thekidneyexperts/public-ai-tools-guide
Watch
3
0
Fork
You've already forked public-ai-tools-guide
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: enable advisory AI review #3

Merged
shree-mulay merged 2 commits from ci/ai-review-auto into main 2026-07-03 12:25:32 -05:00
Conversation 1 Commits 2 Files changed 1 +17
shree-mulay commented 2026-06-11 03:23:04 -05:00
Owner
Copy link

Auto-rollout: adds the org-standard advisory AI review step (broker-based, OpenCode OAuth gpt-5.5 medium, grob fallback). failure: ignore — never merge-blocking. See forgejo-infra grob/README.md.

Auto-rollout: adds the org-standard advisory AI review step (broker-based, OpenCode OAuth gpt-5.5 medium, grob fallback). failure: ignore — never merge-blocking. See forgejo-infra grob/README.md.
ci: enable advisory AI review (auto-rollout)
All checks were successful
ci/woodpecker/pr/woodpecker Pipeline was successful
Details
ci/woodpecker/push/woodpecker Pipeline was successful
Details
9f112782f5
ci: place ai-review inside steps block (fix inserter bug)
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details
ci/woodpecker/pr/woodpecker Pipeline was successful
Details
ci/woodpecker/pull_request_closed/woodpecker Pipeline was successful
Details
14ceb27daa
tke-bot commented 2026-06-11 03:48:19 -05:00
Member
Copy link

AI Review — openai/gpt-5.5 (medium, OAuth)

advisory; generated by review-broker; never merge-blocking

Verdict: needs changes: the new advisory review step likely fails at runtime because the shell quoting is incorrectly escaped inside a YAML block scalar.

Issues Found

  1. Blocker: curl command arguments are broken by escaped quotes
    .woodpecker.yml:16
    In a | block scalar, \" is passed literally to sh; it does not start shell quoting. This splits the Authorization header and JSON payload into invalid arguments, so the review call will likely fail every PR.
    Concrete fix:

        commands:
      - |
        curl -fsS --max-time 1200 -X POST http://172.17.0.1:23459/review \
          -H "Authorization: Bearer $${REVIEW_BROKER_KEY}" \
          -H "Content-Type: application/json" \
          -d "{\"repo\":\"$${CI_REPO}\",\"pr_number\":$${CI_COMMIT_PULL_REQUEST}}"

    Better fix if available in the image: use jq -n to avoid hand-built JSON.

  2. Potential security concern: PR pipeline receives a bearer token
    .woodpecker.yml:10
    This step injects review_broker_key into a pull_request pipeline. If Woodpecker exposes this secret to PRs from untrusted forks, a malicious PR could modify .woodpecker.yml to exfiltrate it.
    Concrete fix: confirm Woodpecker secret policy for forked PRs, and restrict this secret/step to trusted repositories or non-fork PRs if supported. If fork PRs are allowed, do not expose review_broker_key to PR-triggered pipelines.

Security / Data Handling / HIPAA-Adjacent

No credential is present in the diff itself. The only sensitive item is the referenced review_broker_key secret. The request payload only sends repo name and PR number, so there is no obvious PHI/HIPAA-adjacent data handling concern in this diff. The bearer token exposure risk above should be resolved before merge.

<!-- tke-ai-review --> ### AI Review — `openai/gpt-5.5 (medium, OAuth)` _advisory; generated by review-broker; never merge-blocking_ **Verdict: needs changes**: the new advisory review step likely fails at runtime because the shell quoting is incorrectly escaped inside a YAML block scalar. **Issues Found** 1. **Blocker: curl command arguments are broken by escaped quotes** `.woodpecker.yml:16` In a `|` block scalar, `\"` is passed literally to `sh`; it does not start shell quoting. This splits the `Authorization` header and JSON payload into invalid arguments, so the review call will likely fail every PR. Concrete fix: ```yaml commands: - | curl -fsS --max-time 1200 -X POST http://172.17.0.1:23459/review \ -H "Authorization: Bearer $${REVIEW_BROKER_KEY}" \ -H "Content-Type: application/json" \ -d "{\"repo\":\"$${CI_REPO}\",\"pr_number\":$${CI_COMMIT_PULL_REQUEST}}" ``` Better fix if available in the image: use `jq -n` to avoid hand-built JSON. 2. **Potential security concern: PR pipeline receives a bearer token** `.woodpecker.yml:10` This step injects `review_broker_key` into a `pull_request` pipeline. If Woodpecker exposes this secret to PRs from untrusted forks, a malicious PR could modify `.woodpecker.yml` to exfiltrate it. Concrete fix: confirm Woodpecker secret policy for forked PRs, and restrict this secret/step to trusted repositories or non-fork PRs if supported. If fork PRs are allowed, do not expose `review_broker_key` to PR-triggered pipelines. **Security / Data Handling / HIPAA-Adjacent** No credential is present in the diff itself. The only sensitive item is the referenced `review_broker_key` secret. The request payload only sends repo name and PR number, so there is no obvious PHI/HIPAA-adjacent data handling concern in this diff. The bearer token exposure risk above should be resolved before merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
thekidneyexperts/public-ai-tools-guide!3
No description provided.