Migrate PR review to openrouter with pinned 0.11.0 action #66
No reviewers
Labels
No labels
bug
contribution welcome
duplicate
enhancement
good first issue
help wanted
invalid
question
upstream
No milestone
No assignees
3 participants
Notifications
Due date
No due date set.
Reference
marvin8/fedinesia!66
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/issue-94-openrouter-review"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Migrates the wuming PR review to the openrouter backend with the fleet-standard two-tier model mapping (code/tests/performance on deepseek-v4-pro, security on kimi-k2-thinking, config/docs/shell on qwen3.7-flash) and pins the action to
0.11.0.Tracking: marvin8/wuming#94
3a8799edaaf6914f0e58WuMing
Found 1 issue(s). See inline comments below.
@ -13,3 +13,3 @@if: github.event_name == 'pull_request'steps:- uses: https://forge.marvin8.zone/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0security [HIGH]
A08: The action reference uses a mutable version tag (@0.11.0) rather than an immutable commit SHA. Tags can be force-moved or deleted by attackers, enabling supply chain compromise where malicious code is executed in the CI pipeline. Pin to a full-length commit SHA and optionally include a comment indicating the version (e.g., uses: https://forge.marvin8.zone/marvin8/wuming@abc123... # v0.11.0).
#66 (comment)
🔴 Declined (fleet-wide maintainer decision, same content-hash finding already declined across this migration — arvak, rainlog, zaojun, kokopelli, feed2fedi, archiving_imap, cang): tag pinning was chosen so a wuming release update stays a one-line change per repo across ~17 consumer repos. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this forge. SHA pinning is the right follow-up only if that trust boundary grows.