v1.3.2 — Marketplace-ready action description

Fixed

• action.yml description is under the GitHub Marketplace limit of 125 characters, so bugbit can be listed again. No behaviour change.

@v1 is updated to this release.

v1.3.1 — agents can't finish a pass without posting

Fixed

• A review that ends without posting no longer passes silently. If the agent stops before calling post_review (or update_pr_description on the describe pass), bugbit resumes the same session or agent with a follow-up, up to twice, and fails the job if it still hasn't posted. Seen with provider: claude when the model ended its turn after /security-review printed its report.
• .cursor/permissions.json is only copied into the checkout for provider: cursor.

@v1 is updated to this release.

v1.3.0 — Claude Code provider

Added

• provider input: cursor (default) or claude. provider: claude runs Claude Code's built-in /code-review, /security-review and /simplify skills through the Claude Agent SDK and posts findings as inline review comments, like Cursor.
• claude-code-oauth-token (from claude setup-token, Claude Pro/Max) and anthropic-api-key for Claude auth.
• review-level (low | medium | high | xhigh | max), passed to Claude's /code-review.
• auto-describe works on both providers.

- uses: Vilancer/bugbit@v1
  with:
    provider: claude
    claude-code-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
    review-modes: code-review, security-review, simplify
    review-level: medium

Changed

• cursor-api-key is only required when provider is cursor. model defaults to composer-2.5 on Cursor and to Claude Code's default model on Claude.

Security

• Claude sessions are read-only: one plain read-only git command at a time, no file edits or web access, and no reads of .git/config, .env*, keys or /proc.
• Neither provider loads settings, rules, hooks or MCP servers from the PR branch.
• bugbit removes its credential inputs and the Actions runtime token from the environment before any agent starts.
• On both providers, comments, descriptions and labels are stripped of the GitHub token, the provider key and token-shaped strings before they are posted.
• Cursor's shell can't be restricted per command (its SDK has no hooks, and its sandbox doesn't start on GitHub-hosted runners); the scrubbing above is the backstop.

@v1 is updated to this release.

v1.2.0 — review skills, large PRs, auto-describe

Changed

• code-review now invokes Cursor /review-bugbot (aliases: review-bugbot, bugbot). /review-security and /simplify stay first-class.

Fixed

• Paginate pulls.listFiles so PRs with more than 30 changed files are fully reviewed.
• Empty post_review findings no longer post a false LGTM when findings is missing or not an array.
• Live null PR body is treated as empty so auto-describe does not restore deleted author text.

Added

• Prefetched PR title and body (treated as untrusted author text).
• Progressive diff slim (full → hunk_ranges → paths_only) instead of DIFF_TOO_LARGE.
• post-clean-summary (default true) posts a visible LGTM COMMENT when findings are empty.
• Optional auto-describe pass (once per PR) plus inferred type / review-effort labels and describe-labels. Needs issues: write.
• Empty review-modes is allowed when auto-describe is on (describe-only).

@v1 is updated to this release.

Inspired by @JuicyBurger's JuicyBurger/bugbit fork.

v1.1.1

Fixed

• action.yml load failure — Removed invalid workflow expression from action metadata that caused Failed to load action.yml on all consumers.
• workflow_dispatch runtime — resolveEvent uses fetch for GitHub API instead of an unbundled @actions/github import.

@v1 updated to this release.

v1.1.0 — workflow_dispatch support

Added

• pr-number input for workflow_dispatch workflows that lack a native pull_request event payload

Changed

• Improved error messages when pull request context is missing (actionable hints for workflow_dispatch vs other triggers)
• Event/PR validation now runs before the GitHub token permission preflight check, avoiding misleading permissions errors when the real issue is missing PR context

Breaking

• None — this release is additive; existing pull_request workflows are unchanged

bugbit v1.0.1 — Marketplace name fix

bugbit v1.0.1

Patch release: Marketplace listing name is now vilancer-bugbit (GitHub user bugbit blocks the short name bugbit).

Workflows are unchanged — still uses: Vilancer/bugbit@v1.

Highlights

• Cursor built-in review skills: /code-review, /review-security, /simplify
• Custom tools for PR context, diff scope, and post_review batch comments
• Token permission preflight before the agent starts
• Fork PR fail-fast (read-only GITHUB_TOKEN on fork heads)
• Vendored ripgrep for ubuntu-latest (dist/vendor/linux-x64/rg)
• Optional JSONL stream log artifact (save-stream-log)

Usage

- uses: Vilancer/bugbit@v1
  with:
    cursor-api-key: ${{ secrets.CURSOR_API_KEY }}

Requirements

• Job permissions: contents: read, pull-requests: write
• CURSOR_API_KEY repository secret
• runs-on: ubuntu-latest
• Same-repo PR branches (not fork heads)

bugbit v1.0.0 — PR reviews with your Cursor agent

bugbit v1.0.0

First stable release of bugbit — a GitHub Action that runs your own Cursor agent on pull requests and posts line-anchored review comments.

Highlights

• Cursor built-in review skills: /code-review, /review-security, /simplify
• Custom tools for PR context, diff scope, and post_review batch comments
• Token permission preflight before the agent starts
• Fork PR fail-fast (read-only GITHUB_TOKEN on fork heads)
• Vendored ripgrep for ubuntu-latest (dist/vendor/linux-x64/rg)
• Optional JSONL stream log artifact (save-stream-log)

Usage

- uses: Vilancer/bugbit@v1
  with:
    cursor-api-key: ${{ secrets.CURSOR_API_KEY }}

Pin to @v1.0.0 for an exact version, or @v1 for compatible updates within major v1.

Requirements

• Job permissions: contents: read, pull-requests: write
• CURSOR_API_KEY repository secret
• runs-on: ubuntu-latest (supported vendored rg path)
• Same-repo PR branches (not fork heads)

Full docs

See README.