ci(github-action)!: Update action misospace/pr-reviewer-action (v1.3.0 → v2.0.1)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
misospace/pr-reviewer-action	action	major	v1.3.0 → v2.0.1

---

Release Notes

misospace/pr-reviewer-action (misospace/pr-reviewer-action)

v2.0.1: — Forgejo seam hardening + CI guards

Compare Source

A small hardening patch on the 2.0 line. No functional change for GitHub consumers — on the supported path runtime behavior is identical to v2.0.0. This release is regression guards, docs, and two Forgejo-only correctness fixes. @v2 now points here.

Forgejo correctness (the only runtime changes; the GitHub path is byte-identical)

• platform_compare now forwards --jq on the Forgejo backend — it was silently dropped, so a --jq projection returned the whole compare object instead of the field. The --jq passthrough is now a single shared helper used by both platform_pr_get and platform_compare (#​344).
• The incremental-diff fetch only runs for a real http(s):// compare URL. Forgejo's compare object omits url, so the fetch now skips cleanly instead of attempting a doomed request (#​344).

Hardening and docs

• Outbound-HTTP User-Agent regression guard (#​345): web_fetch / web_search / fetch_url are now asserted to send a non-default User-Agent. urllib's default UA is what tripped the konflate Cloudflare bot fence; a future helper that forgets the header now fails in CI instead of in production.
• Adversarial-fixture convention documented (#​345): every sanitizer/fence must have a test that feeds the boundary token itself, not just benign input.
• Seam divergence + versioning notes refreshed (#​344, #​346): the known Forgejo/GitHub shape differences are documented in the platform seam header, and the versioning convention reflects the current floating-major-tag scheme.

Upgrading

Drop-in for any v2 consumer — @v2 and @v2.0.0 pins need no changes. The v1 tag is unaffected.

Full changelog: misospace/pr-reviewer-action@v2.0.0...v2.0.1

v2.0.0: — Consolidation, prefill diet, Forgejo complete

Compare Source

A breaking, semver-honest release. This is the post-1.3 tech-debt audit (#​258): the high-value cleanups change the input and tool-mode surface, so they land as 2.0 rather than 1.4. There are no new review capabilities over v1.3.1 — this release is consolidation, a real prefill-token diet, and finished Forgejo support.

Breaking changes

1. plan_execute tool modes removed (#​326). tool_mode now accepts only off or native_loop. A stale plan_execute_once / plan_execute_loop value degrades to off with a warning — the review still runs (corpus-only), it just won't gather evidence. native_loop has been the only mode any consumer runs since 1.3.0, so this breaks no live deployment. Migration: set tool_mode: native_loop.

2. ai_fast_* inputs removed (#​329). The deprecated ai_fast_model / ai_fast_base_url / ai_fast_api_format / ai_fast_api_key aliases — superseded by ai_primary_* in 1.3.1 — are gone. Migration: rename them to ai_primary_*, or just let the primary resolve from ai_model.

3. Publish steps collapsed into one dispatcher (#​328). Internal restructure; inputs and outputs are unchanged, so most consumers need to do nothing. Flagged breaking out of caution because the action's internal step layout changed. As a bonus it structurally kills the duplicate-env:-key drift that broke v1.2.10 — there's only one publish env: block left to drift.

Performance — prefill-token diet

native_loop is prefill-dominated with low cache reuse, so every token trimmed from the per-round corpus compounds across rounds:

• Corpus-bound JSON compacted (#​337)
• gh_api + web_search tool-result JSON compacted (#​338)
• Conditional system-prompt assembly by PR type — host-platform, image-digest, and release-notes guidance now prefill only when the PR's classification needs them, instead of every round on every PR (#​339, #​334)
• system_prompt_mode: append — a repo can add its conventions on top of the live bundled default instead of copying and re-syncing the whole prompt (#​340)

Forgejo — support complete

• compare backend (#​280), native review publishing (#​291), gh_api routed through the platform seam (#​294), and an end-to-end smoke harness (#​293)
• Golden fixtures recorded from a real forge for every seam normalizer (#​341, finishing #​252) — these guard the field-shape bug class that bit before (e.g. the per-entry commit-status status vs state regression, #​244)

Internals and quality

• run_review.sh split into sourced section modules (#​324); transport and tool executors extracted from the tool harness into their own modules (#​325); dead code pruned (#​331)
• Cache-hit-ratio surfaced in the step summary, outputs, and metadata marker (#​335)
• Per-file attribution for classifier risk flags (#​322); a warning when an evidence provider is configured as a shell string (#​320)
• Test infra: shared bash assertion helpers (#​323), an expanded agentic eval corpus beyond the single Talos scenario (#​321), a mid-flight wall-clock assertion (#​318)
• CI: actions/checkout bumped to v7 (#​316)

Upgrading

Pin to v2.0.0 or the floating v2 tag. The v1 tag is not moved to this release — it stays on the 1.3.x line, so anything pinned to @v1 is unaffected and adopts v2 only when you bump it deliberately. Before upgrading, set tool_mode: native_loop and rename any ai_fast_* inputs.

