oss-pr-reviewer v0.4.0

Highlights

• Added opt-in GitHub Action PR comment mode with post-comment: true.
• Added stable marker-based ownership and create-once/update-in-place behavior across repeated reviews.
• Added comment-action, comment-id, and comment-url Action outputs.
• Kept complete Markdown output in GITHUB_STEP_SUMMARY for every run.
• Added 60,000-character comment bounds, priority-aware truncation, truncation notices, and mention neutralization.
• Added least-privilege documentation: pull-requests: read for summary-only mode and pull-requests: write for comment mode.

Security and limitations

Comment mode is disabled by default, does not use pull_request_target, does not execute reviewed PR code, does not delete older duplicate comments, and remains advisory. Fork workflows may not receive repository secrets under GitHub's pull_request security model. Live GitHub/OpenAI PR comment smoke testing remains pending because credentials were not used during release preparation.

Validation

The release passed local install with 0 vulnerabilities, lint, typecheck, 74 deterministic tests, build, format checks, YAML validation, CLI checks, package dry-run, secret scan, and GitHub Actions CI.

oss-pr-reviewer v0.3.0

Highlights

• Added an opt-in composite GitHub Action for pull_request events: opened, synchronize, and reopened.
• Reused the existing CLI and review engine instead of creating a separate Action implementation.
• Appended the Markdown review report to GITHUB_STEP_SUMMARY in summary-only mode.
• Added Action input validation for GitHub token, OpenAI key, model, and minimum severity.
• Added least-privilege workflow guidance with contents: read and pull-requests: read.
• Added fork secret limitation handling and documentation.
• Added a tagged workflow example and GitHub Actions usage/architecture documentation.

Security and limitations

The Action uses pull_request, does not use pull_request_target, does not check out or execute contributor code, and does not post PR comments or annotations. High and critical findings remain advisory and do not fail the job. Repository configuration continues to come from the trusted pull request base commit.

Live GitHub/OpenAI Action smoke testing remains pending because credentials were not used during release preparation.

Validation

The release passed local install with 0 vulnerabilities, lint, typecheck, 59 deterministic tests, build, format checks, YAML validation, CLI checks, package dry-run, secret scan, and GitHub Actions CI.

oss-pr-reviewer v0.2.0

Highlights

• Added trusted-base repository configuration through .oss-pr-reviewer.yml.
• Added CLI-over-config-over-default minimum severity precedence.
• Added custom repository review rules with explicit untrusted-data prompt boundaries.
• Added validated glob-based ignored paths and ignored-file reporting.
• Added explicit character-based context budgeting with reserved prompt and response space.
• Added configurable batch limits and richer review statistics for changed, reviewed, ignored, skipped, and batched files.
• Added configuration examples, documentation, and 47 deterministic tests.

Security and limitations

Configuration is read from the pull request base commit, so a PR cannot silently change its own active review policy. Rules remain untrusted repository guidance and cannot override system safety instructions. Reviewed code is never executed.

Context budgets use character approximations rather than exact tokenizer accounting. OpenAI remains the only implemented provider. The tool does not clone repositories, post PR comments, or create inline annotations.

Validation

The release passed local install, lint, typecheck, 47 tests, build, format checks, CLI checks, package dry-run, and fresh GitHub Actions CI on main.

Live GitHub/OpenAI smoke testing remains pending because credentials were not used during release preparation.

oss-pr-reviewer v0.1.0

Highlights

• Review GitHub pull requests by repository/PR or URL.
• Fetch PR metadata and changed-file patches with Octokit.
• Normalize unsupported content and batch large diffs deterministically.
• Analyze reviewable changes through the OpenAI provider boundary.
• Validate structured findings with Zod, merge and deduplicate findings, filter by severity, and render Markdown reports.
• Includes mocked tests, GitHub Actions CI, documentation, a synthetic sample report, and community contribution templates.

Limitations

• OpenAI is the only implemented AI provider.
• Reviews use pull request metadata and patches; the repository is not cloned.
• The tool does not run reviewed code, post PR comments, or create inline annotations.
• Automated output does not replace human maintainer review, testing, or security auditing.

Validation

The release branch passed lint, typecheck, 27 automated tests, build, format checks, CLI help checks, and CI. Live GitHub/OpenAI API smoke testing remains pending because credentials were not used during release preparation.