Migrate PR review to openrouter with pinned 0.11.0 action #39
marvin8
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/issue-90-openrouter-review"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Migrates the wuming PR review to the openrouter backend with the fleet-standard two-tier model mapping (code/tests/performance on deepseek-v4-pro, security on kimi-k2-thinking, config/docs/shell on qwen3.7-flash) and pins the action to
0.11.0.Tracking: marvin8/wuming#90
f9f1376688a32f4559e7WuMing
Found 1 issue(s). See inline comments below.
@ -19,1 +18,3 @@agents: code:deepseek-v4-pro,config:deepseek-v4-flash,docs:deepseek-v4-flash,shell:deepseek-v4-flash,security:deepseek-v4-pro,tests:deepseek-v4-flashopenrouter_key: ${{ secrets.wuming_openrouter_key }}backend: openrouteragents: code:deepseek/deepseek-v4-pro,config:qwen/qwen3.7-flash,docs:qwen/qwen3.7-flash,shell:qwen/qwen3.7-flash,security:moonshotai/kimi-k2-thinking,tests:deepseek/deepseek-v4-proconfig [MEDIUM]
The PR description explicitly documents a two-tier model mapping that includes 'performance' alongside 'code' and 'tests' for deepseek-v4-pro, but the
agentslist here omits theperformanceentry. Addperformance:deepseek/deepseek-v4-proto align the configuration with the stated review scope.#39 (comment)
🔴 Intentional — sub2pod did not run a
performanceagent before this migration, and each repo's existing agent set is preserved. The fleet mapping assigns a model to whichever agents a repo runs; it does not add agents. No performance review ran before this change and none runs after.WuMing
Found 3 issue(s). See inline comments below.
@ -12,3 +12,3 @@- repo: https://github.com/astral-sh/ruff-pre-commitrev: v0.16.5rev: v0.17.1config [MEDIUM]
Version conflict with pyproject.toml: pre-commit specifies ruff v0.17.1, but pyproject.toml dev dependency restricts ruff to ~=0.16.10 (<0.17.0). Update pyproject.toml or pre-commit to align versions and avoid toolchain discrepancies.
@ -27,3 +27,3 @@- repo: https://github.com/astral-sh/uv-pre-commitrev: 0.12.7rev: "0.13.1"config [MEDIUM]
Version conflict with pyproject.toml: pre-commit specifies uv 0.13.1, but pyproject.toml dev dependency restricts uv to ~=0.12.24 (<0.13.0). Align versions across the project to ensure consistent locking and caching behavior.
@ -69,0 +68,4 @@"anyio>=4.14.2","httpcore2>=2.10.0","httpx2>=2.12.0","pydantic-settings>=2.14.2", # GHSA-4xgf-cpjx-pc3j,config [LOW]
Non-standard TOML syntax: A trailing comma appears after the inline comment (
# GHSA-4xgf-cpjx-pc3j,). TOML comments terminate the line, making the comma redundant and potentially problematic for strict parsers. Remove the trailing comma.WuMing
Found 6 issue(s). See inline comments below.
@ -13,3 +13,3 @@if: github.event_name == 'pull_request'steps:- uses: https://forge.marvin8.zone/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0security [MEDIUM]
A08: Uses a custom domain (forge.marvin8.zone) for the GitHub Action without apparent integrity verification beyond version pinning. This could be vulnerable to supply chain attacks if the domain is compromised. Consider verifying the action's cryptographic signatures or using GitHub's official marketplace.
@ -19,1 +18,3 @@agents: code:deepseek-v4-pro,config:deepseek-v4-flash,docs:deepseek-v4-flash,shell:deepseek-v4-flash,security:deepseek-v4-pro,tests:deepseek-v4-flashopenrouter_key: ${{ secrets.wuming_openrouter_key }}backend: openrouteragents: code:deepseek/deepseek-v4-pro,config:qwen/qwen3.7-flash,docs:qwen/qwen3.7-flash,shell:qwen/qwen3.7-flash,security:moonshotai/kimi-k2-thinking,tests:deepseek/deepseek-v4-proconfig [LOW]
The 'agents' map omits 'performance', which is explicitly mentioned in the PR description ('code/tests/performance on deepseek-v4-pro'). If this omission is intentional, you can disregard it. Otherwise, add the missing agent to ensure full coverage.
@ -15,3 +15,2 @@dependencies = ["cyclopts~=4.23.3","lxml~=6.1.2","cyclopts~=5.2.0",security [MEDIUM]
A06: Major version bump of cyclopts from 4.23.3 to 5.2.0 may introduce new vulnerabilities or breaking security changes. Review the changelog for security-related changes and verify no known CVEs exist in this version.
@ -21,3 +21,3 @@dev = ["bump-my-version~=1.5.1","complexipy~=7.0.1","complexipy~=8.0.1",security [MEDIUM]
A06: Major version bump of complexipy from 7.0.1 to 8.0.1 may introduce new vulnerabilities. This tool analyzes code complexity and could be exploited if malicious. Verify this version has no known security issues and review its changes.
@ -31,3 +31,2 @@"tryke~=0.0.30","ty~=0.0.75","uv~=0.12.7","ty~=0.0.85",config [MEDIUM]
The version constraint 'ty~=0.0.85' conflicts with the locked version '0.0.88' in pylock.toml. The compatible release specifier (~=) for 0.0.85 expands to >=0.0.85,<0.0.86, making 0.0.88 invalid. Update the constraint to ~=0.0.88 or regenerate the lockfile with explicit overrides.
security [LOW]
A06: Version specification ty~=0.0.85 does not match the updated lock file version 0.0.88, creating a version mismatch that could lead to dependency confusion or unexpected behavior.
#39 (comment)
✅ Already fixed in commit
810af1c— the ruff hook rev is aligned with the pyproject-chosenruff~=0.16.10(rev: v0.16.10), per the fleet-wide hook-alignment policy.#39 (comment)
✅ Already fixed in commit
810af1c— the uv hook rev is aligned with the pyproject-chosenuv~=0.12.24(rev: 0.12.24).#39 (comment)
✅ Fixed in commit
e020636— the stray trailing comma after the inline comment is removed.#39 (comment)
🔴 Intentional — sub2pod did not run a
performanceagent before this migration, and each repo's existing agent set is preserved. The fleet mapping assigns a model to whichever agents a repo runs; it does not add agents.#39 (comment)
🔴 Declined (fleet-wide maintainer decision, consistent with the identical findings across this migration): tag pinning keeps wuming release updates a one-line change per consumer repo. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this self-hosted forge.
#39 (comment)
🔴 Factually incorrect — PEP 440 compatible release
~=0.0.85expands to>=0.0.85, ==0.0.*, i.e. any 0.0.x — so the locked 0.0.88 is within the specifier, not a conflict. Evidence:uv lockresolved 0.0.88 underty~=0.0.85without a single warning, and CI is green.#39 (comment)
🔴 Same as the sibling finding —
~=0.0.85admits 0.0.88 (PEP 440:>=0.0.85, ==0.0.*), so there is no mismatch or dependency-confusion risk. The lockfile resolution is by design.#39 (comment)
🔴 Verified in CI on this very commit: the
pysentrysession scanned the resolved dependency set (including cyclopts 5.2.0) and reported zero known advisories, and the full tryke suite (3.12/3.13/3.14/3.14t) passes against cyclopts 5.x. No known CVEs exist for the bumped version.#39 (comment)
🔴 Verified in CI on this very commit: complexipy 8.0.1 runs successfully in the
complexipy-3.12session on the migrated stack, andpysentryreports zero known advisories for the resolved set including complexipy 8.0.1.