Repository navigation
Give issues and pull requests a first reader - #368
Conversation
Three agent lanes, none gating. A new issue gets its premise checked against the tree behind an account-age gate; a new pull request gets one evidence-based review comment; /oc in a collaborator's comment summons the agent for anything else, including fixing an issue behind a pull request. The shared body is one composite: checkout, warm cache, nextest, and opencode on deepseek-v4-flash with sharing off. The key travels as a composite input and reaches exactly one step's env, under the name the provider contract requires. The mention lane borrows the release token so an agent-opened PR still triggers ci; the other two hold only their lane's write scope. Prompts treat issue text as a claim under test, not as instructions.
|
Warning Review limit reached
Next review available in: 46 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds three non-gating DeepSeek agent workflows for issue triage, pull-request review, and collaborator-triggered ChangesAgent automation
Release pull-request drafts
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubEvent
participant AgentWorkflow
participant DeepSeek
participant GitHubOutput
GitHubEvent->>AgentWorkflow: Trigger issue, pull-request, or comment workflow
AgentWorkflow->>DeepSeek: Run with read-only repository access and bounded outputs
DeepSeek->>GitHubOutput: Post verdict, review, comment, or pull request
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Model not found: deepseek/deepseek-v4-flash. Did you mean: deepseek-v4-flash? |
|
Skeptical pass over the three lanes and the composite. Two claims in the PR body do not survive contact with the pinned action. Discrepancies
Not mentioned in the text
What held up
|
|
Posted one review comment on PR #368. Two of the PR body's claims fail against the tree:
Held up: composite split + pinned actions, restore-only rust-cache, key scoped to one step under |
The agent's own first review caught it: the pinned opencode release has no token input, so the mention lane's release token was silently dropped and the lane would have fallen to an app exchange we never installed. The mechanism this release actually offers is the GITHUB_TOKEN env behind use_github_token, so the composite takes one required github_token and the mention lane hands it the release token. The model-id half of that review refuted itself: the run that posted it resolved deepseek/deepseek-v4-flash.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 5 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
|
Verified both findings before acting, and the verdict splits. The token finding is confirmed and fixed in f352195: the pinned release's action.yml has no token input (checked at the sha: model, agent, share, prompt, use_github_token, mentions, variant, oidc_base_url), so the composite now takes one required github_token routed through the GITHUB_TOKEN env behind use_github_token, and the mention lane hands it the release token. The model finding refutes itself: the very run that posted the review logs 'model: deepseek/deepseek-v4-flash' and completed, so the id resolves; the earlier failure was the not-yet-set key, not the id. |
The wrapper action resolved and installed whatever release was latest while credentials sat in its environment; the composite now installs the CLI itself, version and digest pinned, cached, with credentials entering only at the run step. A comment on a pull request works on that PR's head instead of main. Sessions share their transcript, which is the only real window into what the agent did, since the CLI prints an unquietable event stream. Prompts rebuilt on the collected review-agent practices: reason, then finding, then confidence, with low confidence dropped; inline review comments anchored through the reviews API instead of quoted citations; questions and counterexamples over assertions; links mandatory. The shared voice lives in .github/agent-voice.md, loaded through opencode.json instructions so the mention lane gets it too, because a PROMPT there would replace the comment text itself. Triage comments end by inviting /oc follow-ups.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/agent/action.yml:
- Around line 20-22: Change the default value of the share input in the action
configuration from "true" to "false", so omitted share inputs do not enable
session sharing and callers must explicitly opt in.
In @.github/workflows/agent-mention.yml:
- Around line 25-27: Remove the unused id-token: write permission from the
permissions blocks in .github/workflows/agent-mention.yml (lines 25-27),
.github/workflows/agent-review.yml (lines 23-27), and
.github/workflows/agent-triage.yml (lines 18-21); retain contents: read and the
existing GITHUB_TOKEN/RELEASE_TOKEN behavior.
- Around line 29-39: Update the workflow around the local agent action checkout
to query pull request metadata before any checkout and reject requests whose
head.repo.full_name differs from github.repository. Ensure
./.github/actions/agent is loaded only from a trusted default-branch revision,
and do not pass fork pull-request refs to the privileged workflow.
In `@docs/src/development.md`:
- Line 94: Update the pull-request review statement in the development
documentation to describe the eligibility gates enforced by the agent-review
workflow: only same-repository, non-draft pull requests are reviewed, excluding
head branches matching release-plz-*. Keep the existing review behavior
description for eligible pull requests.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6d347eca-3705-46c0-9be0-c20a80854e21
📒 Files selected for processing (7)
.github/actions/agent/action.yml.github/agent-voice.md.github/workflows/agent-mention.yml.github/workflows/agent-review.yml.github/workflows/agent-triage.ymldocs/src/development.mdopencode.json
There was a problem hiding this comment.
All reported issues were addressed across 7 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
The smoke stalled ten minutes silent: the agent wrote its review payload to /tmp, the external_directory rule's default is ask, and nothing in CI answers. The run step now carries OPENCODE_PERMISSION allowing /tmp and denying the other askable surfaces outright, since a deny returns an error the agent can route around while an ask waits forever. The review prompt also keeps scratch files inside the checkout.
There was a problem hiding this comment.
