ci(github-action): update action misospace/pr-reviewer-action (v2.1.2 → v2.1.3)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
misospace/pr-reviewer-action	action	patch	v2.1.2 → v2.1.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

misospace/pr-reviewer-action (misospace/pr-reviewer-action)

v2.1.3

Compare Source

What's Changed

• ci(github-action): update action misospace/pr-reviewer-action (v2.1.1 → v2.1.2) by @​its-miso[bot] in #​407
• fix: omit Linked Issue Context / Evidence Providers headers when empty by @​Tanguille in #​410
• fix(security): reject artifact symlinks by @​joryirving in #​411
• fix(impact): avoid awk broken pipe by @​joryirving in #​412

New Contributors

• @​Tanguille made their first contribution in #​410

Full Changelog: misospace/pr-reviewer-action@v2.1.2...v2.1.3

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation: Approve

This is a routine patch-version dependency update for the misospace/pr-reviewer-action GitHub Action, from v2.1.2 to v2.1.3. It touches a single file with a two-line change (SHA pin swap).

---

Change-by-Change Analysis

.github/workflows/ai-pr-review.yaml

• What changed: The uses reference for misospace/pr-reviewer-action was updated from commit a177c3478b52a6f8402ebbe9a0ba59c61cf028ed (v2.1.2) to commit 16da47790168e70ca1f5f94821375f5b6e44a2c2 (v2.1.3).
• Verified: The new SHA was confirmed in the ai-pr-review.yaml file read during the tool harness pass. The release tag v2.1.3 with matching SHA was confirmed in the GitHub Releases Enrichment data (16da47790168e70ca1f5f94821375f5b6e44a2c2).
• Change quality: The update is a pure SHA pin replacement with a comment annotation — the standard pattern used consistently throughout the repository's workflow files.

---

Standards Compliance

No repository standards in AGENTS.md govern GitHub Action version updates. The PR follows established conventions:

• Uses full SHA pin (not a mutable tag like v2.1.3)
• Includes a version comment after the SHA (# v2.1.3)
• Matches the pattern used for all other pinned actions in the repo (e.g., actions/checkout, actions/create-github-app-token, etc.)

---

Linked Issue Fit

No linked issues. This is a standalone dependency refresh.

---

Evidence Provider Findings

Some gh_api tool calls failed when attempting to fetch release metadata directly from misospace/pr-reviewer-action (404 responses). This does not block the review because:

1. The release notes were embedded directly in the PR body and sourced from the Renovate update
2. The GitHub Releases Enrichment step successfully retrieved the release metadata, confirming v2.1.3 was published at 2026-07-12T02:25:06Z with commit SHA 16da47790168e70ca1f5f94821375f5b6e44a2c2
3. The compare API confirmed the commit list for v2.1.2...v2.1.3 with four commits including a security fix (#411)

---

Tool Harness Findings

The read_file tool successfully read .github/workflows/ai-pr-review.yaml and confirmed the updated SHA is present in the file after the diff would be applied.

---

Security Considerations

Relevant: The v2.1.3 release includes PR PR 411 ("fix(security): reject artifact symlinks"). The PR description's linked compare data shows a new file scripts/artifact_paths.sh was added that:

• Maintains a hardcoded allowlist of artifact file paths
• Checks if any are symlinks before the workflow writes generated files into the reviewed checkout
• Refuses to proceed if a PR-controlled symlink exists at any artifact path

This is a security hardening improvement. The PR brings this protection into the dispatch repository's CI review pipeline.

---

CI Results

All CI checks passed for commit 99d96287c1a9347f94def7d54490f25e1e1e1d1d:

• Build, Typecheck, Tests, Lint, Docker Build — all success
• Two "review" checks (likely the misospace/pr-reviewer-action running on this PR itself) — both success

---

Unknowns / Needs Verification

None. The release is verified, the SHA pin is correct, CI passes, and the change is mechanically minimal.

---

Summary

Routine patch update. The new version includes a security fix for artifact symlink handling. CI passes, SHA is correctly pinned, and the change follows repository conventions. No blockers.