Skip to content

oss-pr-reviewer v0.3.0

Choose a tag to compare

View all tags
@vuphongle vuphongle released this 13 Aug 03:59
· 7 commits to main since this release
v0.3.0
a351adc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Added an opt-in composite GitHub Action for pull_request events: opened, synchronize, and reopened.
  • Reused the existing CLI and review engine instead of creating a separate Action implementation.
  • Appended the Markdown review report to GITHUB_STEP_SUMMARY in summary-only mode.
  • Added Action input validation for GitHub token, OpenAI key, model, and minimum severity.
  • Added least-privilege workflow guidance with contents: read and pull-requests: read.
  • Added fork secret limitation handling and documentation.
  • Added a tagged workflow example and GitHub Actions usage/architecture documentation.

Security and limitations

The Action uses pull_request, does not use pull_request_target, does not check out or execute contributor code, and does not post PR comments or annotations. High and critical findings remain advisory and do not fail the job. Repository configuration continues to come from the trusted pull request base commit.

Live GitHub/OpenAI Action smoke testing remains pending because credentials were not used during release preparation.

Validation

The release passed local install with 0 vulnerabilities, lint, typecheck, 59 deterministic tests, build, format checks, YAML validation, CLI checks, package dry-run, secret scan, and GitHub Actions CI.

Assets 2
Loading