All reported issues were addressed across 7 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
The three-key permission fix left every unlisted permission kind on its upstream default, so any other ask rule would stall a future run the same way. The blanket allow closes the class; question and doom_loop stay denied, external writes stay fenced to /tmp, and the real boundaries were never this layer anyway: token scopes, the capped key, fork exclusion, and a discarded runner.
workflow_dispatch takes a PR number, checks out that PR's head, and tells the agent to fetch the body, diff, and threads itself, since a dispatched run carries no event context. Also retires the draft-toggle as the smoke mechanism.
Three reviewers converged on the same hole: a collaborator's /oc on a fork PR would have checked out the fork's tree into a job holding the release token and the model key. A gate now resolves the PR through the API, refuses fork heads outright, and pins same-repo heads to the sha it saw, which also closes the TOCTOU window. id-token: write leaves all three lanes since the GITHUB_TOKEN path never exchanges OIDC, transcript sharing follows opencode's own public-only default instead of a hardcoded true, the review prompt derives repository and PR number from the event, and the book states the review lane's eligibility gates and which lane takes instructions.
The reviewer ran on opened and ready_for_review alone, a cost choice now overruled: synchronize joins the triggers, and the concurrency group already cancels superseded runs so rapid pushes collapse to the newest head.
The scanner's stubbornness found the one path the mention-lane fix missed: a hand-dispatched review of a fork PR would have checked out the fork's tree. The dispatch path now resolves the PR the same way, same-repository heads only, pinned to the observed sha.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
One high-confidence finding: the mention lane's fork exclusion fails on the pull_request_review_comment trigger, where a fork's merge ref is checked out before the gate and the local composite then runs from that tree. Composite split, sha-pinned actions, one-step key scoping, and the review/triage eligibility gates all check out; no Rust code is touched.
|
Review posted: #368 (review) One high-confidence finding. For Everything else held: composite split + sha-pinned actions, restore-only rust-cache, key scoped to one step, zizmor-era permission trimming, and the review/triage eligibility gates. No Rust code touched, so the workspace suite was not run. |
There was a problem hiding this comment.
All reported issues were addressed across 5 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
The agent's own review caught what three reviewers and the scanner missed in spirit: pull_request_review_comment events check out the PR merge ref before any step runs, so a fork's tree, composite included, would execute in the credentialed job. That trigger now refuses foreign heads at the job boundary. Every lane mints its identity from one GitHub App, downscoped per lane, falling back to its old token while the app secrets are absent; app-authored PRs also trigger ci, which retires the release token once the app exists. The reviewer posts its findings as an empty-body review of anchored comments and puts the summary in its one comment, whose tail, review link, session link, run link, folds into a closed details block via the voice file's ending rule.
There was a problem hiding this comment.
Every prior finding resolves in the head, and nothing new survives contact with the tree.
What I verified, not asserted: the deepseek/deepseek-v4-flash default resolves at runtime — run 31434641081 logs providerID: "deepseek", modelID: "deepseek-v4-flash" and completes, so the 21:37 "Did you mean: deepseek-v4-flash?" is stale. The pinned sha256 in .github/actions/agent/action.yml:52 matches the v1.18.16 artifact I downloaded and checked. OPENCODE_PERMISSION is read and JSON-merged by the pinned version, and every env name the composite sets matches the pinned action's contract. The merge-ref door is closed at the job boundary: the events reference gives pull_request_review_comment a refs/pull/N/merge checkout, and the gate at .github/workflows/agent-mention.yml:25-26 refuses fork heads before any checkout; issue_comment runs on the default branch, so no fork tree reaches a credentialed workspace on either trigger. Token routing uses only the pinned action's real inputs — no stray token — behind USE_GITHUB_TOKEN with the app-token/RELEASE_TOKEN fallback, and no id-token remains in any workflow. All three workflows and the composite parse; every action is sha-pinned.
One prior item stays open: cubic's dispatch-for-fork agent-review P1 runs on the trusted default-branch tree with the fork's text read as claims — the same trust model as the triage lane, behind a write-access dispatcher — so it does not clear the bar for a finding.
No Rust code is touched, so the workspace suite was not run.
The rewrite regressed the blob URL into a placeholder template, which the scanner reads as a same-repo reference and fails to resolve, the exact law the file exists to teach. The example is a real path again, with the swap-main-for-sha instruction in prose.
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/agent-voice.md:
- Line 9: Update the citation URL template in the documentation around the
link-format guidance to escape or inline-code the <sha>, <path>, and <n>
placeholders, preventing them from being interpreted as markup while preserving
the documented URL format.
In @.github/workflows/agent-mention.yml:
- Around line 37-50: Update the workflow’s place step to emit an allowed output:
set allowed=true for ordinary issues, and for pull requests set it false when
the head repository differs from REPOSITORY while retaining the existing ref
lookup for same-repository PRs. Add allowed=true/false to the step outputs and
gate both the identity step and agent execution step on
steps.place.outputs.allowed == 'true', preventing fork pull requests from
reaching credential or agent steps.
In `@docs/src/development.md`:
- Line 96: Update the collaborator mention-command paragraph to document both
supported aliases, /oc and /opencode, while preserving the existing workflow
description.
