Migrate PR review to openrouter with pinned 0.11.0 action #150
marvin8
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/issue-86-openrouter-review"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Migrates the wuming PR review to the openrouter backend with the fleet-standard two-tier model mapping (code/tests/performance on deepseek-v4-pro, security on kimi-k2-thinking, config/docs/shell on qwen3.7-flash) and pins the action to
0.11.0.Tracking: marvin8/wuming#86
50516a90549cfcdb452fWuMing
Found 1 issue(s). See inline comments below.
@ -13,3 +13,3 @@if: github.event_name == 'pull_request'steps:- uses: https://forge.marvin8.zone/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0security [HIGH]
A08: Software and Data Integrity Failures: Action is pinned to a mutable version tag (@0.11.0) instead of an immutable commit SHA. A compromised repository could retag a malicious commit, breaking supply chain integrity. Pin to a specific commit SHA and verify via checksum if possible.
#150 (comment)
🔴 Declined (fleet-wide maintainer decision, same as the identical findings across this migration — arvak, rainlog, zaojun, kokopelli, feed2fedi, archiving_imap): tag pinning was chosen so a wuming release update stays a one-line change per repo across ~17 consumer repos. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this forge. SHA pinning is the right follow-up only if that trust boundary grows.
WuMing
Found 5 issue(s). See inline comments below.
@ -13,3 +13,3 @@if: github.event_name == 'pull_request'steps:- uses: https://forge.marvin8.zone/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0security [MEDIUM]
A08: Workflow uses external action from custom forge (forge.marvin8.zone) pinned only by tag @0.11.0. Without SHA256 hash pinning, this introduces supply chain integrity risk. Pin to a specific commit hash to prevent tag tampering.
@ -4,62 +4,10 @@ visibility: publiccang 2026.9.7.1docs [MEDIUM]
Missing heading markup. As a version entry, it should be formatted as a heading (e.g., '##') to establish proper document hierarchy, improve scanability, and support screen readers.
@ -8,4 +7,1 @@- Journey view: a movement across several cameras now appears as one event with a stitched cross-camera player- Keep flag: protect events or single frames from retention cleanup with a button in the scrubber and day view#NVR #Python #Container #OpenSourcedocs [LOW]
Inline hashtag-style tags can render unpredictably across different markdown processors. Consider moving them to YAML frontmatter, wrapping in backticks, or using a standardized metadata key format for consistency.
@ -679,2 +819,4 @@wheels = [{ url = "https://files.pythonhosted.org/packages/3c/26/1062c7ec1b053db9e499b4d2d5bc231743201b74051c973dadeac80a8f43/questionary-2.1.1-py3-none-any.whl", upload-time = 2025-08-28T19:00:19Z, size = 36753, hashes = { sha256 = "a51af13f345f1cdea62347589fbb6df3b290306ab8930713bfae4d475a7d4a59" } }][[packages]]name = "requests"security [LOW]
A06: New dependency 'requests' v2.34.2 added. Verify this version isn't affected by known CVEs. Requests has historical security issues (e.g., CVE-2024-35195); confirm version is patched and necessary, as it's not in pyproject.toml.
@ -2,3 +2,3 @@"""Database layer — schema migration, snapshot CRUD, retention."""from collections.abc import AsyncIteratorfrom collections.abc import AsyncGeneratortests [LOW]
Source file modified (import and type annotation change from AsyncIterator to AsyncGenerator) without any test file changes in the diff. Consider adding or updating a test for the open_db function to cover the more specific generator type.
WuMing
Found 3 issue(s). See inline comments below.
@ -19,1 +21,3 @@agents: code:deepseek-v4-pro,config:deepseek-v4-flash,docs:deepseek-v4-flash,shell:deepseek-v4-flash,security:deepseek-v4-pro,tests:deepseek-v4-flashopenrouter_key: ${{ secrets.wuming_openrouter_key }}backend: openrouteragents: code:deepseek/deepseek-v4-pro,config:qwen/qwen3.7-flash,docs:qwen/qwen3.7-flash,shell:qwen/qwen3.7-flash,security:moonshotai/kimi-k2-thinking,tests:deepseek/deepseek-v4-proconfig [MEDIUM]
The PR description specifies a two-tier mapping that includes 'performance' on deepseek-v4-pro, but the 'agents' configuration omits the 'performance' key. If performance reviews are expected to run, this mapping will be missing. Consider adding 'performance:deepseek/deepseek-v4-pro'.
