secrets, upstream changes can silently change what runs in this repo. Pin this to an immutable commit SHA instead of @main.

@jitsu-code-review jitsu-code-review Bot Apr 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uses: ...@main is a mutable reference. Combined with secrets: inherit, any future change in jitsucom/ai-review can execute with this repo's secrets (notably on push to master). Pin this to an immutable commit SHA to prevent upstream drift/supply-chain takeover from gaining secret access.

@jitsu-code-review jitsu-code-review Bot Apr 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use an immutable ref here (full commit SHA) instead of @main. With secrets: inherit, a mutable upstream branch creates a supply-chain path for secret exfiltration if that external workflow changes.

secrets: inherit

@jitsu-code-review jitsu-code-review Bot Apr 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

secrets: inherit forwards all available secrets to an external reusable workflow. Prefer explicitly passing only the minimum required secrets to reduce blast radius if the called workflow is compromised or changed unexpectedly.

with:
review_instructions: >-
Focus on Go correctness, concurrency bugs, and MongoDB protocol handling.
Skip style nitpicks.
Loading