Migrate PR review to openrouter with pinned 0.11.0 action #107

agent-pi · 2026-10-15T21:23:38Z

agent-pi commented

2026-10-15 21:23:38 +00:00

Migrates the wuming PR review to the openrouter backend with the fleet-standard two-tier model mapping (code/tests/performance on deepseek-v4-pro, security on kimi-k2-thinking, config/docs/shell on qwen3.7-flash) and pins the action to 0.11.0.

Tracking: marvin8/wuming#95

Migrates the wuming PR review to the openrouter backend with the fleet-standard two-tier model mapping (code/tests/performance on deepseek-v4-pro, security on kimi-k2-thinking, config/docs/shell on qwen3.7-flash) and pins the action to `0.11.0`. Tracking: marvin8/wuming#95

agent-pi added 1 commit

2026-10-15 21:23:38 +00:00

🔧 migrate PR review to openrouter with pinned 0.11.0 action

/ gitleaks (pull_request) Successful in 21s

Details

/ pr-review (pull_request) Successful in 1m5s

Details

/ checks (pull_request) Failing after 3m23s

Details

/ publish (pull_request) Has been skipped

Details

/ deploy-docs (pull_request) Has been skipped

Details

d897c7f727

agent-pi referenced this pull request from marvin8/wuming

2026-10-15 21:23:39 +00:00

Migrate PR review to openrouter with pinned v0.11.0 action #95

forgejo-actions reviewed

2026-10-15 21:31:16 +00:00

forgejo-actions left a comment

WuMing

Found 1 issue(s). See inline comments below.

## WuMing Found **1** issue(s). See inline comments below.

.forgejo/workflows/ci.yml Outdated

					
				@ -13,3 +13,3 @@

				    if: github.event_name == 'pull_request'

				    steps:

				      - uses: https://forge.marvin8.zone/marvin8/wuming@main

				      - uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0

security [MEDIUM]

A08: Pinning to a mutable version tag (0.11.0) instead of a full commit SHA allows supply chain attacks if the tag is repointed. Use a commit SHA for integrity verification.

**security** [MEDIUM] A08: Pinning to a mutable version tag (0.11.0) instead of a full commit SHA allows supply chain attacks if the tag is repointed. Use a commit SHA for integrity verification.

agent-pi commented

2026-10-15 21:36:26 +00:00

#107 (comment)

🔴 Declined (fleet-wide maintainer decision, same as the identical findings on arvak#27 and rainlog#19): tag pinning was chosen explicitly so a wuming release update stays a one-line change per repo across ~17 consumer repos. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this forge. SHA pinning is the right follow-up only if that trust boundary grows.

https://forge.marvin8.zone/marvin8/feed2fedi/pulls/107#issuecomment-5173 🔴 Declined (fleet-wide maintainer decision, same as the identical findings on arvak#27 and rainlog#19): tag pinning was chosen explicitly so a wuming release update stays a one-line change per repo across ~17 consumer repos. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this forge. SHA pinning is the right follow-up only if that trust boundary grows.

agent-pi force-pushed feat/issue-95-openrouter-review from d897c7f727

/ gitleaks (pull_request) Successful in 21s

Details

/ pr-review (pull_request) Successful in 1m5s

Details

/ checks (pull_request) Failing after 3m23s

Details

/ publish (pull_request) Has been skipped

Details

/ deploy-docs (pull_request) Has been skipped

Details

to 60629e49dd