Bump agentic-pr-review to v1.1.0 and drop the hand-rolled MiniMax review

[wende]

What changed

• .github/workflows/openhands-pr-review.yml now pins wende/agentic-pr-review at 7c6c907 (v1.1.0), up from 1f5bd01 (v1.0.0). Same SHA-pin + version-comment style as before.
• Removed the older hand-rolled review: .github/workflows/minimax-pr-review.yml, .github/scripts/ai-review.mjs, and .github/prompts/minimax-pr-review.md. Both .github/scripts/ and .github/prompts/ are gone, since those were their only contents.

Why

Every pull request was getting two independent AI review passes — the action and the hand-rolled script — covering the same ground. The action is the maintained path, so the script version goes.

Reviewer notes

• No input changes were needed. Every input the workflow passes (llm-model, llm-base-url, llm-api-key, github-token) is still valid in v1.1.0. The removed lmnr-api-key input was never passed here.
• issues: write was already granted, which v1.1.0's new memory feature requires — so no permission change either.
• MINIMAX_API_KEY is still in use by the OpenHands workflow; do not remove the secret.

Behaviour changes that come with v1.1.0, with no config edits

• Repository review memory is on by default, backed by a GitHub issue. Expect a memory issue to be created on the first run.
• Pull requests over 10,000 changed lines get a comment instead of a review.
• A pull request labelled skip-review is skipped. Note this repo does not short-circuit at the job level, so such a PR still starts a runner and skips inside the action — worth adding later if the label sees real use.
• The action now sends no telemetry.
• Review iterations wrap up at 40 and are hard-capped at 60.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
macbeth	Ready	Preview	Jul 30, 2026 8:05pm

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[github-actions]

🟢 Good taste — clean migration to the maintained action and removal of the duplicate hand-rolled review.

Previous review follow-up — this is the first marked review on this PR; no prior findings to classify.

Verification performed:

• Pinned SHA 7c6c9079… resolves to the commit the v1.1.0 annotated tag points to (tag authored by wende@hey.com). Tag is unsigned, but the SHA pin is the actual trust anchor, matching the v1.0.0 pattern.
• The maintainer of wende/agentic-pr-review is the same as the reviewed repo (wende), so this is a first-party action — the 7-day waiting rule does not apply, and supply-chain risk is unchanged from v1.0.0 (same author, same pin style, same input surface).
• All four inputs in openhands-pr-review.yml (llm-model, llm-base-url, llm-api-key, github-token) are still valid in v1.1.0; the new issues: write permission requirement is already present in the workflow.
• No dangling references to the deleted minimax-pr-review.yml, ai-review.mjs, or minimax-pr-review.md remain in the tree.
• CI: Tests workflow run on chore/agentic-review-1.1.0 succeeded; OpenHands PR Review is actively exercising the bumped v1.1.0 action on this PR.

Behaviour notes from v1.1.0 already covered in the PR description (no action needed from the author): repo memory issue will be auto-created on first run, skip-review label still starts a runner, iterations wrap at 40 / hard-cap 60, dead lmnr-api-key input cleared.

[RISK ASSESSMENT]
[Overall PR] ⚠️ Risk Assessment: 🟢 LOW — first-party action pinned by SHA, equivalent permissions to the prior pin, successful CI on the same commit, no behavioral regressions introduced.

VERDICT: ✅ Worth merging — straightforward cleanup; the maintained action supersedes the hand-rolled script and the bump is consistent with prior pinning hygiene.