Marcos
8c491a7626
The reviewer runs an opencode agent with `bash: "*": allow` over a checkout of the PR author's branch, and the pod holds a Gitea Write credential. Those two facts had no wall between them. Security - _build_env now allow-lists the subprocess environment instead of inheriting it, so PRAGENT_BOT_TOKEN and WEBHOOK_SECRET never reach the agent. This was the live hole: a PR body or an AGENTS.md could ask the agent to `curl` the token out, and it had both the value and the tool. - sanitize_workdir deletes author-controlled agent-instruction files from the checkout before opencode starts (AGENTS.md at any depth, CLAUDE.md, .cursorrules, a repo opencode.json/.opencode, copilot-instructions.md). opencode loads nested AGENTS.md as instructions, so a PR could otherwise ship its own system prompt. They are still reviewed, as data. - The brief fences PR title/body and diff in --- UNTRUSTED --- markers under a trust-boundary preamble; the pragent agent, the three lens subagents and the review-methodology skill now treat injection attempts as a critical finding to report rather than an instruction to obey. - .pr-review.json is read from the PR's base branch, not the head sha. Its `instructions` field is spliced into the reviewer's prompt, so head-ref reading let any author rewrite the reviewer's rules. Fields are length-capped. - Untar rejects escaping symlinks, parent traversal, and writes through a planted symlink (tar-slip). - The image runs as uid 10001 instead of root. Robustness - Bounded review concurrency (PRAGENT_MAX_CONCURRENT_REVIEWS, default 2). Each review forks an opencode process; a thread per delivery was a fork bomb on a burst of labels or Gitea retries. - An in-flight (repo, index, sha) claim closes the check-then-act race in the sha-marker dedupe, where two deliveries a second apart both read "not yet reviewed" and both posted. - Request bodies are capped before being read into memory. Correctness - parse_diff_anchors counts a whitespace-stripped blank context line. Skipping it desynced the new-line counter for the rest of the hunk and silently misplaced every later inline comment in that file. - post_inline_review's body-only fallback folds the anchored findings into the body. It previously posted a summary saying "N inline comment(s) below" with no comments and no findings — losing them all on the one path that matters. - fetch_pr_diff's files-endpoint fallback emits real a// b/ prefixes (so changed_files and the anchor parser work on it) and reports both HTTP statuses in its error instead of the same one twice. - The CI workflow template pins PRAGENT_ENGINE=ollama; review_pr defaults to opencode, which does not exist on a Gitea Actions runner. Tests: 68 -> 101, covering each of the above. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B11e8TZZxJyzHW7jj7KWUN
52 lines
2.3 KiB
YAML
52 lines
2.3 KiB
YAML
# pragent pilot — AI Review workflow template.
|
|
#
|
|
# Copy this file into the repo you want reviewed as:
|
|
# .gitea/workflows/ai-review.yml
|
|
#
|
|
# Prerequisites (see pilot/README.md):
|
|
# 1. pragent-bot added as a collaborator with Write access.
|
|
# 2. repo secret PRAGENT_BOT_TOKEN set to the bot's access token.
|
|
#
|
|
# Reviews fire ONLY on PRs carrying the `AI-REVIEW` label. Remove the label to
|
|
# stop a re-review on subsequent pushes. The job is fail-open (never blocks CI).
|
|
|
|
name: AI Review
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, labeled]
|
|
|
|
jobs:
|
|
review:
|
|
# Only run when the PR has the AI-REVIEW label. Acts as a cheap gate: no
|
|
# model call, no cost, when the label is absent.
|
|
if: contains(github.event.pull_request.labels.*.name, 'AI-REVIEW')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Run pragent pilot review
|
|
env:
|
|
GITEA_API: http://gitea-http.gitea.svc.cluster.local:3000
|
|
GITEA_REPOSITORY: ${{ github.repository }}
|
|
PR_INDEX: ${{ github.event.pull_request.number }}
|
|
PR_TITLE: ${{ github.event.pull_request.title }}
|
|
PR_BODY: ${{ github.event.pull_request.body }}
|
|
# .pr-review.json is read from the base branch, not the PR head, so a
|
|
# PR cannot ship its own reviewer instructions.
|
|
PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
|
|
PRAGENT_BOT_TOKEN: ${{ secrets.PRAGENT_BOT_TOKEN }}
|
|
PRAGENT_SHA: ${{ github.event.pull_request.head.sha }}
|
|
# The CI runner has no opencode CLI (and no factory checkout), so the
|
|
# legacy single-model-call engine is the only one that works here.
|
|
# review_pr defaults to `opencode` for the webhook service.
|
|
PRAGENT_ENGINE: ollama
|
|
# On-network model: headroom proxy on kubernets (tailnet IP).
|
|
OLLAMA_URL: http://100.74.17.70:8789
|
|
OLLAMA_MODEL: glm-5.2:cloud
|
|
OLLAMA_MAX_TOKENS: "6000"
|
|
DIFF_MAX_CHARS: "150000"
|
|
run: |
|
|
set -e
|
|
# Fetch the reviewer script from the pragent repo (private → bot token).
|
|
curl -fsS -H "Authorization: token $PRAGENT_BOT_TOKEN" \
|
|
"$GITEA_API/api/v1/repos/gitea_admin/pragent/raw/pilot/ai_review.py?ref=main" -o ai_review.py
|
|
python3 ai_review.py |