Triggering pr-review in ollama-pr-review with v1.0 tag

[sungeunbae]

This pull request introduces a new GitHub Actions workflow for automated AI code review. The workflow is triggered on pull request events and delegates the review process to an external workflow, using a secret API key for authentication.

Workflow automation:

• Added a new workflow file .github/workflows/pr-review.yml that triggers on pull request events (opened, synchronize, reopened) and calls the ucgmsim/ollama_pr_review workflow for AI-driven code review.
• Configured the workflow to use the OLLAMA_API_KEY secret for authentication with the external review service.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-actions]

🤖 AI Code Review (deepseek-v4-flash:cloud)

[github-actions]

📍 Line 8

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
👉   call-review:
    uses: ucgmsim/ollama_pr_review/.github/workflows/pr-review.yml@v1.0
    secrets:
      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}

⚠️ Problem: Using an external reusable workflow from an untrusted source. If the external repository is compromised, it could execute arbitrary code in the context of this repository, potentially exfiltrating secrets or modifying the codebase.

✅ Fix: Pin the workflow to a specific commit hash instead of a version tag for immutability, and thoroughly audit the external workflow's code. Alternatively, self-host the workflow to maintain control.

[github-actions]

📍 Line 9

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  call-review:
👉     uses: ucgmsim/ollama_pr_review/.github/workflows/pr-review.yml@v1.0
    secrets:
      OLLAMA_API_KEY: ${{ secrets.OLLAMA_API_KEY }}

⚠️ Problem: Passing a secret to an external reusable workflow exposes the secret to that workflow. If the external workflow is malicious or has a vulnerability, the secret could be leaked or misused.

✅ Fix: Avoid passing secrets to external workflows. If necessary, ensure the external workflow is fully trusted and consider using environment variables with restricted scope.

[github-actions]

📍 Line 3

name: AI Code Review

👉 on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  call-review:
    uses: ucgmsim/ollama_pr_review/.github/workflows/pr-review.yml@v1.0

⚠️ Problem: For pull requests from forks, GitHub does not pass secrets to workflows triggered by pull_request. This workflow uses a secret, so it will fail or behave unexpectedly for fork PRs, leading to inconsistent CI results.

✅ Fix: Use pull_request_target event (with caution) to allow secret access, or conditionally skip the job for fork PRs. Alternatively, handle the missing secret gracefully in the workflow.

[github-actions]

🤖 AI Code Review (deepseek-v4-flash:cloud)

Found 3 issues.

Diff size: 447 bytes
Truncated: false

See inline comments for details.

[Copilot]

Pull request overview

This PR adds a GitHub Actions workflow that runs on pull request events and delegates automated AI-driven review to a reusable workflow hosted in ucgmsim/ollama_pr_review, passing an OLLAMA_API_KEY secret for authentication.

Changes:

• Added a new pull_request-triggered workflow (opened, synchronize, reopened).
• Configured a reusable-workflow job that calls ucgmsim/ollama_pr_review and forwards OLLAMA_API_KEY.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.