ci: add trusted-contributor AI PR review#13
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f40177f4f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if len(diff) > DIFF_CHAR_BUDGET: | ||
| diff = diff[:DIFF_CHAR_BUDGET] + "\n\n[... diff truncated for length ...]" |
There was a problem hiding this comment.
For any PR whose unified diff exceeds 200 KB, this silently drops the tail and still lets the run produce a normal clean verdict. If a P0 issue appears after the truncation point, the script can add ai-review-passed and submit the trusted-author approval even though that part of the PR was never reviewed; treat truncation as non-approvable or surface it as a blocking/skip state.
Useful? React with 👍 / 👎.
| findings: dict[str, list[str]] = {"P0": [], "P1": [], "P2": []} | ||
| matches = list(_SECTION_RE.finditer(review_md)) |
There was a problem hiding this comment.
If Claude returns markdown without the exact ## P0/## P1/## P2 headings, returns an empty response, or is truncated before those headings, matches is empty and the default empty findings make verdict_from_findings() return clean. That can label and approve a PR even though the review result was malformed, so missing required sections should be treated as a review failure rather than as zero findings.
Useful? React with 👍 / 👎.
| # Budget guardrails (override per repo if needed). | ||
| AI_REVIEW_DAILY_USD_CAP: "10.00" |
There was a problem hiding this comment.
This workflow sets a daily cap but never supplies AGENT_PRIOR_COST_USD or restores the cached artifact that read_prior_cumulative_cost() expects; in Actions there is also no local brain.db, so every run starts with prior cost 0.0. A busy day of PR updates or trusted comments can therefore exceed the intended daily cap as long as each individual review is under $10.
Useful? React with 👍 / 👎.
| else: | ||
| set_output("trusted_auto_approve", "skipped-p0") |
There was a problem hiding this comment.
When a PR was previously clean, this script adds ai-review-passed; on a later synchronize run that finds a P0, the non-clean path only records an output and never removes the old label. That leaves the PR marked as passed on a revision with blocking findings, which can mislead any humans or automation that key off the label.
Useful? React with 👍 / 👎.
1 participant
Summary
ai-review-passed, and approve only when there are zero P0 findings.Safety
git diff; it is not executed with secrets.AI_REVIEW_TRUSTED_AUTHORS.AI_REVIEW_APPROVER_TOKEN; without it the workflow still reviews/comments but skips approval.Required config
AI_REVIEW_TRUSTED_AUTHORS.ANTHROPIC_API_KEYfor AI review.AI_REVIEW_APPROVER_TOKENfor trusted-author approve.Test plan
.github/ai_pr_review.pydry-run with a clean mocked review from the source template.