- Around line 94-95: Update the review-trigger documentation near the
description of new pull requests to enumerate all supported triggers: pull
request creation, transition to ready for review, every subsequent push, and
manual dispatch. Preserve the existing eligibility conditions for the automated
review lane.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5d8adeaf-9fbb-4518-a570-eee5a597a4f7
📒 Files selected for processing (6)
.github/actions/agent/action.yml.github/agent-voice.md.github/workflows/agent-mention.yml.github/workflows/agent-review.yml.github/workflows/agent-triage.ymldocs/src/development.md
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/actions/agent/action.yml
|
Everything held. I verified each claim against the tree and found no new high-confidence defect, so per the rule I post no review. What I checked, not asserted: every pinned action sha dereferences to its stated tag, and the pinned The security posture survives the events reference. No Rust code is touched, so the workspace suite was not run. |
The mention lane's empty-ref fallback silently ran against main with credentials when a collaborator summoned it on a fork PR; it exits 1 now, matching the dispatch gate. The book's lane paragraph gains the per-push and dispatch triggers and the /opencode alias.
There was a problem hiding this comment.
All reported issues were addressed across 2 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
The comment structure the lanes promise is now assembled by an opencode plugin at the one published hook that reaches posted text, experimental.text.complete: a STATUS marker becomes the visible callout, WHAT WAS DONE folds into a closed details block, a trailing review link and the harness's appended session and run links land inside an open-ended Session details block, shapes verified against GitHub's own renderer. The plugin no-ops outside Actions, passes marker-less text through untouched, and covers all three lanes from one file, since every lane's session loads it. The model's formatting duty shrinks to two marker lines, stated in the voice file all lanes read.
|
Review posted: #368 (review) The head commit's templating machinery is dead on arrival. The triage lane cannot serve the population its gate admits. The pinned harness treats Everything else held up: the composite split and sha-pinned actions, restore-only rust-cache, one-step key scoping, the merge-ref door and fork refusals, and the eligibility gates. No Rust code is touched, so the workspace suite was not run. review: #368 (review) |
The reviewer caught the plugin dead on arrival: the pinned loader treats every module export as a plugin and throws on the test-only object export, so no hook ever registered. The test rides the public export now.
|
Warning The fix holds, verified against the pinned loader and not the commit message. The head's module exports only One claim in the reply does not survive contact with the tree: there is no offline test. The only committed file under What was doneConfirmed abafd97 deletes Session details |
|
One finding, verified against the pinned binary and the API, posted as a review. The triage lane cannot serve the issue authors its own gate admits. The pinned opencode v1.18.16 artifact (sha256 matches the digest in What held up, verified not asserted: the plugin fix in review: #368 (review) |
opencode's github harness posts a conversational comment it fully owns, permission-gates issue authors to write access, which no triage audience survives, and follows formatting only as far as the model cooperates. The lanes are gh-aw workflows now: agents run read-only on DeepSeek through Copilot BYOK, whose provider key lives in the sandbox proxy where the agent cannot read it, and a separate harness job executes their schema-validated outputs, one consolidated review with anchored comments for pushes, one comment for issue triage, and comment, pull request, or branch push for /oc, nothing else expressible. The composite, the plugin, the voice file, and the app token plumbing all retire; the compiled locks are generated, zizmor-clean, and exempt from the file-start rule like Cargo.lock. The book's lane paragraph moves with the architecture.
There was a problem hiding this comment.
Warning
"One finding: the triage lane's /oc follow-up instruction is a dead-end for the external issue openers it serves."
The triage lane (agent-triage.md#L59) tells whomever opened an issue to "reply with /oc," but /oc is gated to admin/maintainer/write team members, so the external openers this lane explicitly targets (public repo, roles: all) hit a command that never activates for them. Either make the /oc suggestion collaborator-scoped or point reject/unclear issue authors at a working path.
Session details
github.com/HardMax71/amiss/actions/runs/31487981359
Reviewed the workflow-source .md files and verified their compiled .lock.yml outputs (agent-mention.lock.yml membership gate vs agent-triage.md roles: all); no Rust sources changed.
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agent-mention.md:
- Around line 3-4: Update the slash_command name configuration to register both
oc and opencode aliases, then run gh aw compile to regenerate the corresponding
.github/workflows/agent-mention.lock.yml output and GH_AW_COMMANDS value.
In @.github/workflows/agent-review.md:
- Around line 2-4: Update the pull_request trigger configuration to include
draft: false and add an explicit github.event.pull_request.head.ref guard
excluding the repository’s release-plz branch pattern, while preserving the
existing opened, synchronize, and ready_for_review event types.
- Around line 2-4: Extend the workflow triggers with a workflow_dispatch input
identifying the pull request, then update the prompt construction to use that
input for manual runs and pass the same value as pull_request_number to
submit-pull-request-review. Preserve the existing pull_request trigger behavior.
In @.github/workflows/agent-triage.md:
- Around line 2-5: Update the source workflow’s trigger configuration to enforce
the required account-age condition instead of allowing all roles via roles: all.
Then regenerate the derived .github/workflows/agent-triage.lock.yml so it
reflects the updated workflow configuration.