Full changelog: misospace/pr-reviewer-action@v1.3.1...v2.0.0

v2

Compare Source

v1.3.1: — Routing fix: the primary model gets its full tool budget

Compare Source

v1.3.1 — Routing fix: the primary model gets its full tool budget

A bug-fix release for review_routing_mode: auto. The auto router was sending low-risk PRs (e.g. a renovate dependency bump) to a shallow lane that capped the loop's tool budget — starving exactly the multi-hop chains (read the changed config → search → fetch the compatibility matrix → cite) that the v1.3.0 native loop was built to run. All changes are backward-compatible via deprecated aliases.

Fixes

• The primary route gets the full configured tool budget. Removed the route-based shallow cap — the loop self-limits, so the cap only ever starved chain-needing PRs. The route now selects the model, not the budget (#​278).
• The smart tier only escalates when explicitly configured. ai_smart_* no longer falls back to ai_fallback_*: with no ai_smart_model set, a review stays on the primary model instead of silently escalating to the fallback. The fallback model is for availability, not quality escalation (#​278).

Rename (backward-compatible)

• The fast route is now primary — a capable primary model shouldn't be rationed like a "fast/dumb" lane. Inputs ai_fast_* → ai_primary_*, with ai_fast_* retained as deprecated aliases, so no workflow changes are needed to upgrade. The review_route output and engine annotation now read primary; the per-route artifact is ai-output.primary.json (#​278).

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR Review: Update misospace/pr-reviewer-action v1.3.0 → v2.0.1

Recommendation

Approve. This is a routine GitHub Actions dependency update. The upgrade is a drop-in for v2 consumers; the repository's workflow is already compatible with v2.0.1's requirements.

---

Change-by-Change Findings

.github/workflows/ai-pr-review.yaml (1 line changed)

• Updated action pin from SHA 3479bf51ab9133414ae07af783bff985d3929884 (v1.3.0) to SHA 75d38fbc0a6098eb253a9c8a2c28ad1c20f268fb (v2.0.1), with the comment updated accordingly.
• This is a pinned SHA with a version comment — correct and secure.

---

Standards Compliance

Check	Status	Notes
Action version pinned with SHA	✅	Both old and new refs use full commit SHAs
Version comment matches ref	✅	# v2.0.1 correctly labels the new SHA
No secret exposure	✅	No secrets modified
CI workflow change (no blocking preconditions)	✅	No build/test files affected

---

Linked Issue Fit

No linked issues. The PR is a self-contained dependency update.

---

Evidence Provider Findings

Not applicable — no evidence providers are configured in this repository.

---

Tool Harness Findings

Not applicable — no tool harness was invoked for this PR.

---

Breaking Change Analysis (v1.3.0 → v2.0.1)

The v2.0.0 release notes explicitly flag two breaking changes:

1. tool_execute modes removed — v2 accepts only off or native_loop; plan_execute_loop/plan_execute_once degrade to off with a warning. This repository's workflow does not set tool_mode explicitly, so it inherits the default (native_loop). ✅ Compatible.

2. ai_fast_* inputs removed — renamed to ai_primary_*. This repository's workflow uses ai_primary_retries (correct v2 name) and ai_smart_* inputs (unchanged). ✅ Compatible.

The v2.0.1 patch is described as a hardening release with no functional change for GitHub consumers; the Forgejo-only fixes do not affect this repository. ✅ No regression risk.

---

CI Check Results

All CI checks passed at commit 0333d492ce0cf9d4512d31562bcf9e241ddfcbb8:

• merge ✅
• dockerfile-lint ✅
• lint ✅
• npm-audit ✅
• test ✅
• build (ubuntu-latest, linux/amd64) ✅
• build (ubuntu-24.04-arm, linux/arm64) ✅

---

Unknowns / Needs Verification

None. The upgrade path is clear, the breaking changes are confirmed non-impactful, and all CI gates are green.