H-Chris233
bd4547b613
The workflow must keep reviewing every PR and every pushed commit automatically, including fork PRs, so the hardening focuses on pinning the code that actually runs in the secrets-bearing job. The wrapper action commit still delegates to a mutable Docker tag, so the workflow now calls the PR-Agent container by immutable digest directly. Constraint: Maintainer preference is automatic PR-Agent coverage for each PR and synchronize event. Constraint: Issue #222 requires removing mutable third-party execution refs from the secrets-bearing path. Rejected: Pin only the action repository commit | the wrapper Dockerfile still resolves pragent/pr-agent:github_action at runtime. Rejected: Require trusted comment triggers for fork PRs | too inconvenient because new commits would not be reviewed automatically. Confidence: medium Scope-risk: moderate Directive: If fork PR automation remains required, keep the runtime container digest-pinned and do not checkout PR head code in this workflow. Tested: Parsed .github/workflows/pr-agent.yml with PyYAML and asserted docker:// sha256 form; git diff --check; grep confirmed no action ref or github_action tag remains in the workflow. Not-tested: Live GitHub Actions execution or Docker Hub digest pull from this host. Related: https://github.com/appergb/openless/issues/222
69 lines
2.6 KiB
YAML
69 lines
2.6 KiB
YAML
name: PR-Agent
|
||
|
||
on:
|
||
# 使用 pull_request_target 让同仓库与外部 fork PR 都能自动运行 PR-Agent，
|
||
# 并在 synchronize 事件跟进每次新 commit。
|
||
# 本 workflow 不 checkout / 执行 PR 分支代码，只让 digest-pinned PR-Agent 镜像通过 GitHub API 读取 diff。
|
||
pull_request_target:
|
||
types: [opened, reopened, ready_for_review, synchronize]
|
||
issue_comment:
|
||
types: [created]
|
||
|
||
jobs:
|
||
pr_agent_job:
|
||
# PR 与每次新 commit 自动运行；评论触发仍限制为可信成员，避免任意评论滥用 Secrets。
|
||
if: >-
|
||
${{
|
||
github.event.sender.type != 'Bot' &&
|
||
(
|
||
github.event_name == 'pull_request_target' ||
|
||
(
|
||
github.event_name == 'issue_comment' &&
|
||
github.event.issue.pull_request &&
|
||
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
|
||
)
|
||
)
|
||
}}
|
||
runs-on: ubuntu-latest
|
||
|
||
permissions:
|
||
# PR-Agent 需要在 PR/issue 上评论，并通过 GitHub API 读取 diff/文件内容。
|
||
issues: write
|
||
pull-requests: write
|
||
contents: read
|
||
|
||
steps:
|
||
- name: Run PR Agent
|
||
# Pin the actual PR-Agent container image because this job can access repo Secrets.
|
||
uses: docker://pragent/pr-agent@sha256:a0b36966ca3a197ca739fa1e65c16703076fc1c744cd423ca203b8c21707d71c
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||
|
||
# 同时兼容 PR-Agent 旧写法和 OpenAI-like 新写法
|
||
OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
|
||
OPENAI__KEY: ${{ secrets.OPENAI_KEY }}
|
||
OPENAI.API_BASE: "https://cpa.chris233.qzz.io/v1"
|
||
OPENAI__API_BASE: "https://cpa.chris233.qzz.io/v1"
|
||
OPENAI_API_BASE: "https://cpa.chris233.qzz.io/v1"
|
||
OPENAI_BASE_URL: "https://cpa.chris233.qzz.io/v1"
|
||
|
||
# 中文输出
|
||
pr_reviewer.response_language: "zh-CN"
|
||
pr_description.response_language: "zh-CN"
|
||
pr_code_suggestions.response_language: "zh-CN"
|
||
|
||
# 模型配置
|
||
config.model: "openai/deepseek-v4-pro"
|
||
config.fallback_models: '["openai/gpt-5.4-mini"]'
|
||
config.custom_model_max_tokens: "1048576"
|
||
# GPT-5 fallback 不接受 temperature=0.2，保持 1 避免 LiteLLM 参数错误。
|
||
config.temperature: "1"
|
||
|
||
# 自动执行配置
|
||
github_action_config.auto_review: "true"
|
||
github_action_config.auto_describe: "true"
|
||
github_action_config.auto_improve: "false"
|
||
|
||
# 允许 synchronize 事件触发 PR-Agent
|
||
github_action_config.pr_actions: '["opened", "reopened", "ready_for_review", "synchronize"]'
|