@ -25,3 +25,3 @@- repo: https://github.com/astral-sh/uv-pre-commitrev: 0.12.10rev: "0.13.1"config [LOW]
Inconsistent quoting for the 'rev' value. Align with the unquoted string style used for other revisions in this file to maintain consistency.
@ -43,3 +43,3 @@- repo: https://forge.marvin8.zone/marvin8/zaojunrev: 1.7.5rev: "1.8.2"config [LOW]
Inconsistent quoting for the 'rev' value. Align with the unquoted string style used for other revisions in this file to maintain consistency.
#150 (comment)
🔴 This file is a taibai thread, not ordinary markdown: its exact structure (version line, plain bullets, hashtag tags,
---post separators) is consumed and rewritten by the repo'sjust releaseandjust fediverse-postrecipes. Adding heading markup or moving the hashtags would break the release tooling. The format is mandated by the tooling and intentionally left as-is.#150 (comment)
🔴 This file is a taibai thread, not ordinary markdown: its exact structure (version line, plain bullets, hashtag tags,
---post separators) is consumed and rewritten by the repo'sjust releaseandjust fediverse-postrecipes. Adding heading markup or moving the hashtags would break the release tooling. The format is mandated by the tooling and intentionally left as-is.#150 (comment)
🔴 Declined (fleet-wide maintainer decision, consistent with the identical findings across this migration): tag pinning keeps wuming release updates a one-line change per consumer repo. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this forge.
#150 (comment)
🔴 Verified in CI on this very commit: the
pysentrysession scanned 111 packages and flagged advisories only on httpcore2, httpx2, urllib3, and virtualenv —requests2.34.2 has no known-advisory findings. pysentry runs on every PR, so any future advisory on it will be caught automatically.#150 (comment)
🔴 Annotation-only change:
AsyncGenerator[T, None]is the identical runtime contract@asynccontextmanageralways produced. Thetysession and the tryke suite (3.12/3.13/3.14) pass in CI — a signature-only typing adaptation does not warrant a new test.WuMing
Found 1 issue(s). See inline comments below.
@ -62,4 +11,3 @@Install / upgrade:pip install cangdocs [LOW]
The installation command contains unintended leading whitespace. Inline CLI instructions should not be indented unless enclosed in a fenced code block, as this may cause copy-paste errors or confuse automated parsers.
#150 (comment)
🔴 Intentional — cang did not run a
performanceagent before this migration, and each repo's existing agent set is preserved. The fleet mapping assigns a model to whichever agents a repo runs; it does not add agents. No performance review ran before this change and none runs after.#150 (comment)
✅ Fixed in commit
2ac6922— the bumped hook revisions are now unquoted (rev: 0.13.1,rev: 1.8.2), matching the unquoted style of every otherrevin the file.#150 (comment)
✅ Fixed in commit
2ac6922— same as the sibling finding: unquoted for consistency.#150 (comment)
🔴 Intentional — the indented install block is part of the taibai thread footer format that the repo's
just release/just fediverse-posttooling writes and consumes; the indentation renders as a code block in the Fediverse post. Same tooling-mandated format as the version line and hashtags.WuMing
Found 2 issue(s). See inline comments below.
@ -8,2 +8,4 @@workflow_dispatch:env:UV_PYTHON: "3.14"security [MEDIUM]
A05: Security Misconfiguration - UV_PYTHON set to "3.14", a non-existent Python version that may cause build failures or fallback to unexpected Python versions with potential security implications.
@ -15,3 +18,3 @@- uses: https://forge.marvin8.zone/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0with:forgejo_token: ${{ forge.token }}security [HIGH]
A05: Security Misconfiguration - forgejo_token uses incorrect syntax ${{ forge.token }}. Should use ${{ secrets.FORGEJO_TOKEN }} to ensure secrets are properly handled and not exposed in logs.
#150 (comment)
🔴 Factually incorrect — CPython 3.14.8 exists and is exactly what the previous CI run on this configuration resolved (run 999: "Using CPython 3.14.8", all sessions green, wheels present on PyPI for every dependency in the stack). The pin exists precisely because 3.15.0 — the unpinned resolution — has no ecosystem wheels and fails PyO3's supported-version check.
#150 (comment)
🔴 Pre-existing, untouched by this PR —
forge.tokenis the token context provided by the zhuiri runner on forge.marvin8.zone (wuming's ownci.ymluses the identical reference), and cang's reviews have run successfully with it for months — including this one.secrets.FORGEJO_TOKENdoes not exist in this repo's configuration.