- Around line 14-16: Replace the retired COPILOT_MODEL value with
deepseek-v4-flash in .github/workflows/agent-triage.md (lines 14-16),
.github/workflows/agent-review.md (lines 13-15), and
.github/workflows/agent-mention.md (lines 14-16), preserving the existing
provider URL and API key settings; then run gh aw compile to regenerate each
corresponding .lock.yml workflow file.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 75de43d7-c29c-412d-a91f-10d16b3ed5cc
📒 Files selected for processing (10)
.gitattributes.github/aw/actions-lock.json.github/workflows/agent-mention.lock.yml.github/workflows/agent-mention.md.github/workflows/agent-review.lock.yml.github/workflows/agent-review.md.github/workflows/agent-triage.lock.yml.github/workflows/agent-triage.md.pre-commit-config.yamldocs/src/development.md
🚧 Files skipped from review as they are similar to previous changes (1)
- docs/src/development.md
There was a problem hiding this comment.
All reported issues were addressed across 17 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
The callout drops its quotation marks and carries the verdict as its own quoted line; the run link becomes a real markdown link the agent assembles from its environment; the generated-by footers turn off where this gh-aw version allows; and the mention lane routes through the centralized dispatcher, so skipped runs stop littering every comment and /opencode works beside /oc, on comment events only, which also makes the book's collaborator sentence true. Reviews skip drafts, and release-plz pull requests become drafts at the source, restoring both old exclusions in one filter. The model id moves to deepseek-v4-flash for robustness, though the retirement claim is contradicted by the run that reviewed the migration on the alias. The generated dispatcher joins the generated-file exemptions and its two audit findings are excepted by name; both belong upstream.
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agent-review.md:
- Line 75: Remove the trailing space inside the inline code span on the
referenced instruction line, changing the representation of the blockquote
marker to `>` or a fenced example while preserving the required `> ` output
format.
In @.github/workflows/agent-triage.md:
- Line 54: Update the instruction text in the relevant Markdown guidance so the
blockquote marker code span contains only `>` and places the following space
outside the span, eliminating the MD038 warning while preserving the intended
wording.
- Around line 57-59: Update the evidence-link guidance in the triage
instructions so every cited file and line uses the inspected commit SHA in the
blob URL instead of the mutable blob/main reference, matching the commit-pinning
requirement in agent-review.md.
In @.github/workflows/agentic_commands.yml:
- Around line 55-58: Regenerate the router so the Setup Scripts step uses the
pinned github/gh-aw-actions/setup commit
2709137ea6c5b0e19aa621454dc643ea8dc526b1 with the v0.85.4 annotation; in
.github/workflows/agentic_commands.yml lines 55-58 update that action and set
checkout persist-credentials to false. In .github/zizmor.yml lines 4-9 remove
the unpinned-uses ignore and remove the artipacked ignore unless the regenerated
router still requires Git credentials.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3ba0f706-1785-4e90-9d0a-8de992ab633e
📒 Files selected for processing (10)
.github/workflows/agent-mention.lock.yml.github/workflows/agent-mention.md.github/workflows/agent-review.lock.yml.github/workflows/agent-review.md.github/workflows/agent-triage.lock.yml.github/workflows/agent-triage.md.github/workflows/agentic_commands.yml.github/zizmor.yml.pre-commit-config.yamlrelease-plz.toml
🚧 Files skipped from review as they are similar to previous changes (1)
- .pre-commit-config.yaml
| Then submit one review with the submit_pull_request_review tool, event | ||
| COMMENT. Its body opens with `> [!TIP]` when everything holds or `> [!WARNING]` | ||
| when findings exist, with the verdict sentence as the callout body on its | ||
| own `> ` line, no quotation marks around it, followed by at most a paragraph per finding, one line each. Link |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove the trailing space from the code span.
Line 75 contains `> `, which triggers markdownlint MD038. Use `>` line or a fenced example while preserving the required blockquote output format.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 75-75: Spaces inside code span elements
(MD038, no-space-in-code)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agent-review.md at line 75, Remove the trailing space
inside the inline code span on the referenced instruction line, changing the
representation of the blockquote marker to `>` or a fenced example while
preserving the required `> ` output format.
Source: Linters/SAST tools
| Post one comment with the add_comment tool. It opens with `> [!TIP]` when the claim | ||
| does not reproduce or the issue is fine as filed, or `> [!WARNING]` when | ||
| the claim is confirmed, with the verdict sentence as the callout body on | ||
| its own `> ` line, no quotation marks around it. Then: confirmed means what breaks, where, and the command with |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Resolve the MD038 warning in the instruction text.
Line 54 places a space inside the > code span. markdownlint reports MD038. Keep only > inside the code span.
Suggested wording
-its own `> ` line, no quotation marks around it.
+its own line prefixed by `>`, with no quotation marks.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| its own `> ` line, no quotation marks around it. Then: confirmed means what breaks, where, and the command with | |
| its own line prefixed by `>`, with no quotation marks. Then: confirmed means what breaks, where, and the command with |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 54-54: Spaces inside code span elements
(MD038, no-space-in-code)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agent-triage.md at line 54, Update the instruction text in
the relevant Markdown guidance so the blockquote marker code span contains only
`>` and places the following space outside the span, eliminating the MD038
warning while preserving the intended wording.
