Migrate PR review to openrouter with pinned 0.11.0 action #49
No reviewers
Labels
No labels
bug
contribution welcome
duplicate
enhancement
good first issue
help wanted
invalid
question
upstream
No milestone
No assignees
3 participants
Notifications
Due date
No due date set.
Reference
marvin8/zaojun!49
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/issue-92-openrouter-review"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Migrates the wuming PR review to the openrouter backend with the fleet-standard two-tier model mapping (code/tests/performance on deepseek-v4-pro, security on kimi-k2-thinking, config/docs/shell on qwen3.7-flash) and pins the action to
0.11.0.Tracking: marvin8/wuming#92
WuMing
Found 1 issue(s). See inline comments below.
@ -19,1 +18,3 @@agents: code:deepseek-v4-pro,config:deepseek-v4-flash,docs:deepseek-v4-flash,shell:deepseek-v4-flash,security:deepseek-v4-pro,tests:deepseek-v4-flashopenrouter_key: ${{ secrets.wuming_openrouter_key }}backend: openrouteragents: code:deepseek/deepseek-v4-pro,config:qwen/qwen3.7-flash,docs:qwen/qwen3.7-flash,shell:qwen/qwen3.7-flash,security:moonshotai/kimi-k2-thinking,tests:deepseek/deepseek-v4-proconfig [MEDIUM]
The PR description explicitly states that the
performancerole should also map todeepseek-v4-pro, but this role is omitted from theagentsstring. This will cause the workflow to error or skip when evaluating performance files. Add,performance:deepseek/deepseek-v4-proto complete the model mapping.#49 (comment)
🔴 Intentional — zaojun did not run a
performanceagent before this migration, and each repo's existing agent set is preserved. The fleet mapping assigns a model to whichever agents a repo runs; it does not add agents. The workflow will not error or skip: theagentsstring simply doesn't includeperformance, so no performance review runs, exactly as before the migration.8e25eb18697fc98866abWuMing
Found 1 issue(s). See inline comments below.
@ -49,2 +48,2 @@"ty~=0.0.84","uv~=0.12.23","ruff~=0.16.10","ty~=0.0.85",config [MEDIUM]
Version constraint drift:
ty~=0.0.85inpyproject.tomldoes not match the pinned version0.0.88inpylock.tomland.pre-commit-config.yaml. While technically compatible under PEP 440, this misalignment creates unnecessary ambiguity and risks future resolution conflicts. Update the constraint toty~=0.0.88to strictly align with the lockfile.#49 (comment)
🔴 Intentional per the project's dependency policy:
ty~=0.0.85is the zaojun-chosen aged version (0.0.88 was too_new at scan time — under the 7-day quarantine), anduv lockmay resolve a newer patch within the~=range — the lockfile tracking 0.0.88 is by design, not drift. The pre-commit rev likewise intentionally tracks the pyproject-chosen version; pre-commit maintains its own isolated environments, so the rev does not need to match the installed version exactly.WuMing
Found 3 issue(s). See inline comments below.
@ -15,3 +15,3 @@- uses: https://forge.marvin8.zone/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0with:forgejo_token: ${{ forge.token }}security [CRITICAL]
A02/A05: Potential secret exposure via non-standard context syntax ${{ forge.token }}. Secrets must use ${{ secrets.NAME }} context. Using custom contexts can expose tokens to pull request workflows, allowing attackers to extract credentials via malicious PR commands or logs.
@ -19,1 +18,3 @@agents: code:deepseek-v4-pro,config:deepseek-v4-flash,docs:deepseek-v4-flash,shell:deepseek-v4-flash,security:deepseek-v4-pro,tests:deepseek-v4-flashopenrouter_key: ${{ secrets.wuming_openrouter_key }}backend: openrouteragents: code:deepseek/deepseek-v4-pro,config:qwen/qwen3.7-flash,docs:qwen/qwen3.7-flash,shell:qwen/qwen3.7-flash,security:moonshotai/kimi-k2-thinking,tests:deepseek/deepseek-v4-proconfig [HIGH]
The PR description explicitly maps 'performance' to 'deepseek-v4-pro', but the agents string on this line is missing the 'performance' entry. This will likely cause performance-related PR reviews to be skipped or trigger unexpected fallback behavior. Add 'performance:deepseek/deepseek-v4-pro,' to the list.
@ -27,3 +27,3 @@- repo: https://github.com/astral-sh/uv-pre-commitrev: "0.12.23"rev: "0.13.1"security [HIGH]
A06/A08: uv-pre-commit v0.13.1 is incompatible with uv dependency (~0.12.24) in pyproject.toml line 50. Major version mismatch can bypass integrity checks and cause inconsistent security scanning between local pre-commit hooks and CI environment.
#49 (comment)
🔴 Intentional — zaojun did not run a
performanceagent before this migration, and each repo's existing agent set is preserved. The fleet mapping assigns a model to whichever agents a repo runs; it does not add agents.#49 (comment)
🔴 Pre-existing, untouched by this PR —
forge.tokenis the token context provided by the zhuiri runner on forge.marvin8.zone (wuming's ownci.ymluses the identical reference), and zaojun's reviews have run successfully with it for months — including the review that produced this finding. On this single-maintainer forge, PR branches originate from the maintainer's own repos, so there is no untrusted fork vector for the described exfiltration scenario.#49 (comment)
🔴 Declined (fleet-wide maintainer decision): tag pinning keeps wuming release updates a one-line change per consumer repo. The repointed-tag threat requires write access to the wuming repo itself — a single-maintainer repo on this forge.