Migrate PR review to openrouter with pinned 0.11.0 action #30
marvin8
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/issue-91-openrouter-review"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Migrates the wuming PR review to the openrouter backend with the fleet-standard two-tier model mapping (code/tests/performance on deepseek-v4-pro, security on kimi-k2-thinking, config/docs/shell on qwen3.7-flash) and pins the action to
0.11.0.Tracking: marvin8/wuming#91
3c6e565b271575026d7bWuMing
Found 1 issue(s). See inline comments below.
@ -12,3 +12,3 @@- repo: https://github.com/astral-sh/ruff-pre-commitrev: v0.16.5rev: v0.17.1config [MEDIUM]
Version mismatch detected: the pre-commit hook is pinned to ruff v0.17.1, while pyproject.toml and pylock.toml constrain/install ruff~=0.16.10. This divergence can cause linting results to differ between local pre-commit hooks and the virtual environment, leading to inconsistent checks. Align the versions by updating pyproject.toml to ruff~=0.17.1 or downgrading the pre-commit hook to match the lockfile.
#30 (comment)
✅ Fixed in commit
3edb36f— the ruff (and ty/uv) hook revs are aligned with the pyproject-chosen versions (ruff~=0.16.10,ty~=0.0.85,uv~=0.12.24), matching the fleet-wide hook-alignment policy.WuMing
Found 2 issue(s). See inline comments below.
@ -22,3 +22,3 @@- repo: https://github.com/astral-sh/ty-pre-commitrev: v0.0.75rev: v0.0.85config [MEDIUM]
Version drift: The pre-commit hook for 'ty' is pinned to v0.0.85, while the project's pylock.toml and pyproject.toml reference/update to v0.0.88. Update the pre-commit revision to v0.0.88 to ensure consistent type-checking rules and behavior across local and CI environments.
@ -80,0 +79,4 @@"anyio>=4.14.2","httpcore2>=2.10.0","httpx2>=2.12.0","pymdown-extensions>=11.0", # Addresses PYSEC-2026-3609,config [CRITICAL]
Invalid TOML syntax: a trailing comma appears after the inline comment. TOML parsers will treat the '#' as starting a comment that consumes the rest of the line, leaving the trailing comma as a standalone token, which causes a parse error during
uv syncor validation. Move the array separator comma before the comment.#30 (comment)
The comma sits inside the comment, so the TOML was always parseable (tomllib, uv, and this PR's green CI all confirm) — but it was untidy, a leftover from the constraint-merge. ✅ Removed in the latest push.
#30 (comment)
🔴 Intentional per the fleet's dependency policy: the hook rev tracks the pyproject-chosen version (
ty~=0.0.85, the zaojun-aged pick — 0.0.88 was too_new at scan time under the 7-day quarantine), while pylock resolving 0.0.88 within the~=range is by design. pre-commit maintains its own isolated environments, so the rev does not need to match the installed version.WuMing
Found 2 issue(s). See inline comments below.
@ -13,3 +13,3 @@if: github.event_name == 'pull_request'steps:- uses: https://forge.marvin8.zone/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0security [MEDIUM]
A06: Pinning to a specific action version is good practice, but ensure the version is regularly updated. However, using a mutable tag '0.11.0' instead of a full commit SHA could allow supply chain attacks if the tag is moved. Consider using full commit SHA for stronger integrity guarantees.
@ -76,5 +76,10 @@ check-licenses = true[tool.uv]constraint-dependencies = ["anyio>=4.14.2", # PYSEC-2026-4025 (CRITICAL)security [CRITICAL]
A06: Constraint dependency comments reference future-dated PYSEC vulnerabilities (e.g., PYSEC-2026-4025). This indicates the vulnerability database entries may not exist yet or dates are incorrect, potentially masking real vulnerabilities. Verify CVE identifiers and dates are accurate before merging.
#30 (comment)
🔴 Declined (fleet-wide maintainer decision, consistent with the identical findings across this migration): tag pinning keeps wuming release updates a one-line change per consumer repo. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this self-hosted forge.
#30 (comment)
🔴 Factually incorrect — the current date is October 2026, and the cited identifiers are not future-dated:
PYSEC-2026-4025(anyio, CRITICAL) and its siblings come verbatim from this PR's ownpysentryCI run, which merged vulnerability data from three advisory sources and reported them against the scanned lockfile. The comments cite the exact advisories pysentry flagged; nothing is masked.