Source: Linters/SAST tools
| would decide it, prefixed Question:. Link every file and line you mention | ||
| as a blob URL like | ||
| https://github.com/HardMax71/amiss/blob/main/README.md#L1. Close the |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- triage lines 45-75 ---'
cat -n .github/workflows/agent-triage.md | sed -n '45,75p'
printf '%s\n' '--- review contract lines 45-100 ---'
cat -n .github/workflows/agent-review.md | sed -n '45,100p'
printf '%s\n' '--- related wording ---'
rg -n -C 3 'blob/(main|<commit|SHA)|head commit|commit SHA|evidence|inspected' .github/workflows/agent-triage.md .github/workflows/agent-review.md
printf '%s\n' '--- repository state ---'
git status --short
git rev-parse HEADRepository: HardMax71/amiss
Length of output: 6503
Pin evidence links to the inspected commit.
blob/main can change after the agent posts its verdict. Require the triage lane to use the inspected commit SHA, as required by .github/workflows/agent-review.md.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agent-triage.md around lines 57 - 59, Update the
evidence-link guidance in the triage instructions so every cited file and line
uses the inspected commit SHA in the blob URL instead of the mutable blob/main
reference, matching the commit-pinning requirement in agent-review.md.
| - name: Setup Scripts | ||
| uses: github/gh-aw-actions/setup@v0.85.4 | ||
| with: | ||
| destination: ${{ runner.temp }}/gh-aw/actions |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(agentic_commands\.yml|zizmor\.yml|.*lock.*|.*gh-aw.*)$' || true
printf '%s\n' '--- setup action references ---'
rg -n -C 4 'github/gh-aw-actions/setup|unpinned-uses|artipacked|immutable|lock|sha256|v0\.85\.4' \
.github 2>/dev/null || true
printf '%s\n' '--- workflow and zizmor sections ---'
if test -f .github/workflows/agentic_commands.yml; then
cat -n .github/workflows/agentic_commands.yml | sed -n '45,68p'
fi
if test -f .github/zizmor.yml; then
cat -n .github/zizmor.yml | sed -n '1,30p'
fi
printf '%s\n' '--- repository metadata references ---'
rg -n -S 'gh-aw-actions/setup|setup@v0\.85\.4|agentic_commands\.yml|gh-aw compile|action.*lock|lock.*action' \
. --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' 2>/dev/null || trueRepository: HardMax71/amiss
Length of output: 50372
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- exact tracked workflow/config files ---'
git ls-files '.github/workflows/*agentic*' '.github/zizmor.yml' | sort
printf '%s\n' '--- agentic workflow references ---'
for f in .github/workflows/agentic_commands.yml .github/workflows/agentic_commands.lock.yml .github/zizmor.yml; do
if test -f "$f"; then
printf '\n### %s\n' "$f"
rg -n -C 3 'gh-aw-actions/setup|gh-aw-metadata|gh-aw-manifest|unpinned-uses|artipacked|agentic_commands' "$f" || true
fi
done
printf '%s\n' '--- all exact setup references in agentic files ---'
rg -n '^[[:space:]]*uses:[[:space:]]*github/gh-aw-actions/setup@' \
.github/workflows --glob 'agentic_commands*' --glob '*.lock.yml' \
| rg 'agentic_commands|gh-aw-actions/setup' | head -n 100 || trueRepository: HardMax71/amiss
Length of output: 3363
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- all agentic-related tracked paths ---'
git ls-files | rg -i 'agentic|gh[-_ ]?aw|zizmor' | sort
printf '%s\n' '--- workflow header and action references ---'
cat -n .github/workflows/agentic_commands.yml | sed -n '1,90p'
printf '%s\n' '--- all uses references in agentic_commands.yml ---'
rg -n '^[[:space:]]*(uses|-[[:space:]]+uses):' .github/workflows/agentic_commands.yml || true
printf '%s\n' '--- generator and compile references ---'
rg -n -S -C 3 'gh aw compile|gh-aw compile|agentic_commands\.yml|agentic_commands|unpinned-uses|artipacked' \
--glob '!*.lock.yml' --glob '!target/**' --glob '!node_modules/**' .github AGENTS.md README.md 2>/dev/null || true
printf '%s\n' '--- deterministic action-reference comparison ---'
python3 - <<'PY'
from pathlib import Path
import re
pat = re.compile(r'uses:\s*([^@\s]+)@([^\s#]+)')
files = [
Path('.github/workflows/agentic_commands.yml'),
*sorted(Path('.github/workflows').glob('*.lock.yml')),
]
for path in files:
if not path.exists():
continue
refs = [(repo, ref) for repo, ref in pat.findall(path.read_text())]
setup = [(repo, ref) for repo, ref in refs if repo == 'github/gh-aw-actions/setup']
if setup:
print(f'{path}: setup={setup}')
PYRepository: HardMax71/amiss
Length of output: 6705
🌐 Web query:
github gh-aw compile generated agentic commands router setup action SHA pinning v0.85.4
💡 Result:
In GitHub Agentic Workflows (gh-aw), the "agentic_commands" router is a compiler-generated workflow (typically named agentic_commands.yml) that centralizes the handling of slash commands and label-based triggers [1][2][3]. When workflows are configured with on.slash_command.strategy: centralized or on.label_command.strategy: decentralized, the gh-aw compiler replaces individual triggers with a dispatch-centric model [2][3]. This router works by: 1. Listening to merged events (e.g., issue_comment, labeled) [1][3]. 2. Executing a JavaScript-based router (route_slash_command.cjs) which uses the GH_AW_SLASH_ROUTING or GH_AW_LABEL_ROUTING metadata to match events to specific workflows [4][3]. 3. Dispatching the target workflows using workflow_dispatch, while propagating essential context via aw_context [1][5][3]. Regarding SHA pinning and version v0.85.4: - The gh-aw project enforces supply chain security through mandatory SHA pinning for dependencies and action references [6]. - The compiler tool (gh-aw compile) is responsible for maintaining these pins [7]. Users are instructed never to edit these references by hand, but rather to use gh-aw compile or gh-aw update-actions to regenerate them [7]. - Version v0.85.4, released on August 6, 2026, includes various security improvements, including audit enhancements and dependency remediations, continuing the project's focus on secure, pinned supply-chain management [8][9][10]. To ensure correct setup, verify your workflow configuration includes the appropriate strategy in the frontmatter, then run the compiler to generate the router and update the SHA pins: gh aw compile This ensures that the generated agentic_commands.yml router and all action references are correctly pinned and aligned with your current project version [7].
