ci: request review from the Devin session creator on Devin PRs

[devin-ai-integration]

Summary

This repo has no CODEOWNERS, so Devin PRs were opened with no reviewer at all (e.g. #83) and had to be assigned by hand. This adds a workflow that, on every PR opened by devin-ai-integration[bot], parses the Requested by: @user line Devin appends to the body and requests review from that user:

const reviewer = pr.body.match(/^Requested by: @(...)$/m)?.[1]
if (reviewer && !pr.requested_reviewers.some(u => u.login === reviewer))
  await github.rest.pulls.requestReviewers({...context.repo, pull_number: pr.number, reviewers: [reviewer]})

It reads the requester from the body rather than hardcoding a name, so PRs from anyone's session get routed to that person. Missing line or a failed request (e.g. reviewer lacks repo access) is a core.warning, never a red check.

Identical workflow added to flightcontrolhq/flightcontrol (flightcontrolhq/flightcontrol#6761), where CODEOWNERS only covered a handful of paths.

Link to Devin session: https://app.devin.ai/sessions/675bb21ebaa044e9b4291ca96ac271ca
Requested by: @flybayer

Greptile Summary

Adds automation for routing Devin-authored pull requests to their session creator.

• Runs when a Devin pull request is opened, reopened, or marked ready for review.
• Extracts the requester username from the pull-request body and avoids duplicate requests.
• Requests review through the GitHub API while treating missing requesters and API failures as warnings.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking supply-chain hardening opportunity in the new workflow.

The reviewer-routing logic is scoped to Devin-authored pull requests and handles expected failures without breaking CI, while the mutable action reference unnecessarily leaves write-enabled execution dependent on an upstream tag.

Files Needing Attention: .github/workflows/devin-pr-reviewer.yml

Security Review

The new write-enabled workflow references actions/github-script by a mutable major-version tag; pinning it to a full commit SHA would constrain execution to reviewed action code.

Important Files Changed

Filename	Overview
.github/workflows/devin-pr-reviewer.yml	Adds the Devin reviewer-request workflow; its behavior is narrowly scoped, but the write-enabled action dependency is not pinned immutably.

Prompt To Fix All With AI

### Issue 1
.github/workflows/devin-pr-reviewer.yml:16
**Mutable write-enabled action reference**

The workflow loads `actions/github-script` through the mutable `v7` tag while granting pull-request write permission, leaving repository state exposed to unintended code when that upstream tag changes; pin the action to a full commit SHA. **How this was verified:** The referenced action receives the workflow's `pull-requests: write` permission.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "ci: request review from the Devin sessio..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Ravion Module Publish Plan

Dry run only. No Ravion API mutations were made.

No publish changes are required. All versions already exist with identical config.

[greptile-apps]

Mutable write-enabled action reference

The workflow loads actions/github-script through the mutable v7 tag while granting pull-request write permission, leaving repository state exposed to unintended code when that upstream tag changes; pin the action to a full commit SHA. How this was verified: The referenced action receives the workflow's pull-requests: write permission.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/devin-pr-reviewer.yml
Line: 16

Comment:
**Mutable write-enabled action reference**

The workflow loads `actions/github-script` through the mutable `v7` tag while granting pull-request write permission, leaving repository state exposed to unintended code when that upstream tag changes; pin the action to a full commit SHA. **How this was verified:** The referenced action receives the workflow's `pull-requests: write` permission.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.