ci: AI code review on PRs (self-hosted, claude -p, advisory)#1037
Closed
EmersonBraun wants to merge 1 commit into
Closed
ci: AI code review on PRs (self-hosted, claude -p, advisory)#1037EmersonBraun wants to merge 1 commit into
EmersonBraun wants to merge 1 commit into
Conversation
Runs the AgentsKit code-review agent locally on a self-hosted runner via claude -p (subscription, no per-call API cost). Advisory — posts a review, never blocks. Guarded to non-fork PRs only (head.repo == repo) so untrusted fork code never runs on the self-hosted runner.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Member
Author
|
Moving the PR-gate to the private agentskit-os repo (no fork-RCE surface there → covers all PRs). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runs the AgentsKit code-review agent on every PR — locally on a self-hosted runner via
claude -p(subscription, no per-call API cost). Advisory: posts an inline + summary review, never fails the check.Safety
if: github.event.pull_request.head.repo.full_name == github.repository— only non-fork PRs (branches in this repo). Fork PRs are skipped so untrusted fork code never executes on the self-hosted runner.run:step is a staticPATHecho; no untrusted input is interpolated into a shell.Requires
self-hosted) — registered.CLAUDE_CODE_OAUTH_TOKEN(fromclaude setup-token) at repo or org level.Tune
max-files/block; flipfail-on-block: 'true'later to gate merges. This PR itself (a same-repo branch) will be reviewed by the agent once merged + on its next push.