Citations:
- 1: Add centralized slash-command trigger strategy with compiler-generated agentic_commands router workflow github/gh-aw#31605
- 2: https://github.github.com/gh-aw/reference/command-triggers/
- 3: Add decentralized
label_commandrouting viaagentic_commands.ymlgithub/gh-aw#31917 - 4: Add immediate centralized command reactions and propagate desired reaction context github/gh-aw#31847
- 5: Route centralized command dispatches to the triggering PR branch and harden PR checkout runtime github/gh-aw#37187
- 6: https://github.com/github/gh-aw
- 7: https://github.github.com/gh-aw/reference/compilation-process/
- 8: https://github.com/github/gh-aw/releases/tag/v0.85.4
- 9: https://github.com/github/gh-aw/releases
- 10: https://github.com/github/gh-aw/releases/tag/v0.86.0
🌐 Web query:
github github/gh-aw-actions setup v0.85.4 commit 2709137ea6c5b0e19aa621454dc643ea8dc526b1
💡 Result:
The repository github/gh-aw-actions is a shared library of custom GitHub Actions used by the GitHub Agentic Workflows (gh-aw) project [1][2]. These actions are designed to support compiled workflows, providing capabilities such as file management for Model Context Protocol (MCP) servers [1][3]. The commit hash 2709137ea6c5b0e19aa621454dc643ea8dc526b1 identifies a specific version state within the GitHub ecosystem for these workflows. The version tag v0.85.4, released on August 6, 2026, is part of the gh-aw release cycle, where versioning for the actions repository is aligned with the main gh-aw project [1][4]. Important usage notes include: - You should not manually edit action references in your workflows [5]. Instead, use the gh-aw CLI tools (e.g., gh aw compile or gh aw update-actions) to ensure that your workflows are correctly synchronized with the required action versions and commit SHAs [5]. - Dependabot pull requests attempting to bump these action versions should generally not be merged, as pins must be coordinated through the gh-aw compiler to maintain consistency [5].
Citations:
- 1: https://github.com/github/gh-aw-actions
- 2: https://github.com/github/gh-aw/tree/refs/heads/main
- 3: https://github.com/github/gh-aw/tree/main/actions
- 4: https://github.com/github/gh-aw/releases/tag/v0.85.4
- 5: https://github.github.com/gh-aw/reference/compilation-process/
🏁 Script executed:
#!/bin/bash
set -eu
repo='github/gh-aw-actions'
tag='v0.85.4'
pin='2709137ea6c5b0e19aa621454dc643ea8dc526b1'
printf '%s\n' '--- tag ref ---'
if command -v gh >/dev/null 2>&1; then
gh api "repos/$repo/git/refs/tags/$tag" --jq '.object | [.type, .sha] | `@tsv`'
obj="$(gh api "repos/$repo/git/refs/tags/$tag" --jq '.object | [.type, .sha] | `@tsv`')"
type="${obj%%$'\t'*}"
sha="${obj#*$'\t'}"
if [ "$type" = tag ]; then
printf '%s\n' '--- annotated tag target ---'
gh api "repos/$repo/git/tags/$sha" --jq '.object | [.type, .sha] | `@tsv`'
sha="$(gh api "repos/$repo/git/tags/$sha" --jq '.object.sha')"
fi
printf '%s\n' '--- resolved commit ---'
gh api "repos/$repo/commits/$sha" --jq '.sha'
printf '%s\n' '--- contributor pin resolution ---'
gh api "repos/$repo/commits/$pin" --jq '.sha'
printf '%s\n' '--- comparison ---'
if [ "$sha" = "$pin" ]; then echo MATCH; else echo MISMATCH; fi
else
printf '%s\n' 'gh CLI is unavailable'
exit 2
fi
printf '%s\n' '--- upstream compilation references ---'
curl -fsSL https://raw.githubusercontent.com/github/gh-aw/main/docs/reference/compilation-process.md \
| rg -n -C 4 'pin|SHA|update-actions|agentic_commands|compile' | head -n 160 || true
printf '%s\n' '--- upstream router setup references ---'
for ref in main v0.85.4; do
url="https://raw.githubusercontent.com/github/gh-aw/$ref/.github/workflows/agentic_commands.yml"
printf '\n### %s\n' "$url"
curl -fsSL "$url" 2>/dev/null | rg -n -C 2 'gh-aw-actions/setup|uses:' | head -n 80 || true
doneRepository: HardMax71/amiss
Length of output: 20397
🌐 Web query:
zizmor artipacked rule actions checkout GitHub Actions documentation
💡 Result:
