Skip to content

Add AI-powered PR review workflow via docker/cagent-action #13659

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
glours merged 1 commit into from
Mar 23, 2026
+44 −0
Merged

Add AI-powered PR review workflow via docker/cagent-action #13659

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions .github/workflows/pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
name: PR Review

on:
pull_request_target:
types: [opened, ready_for_review]
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]

# Serialize reviews per PR; do not cancel in-progress runs
# so no review is silently dropped mid-execution.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: false

jobs:
review:
# Only run on the upstream repo (not forks) to prevent credential leaks.
# Skip draft PRs (ready_for_review will fire when promoted).
# Skip bot actors to avoid reviewing Dependabot and automation PRs.
# Require collaborator-level access for comment-triggered events.
# Only trigger on PR comments, not plain issue comments.
if: >-
github.repository == 'docker/compose' &&
Copy link

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fork-protection check github.repository == 'docker/compose' does not actually prevent runs on PRs opened from forks (for pull_request_target, github.repository is always the base repo). Since this workflow passes secrets to a reusable workflow, it should also gate on the PR head repo (e.g., ensure github.event.pull_request.head.repo.full_name == github.repository / head.repo.fork == false) to avoid exposing secrets to untrusted fork PRs.

Suggested change
github.repository == 'docker/compose' &&
github.repository == 'docker/compose' &&
(github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository) &&

Copilot uses AI. Check for mistakes.
(github.event_name != 'pull_request_target' || github.event.pull_request.draft == false) &&
(github.event_name == 'pull_request_target' ||
Comment on lines +25 to +27
Copy link

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description says draft PRs are filtered out, but the draft check is only applied for pull_request_target. The comment-triggered paths (issue_comment / pull_request_review_comment) can still run on draft PRs. If drafts should be excluded consistently, add a draft gate for comment events (likely requiring fetching PR details via the API/reusable workflow) or adjust the triggers accordingly.

Copilot uses AI. Check for mistakes.
(github.event_name == 'issue_comment' &&
github.event.issue.pull_request &&
contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
(github.event_name == 'pull_request_review_comment' &&
contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))) &&
!endsWith(github.actor, '[bot]')
uses: docker/cagent-action/.github/workflows/review-pr.yml@3a12dbd0c6cd7dda3d4e05f24f0143c9701456de # v1.2.13
secrets:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
CAGENT_ORG_MEMBERSHIP_TOKEN: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }}
CAGENT_REVIEWER_APP_ID: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
CAGENT_REVIEWER_APP_PRIVATE_KEY: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}
permissions:
contents: read # to fetch code
pull-requests: write # to post review comments
issues: write # to reply to issue/PR comments
checks: write # to update check statuses
Loading