In the context of the zizmor security tool, the artipacked audit rule is designed to detect potentially insecure credential persistence in GitHub Actions workflows, specifically concerning the use of actions/checkout [1][2]. By default, the actions/checkout action persists Git credentials on the runner's disk to allow subsequent Git operations [1][3]. The artipacked rule flags these instances because this behavior can inadvertently lead to the leakage of credentials—such as the GITHUB_TOKEN—if the workspace is later uploaded as an artifact (e.g., using actions/upload-artifact) [1][3]. Key aspects of the artipacked rule and its interaction with actions/checkout include: - Credential Persistence: In versions of actions/checkout prior to v6.0.0, credentials are stored directly in the repository's.git/config file [1][3]. In v6.0.0 and later, they are stored under $RUNNER_TEMP, which is a more secure, misuse-resistant location [1][4]. - Rule Behavior: zizmor's artipacked audit identifies when persist-credentials is not explicitly set to false [1][5]. Starting in zizmor v1.17.0, the severity of the finding is downgraded if the workflow is using actions/checkout v6.0.0 or higher, reflecting the reduced risk of credential leakage [1][4]. - Remediation: The recommended remediation is to explicitly disable credential persistence when it is not required for Git operations by setting persist-credentials to false in the actions/checkout step [1][2]. Example of a remediated workflow step: - uses: actions/checkout@v4 with: persist-credentials: false [1][6] If a workflow requires these credentials for specific Git operations (e.g., pushing commits or tagging), you should explicitly set persist-credentials: true to maintain clarity and security, ensuring credentials are only available where necessary [1][2].
Citations:
- 1: https://docs.zizmor.sh/audits/
- 2: https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/
- 3: https://sisaku-security.github.io/lint/docs/rules/artipacked/
- 4: https://github.com/woodruffw/zizmor/blob/main/crates/zizmor/src/audit/artipacked.rs
- 5: https://yashpankhania.com/posts/using-zizmor-github-actions/
- 6: https://github.com/zizmorcore/zizmor/blob/563b7b25/docs/audits.md
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- checkout and routing context ---'
cat -n .github/workflows/agentic_commands.yml | sed -n '39,80p'
printf '%s\n' '--- local documentation mentioning Zizmor or artipacked ---'
rg -n -S -C 3 'zizmor|artipacked|unpinned-uses|persist-credentials|agentic_commands' \
. --glob '!*.lock.yml' --glob '!target/**' --glob '!node_modules/**' 2>/dev/null || trueRepository: HardMax71/amiss
Length of output: 3276
Pin the generated setup action.
Regenerate the router with github/gh-aw-actions/setup@2709137ea6c5b0e19aa621454dc643ea8dc526b1 # v0.85.4, then remove the unpinned-uses ignore. Set persist-credentials: false for checkout and remove the artipacked ignore unless the router requires Git credentials.
📍 Affects 2 files
.github/workflows/agentic_commands.yml#L55-L58(this comment).github/zizmor.yml#L4-L9
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agentic_commands.yml around lines 55 - 58, Regenerate the
router so the Setup Scripts step uses the pinned github/gh-aw-actions/setup
commit 2709137ea6c5b0e19aa621454dc643ea8dc526b1 with the v0.85.4 annotation; in
.github/workflows/agentic_commands.yml lines 55-58 update that action and set
checkout persist-credentials to false. In .github/zizmor.yml lines 4-9 remove
the unpinned-uses ignore and remove the artipacked ignore unless the regenerated
router still requires Git credentials.
There was a problem hiding this comment.
Warning
The automatic PR-review lane fires only for same-repo PRs from collaborators; the docs' "every push gets one consolidated review" promise is broader than what activates.
Question: Is collaborator-only automatic review the intended scope, and should the docs sentence (and the manual workflow_dispatch fallback) be qualified to match the triggers? The source trigger in agent-review.md#L3 compiles to a same-repo head guard plus an admin/maintainer/write role gate (agent-review.lock.yml#L88, #L1581), so fork, dependabot, and release-plz PRs (draft, github-actions[bot] author) are never auto-reviewed, while development.md#L96 says every push gets one consolidated review. Confidence: high.
Session details
- run
- Reviewed all three lane sources and their compiled
.lock.ymlfiles against the tree: trigger/role/fork gates, safe-outputs configs and job permissions, secret routing (COPILOT_PROVIDER_API_KEY excluded from the agent container), and log-artifact upload. CI-only PR — no cargo tests run.
The lane's own first fixed-format review caught the sentence its migration rewrite had widened: fork heads and drafts never activate, so the promise carries the qualifiers again, plus the dispatch path.
There was a problem hiding this comment.
1 issue found across 10 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/agent-review.md">
<violation number="1" location=".github/workflows/agent-review.md:9">
P2: A manual dispatch via the new `pr` input is not wired into the harness: the compiled workflow only checks out the target PR branch when `aw_context.item_type == 'pull_request'` is set, and `github.event.pull_request.head.sha` (used for GH_AW_HEAD_SHA / blob links) is empty on a dispatch. So a dispatched review runs `cargo nextest` and verifies against the default-branch tree rather than the PR's code, and the agent has no PR head sha in its environment to pin blob URLs to the head commit as the instructions demand. Consider either having the dispatch resolve the PR from `inputs.pr` (checkout the branch and export its head sha) or directing the agent to fetch and check out the PR head itself before verifying/linking.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
| workflow_dispatch: | ||
| inputs: | ||
| pr: | ||
| description: Pull request number to review |
There was a problem hiding this comment.
P2: A manual dispatch via the new pr input is not wired into the harness: the compiled workflow only checks out the target PR branch when aw_context.item_type == 'pull_request' is set, and github.event.pull_request.head.sha (used for GH_AW_HEAD_SHA / blob links) is empty on a dispatch. So a dispatched review runs cargo nextest and verifies against the default-branch tree rather than the PR's code, and the agent has no PR head sha in its environment to pin blob URLs to the head commit as the instructions demand. Consider either having the dispatch resolve the PR from inputs.pr (checkout the branch and export its head sha) or directing the agent to fetch and check out the PR head itself before verifying/linking.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/agent-review.md, line 9:
<comment>A manual dispatch via the new `pr` input is not wired into the harness: the compiled workflow only checks out the target PR branch when `aw_context.item_type == 'pull_request'` is set, and `github.event.pull_request.head.sha` (used for GH_AW_HEAD_SHA / blob links) is empty on a dispatch. So a dispatched review runs `cargo nextest` and verifies against the default-branch tree rather than the PR's code, and the agent has no PR head sha in its environment to pin blob URLs to the head commit as the instructions demand. Consider either having the dispatch resolve the PR from `inputs.pr` (checkout the branch and export its head sha) or directing the agent to fetch and check out the PR head itself before verifying/linking.</comment>
<file context>
@@ -2,6 +2,13 @@
+ workflow_dispatch:
+ inputs:
+ pr:
+ description: Pull request number to review
+ required: true
+ type: string
</file context>
There was a problem hiding this comment.
Warning
The review lane's hand-dispatch path is wired to nothing: pr is declared, promised in the prompt, and documented, but the compiled workflow never reads it.
One finding. The review lane declares workflow_dispatch.inputs.pr (agent-review.md), its prompt tells a dispatched agent to use "the number in the pr input" (lines 52-53), and docs/src/development.md (added by this PR) promises "a review can be dispatched by hand for any PR number" — but the compiled agent-review.lock.yml resolves the PR only from github.event.pull_request.number or aw_context.item_type/item_number, and its PR-checkout gate (line 498) keys off aw_context.item_type == 'pull_request', so a manual dispatch that fills the required pr input yields no PR number, no pull-request-number context, and a default-branch checkout. The mention lane's dispatch path works (the dispatcher passes only aw_context); the documented manual path is a no-op.
Session details
run — extracted the three compiled lane workflows and the pinned gh-aw-actions v0.85.4 scripts (route_slash_command.cjs, check_membership.cjs, checkout_pr_branch.cjs, safe-output handler manager), grepped the compiled locks for every inputs.* and secret reference, and verified the PR body claims against the tree.
| draft: false | ||
| workflow_dispatch: | ||
| inputs: | ||
| pr: |
There was a problem hiding this comment.
Reason: the compiled agent-review.lock.yml reads dispatch context only from github.event.inputs.aw_context and github.event.pull_request.number (context expressions at lines 190, 268-271, 344-347), and its PR-checkout gate (line 498) keys on aw_context.item_type == 'pull_request'; github.event.inputs.pr appears nowhere in the compiled file, and the dispatcher (route_slash_command.cjs) passes only aw_context, never pr.
Problem: the required 'pr' dispatch input declared here is never read, so a manual workflow_dispatch that fills it hands the agent no PR number, no pull-request-number context block, and a default-branch checkout — the prompt's 'on a dispatched run the number in the pr input' (lines 52-53) and the docs promise of dispatching a review 'by hand for any PR number' (docs/src/development.md line 97, added by this PR) do not hold as wired.
Confidence: high.
Three agent lanes for issues and pull requests, final architecture: gh-aw workflows whose agents run read-only on DeepSeek and express every action through schema-validated safe outputs that a separate harness job executes. Reviews land as one consolidated card, summary plus line-anchored comments in a single API call; issue triage answers whoever opened the issue, with evidence; /oc summons the agent for collaborators and can produce a comment, a pull request, or a push to the PR branch, and nothing else is expressible. The DeepSeek key rides Copilot BYOK, isolated in the sandbox proxy where the agent process cannot read it.
The road here is the review history: an opencode-based stack (composite action, digest-pinned install, permission config, a comment-template plugin) fell one lane at a time to findings its own reviewer raised, the decisive one being the pinned harness's write-access gate on issue authors, which no triage audience survives. The compiled .lock.yml files are generated by gh aw compile, sha-pinned and zizmor-clean, and exempted from the file-start-comment hook like Cargo.lock.
Arming: DEEPSEEK_API_KEY is the only secret the lanes need.
Summary by CodeRabbit
/ocworkflows for investigations and implementation pull requests.