[PR #227] add automated PR review workflow with read-only token #402

New issue

Open

opened 2026-05-06 12:39:38 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:38 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/227
Author: @elithrar
Created: 3/2/2026
Status: 🔄 Open

Base: main ← Head: feat/auto-pr-review

📝 Commits (4)

1bc6b61 add automated PR review workflow with read-only token
3c9d8fa harden auto-review: base branch checkout, drop install, no approve
ab0fd10 harden reviewer agents: fix permissions, env var, prompt structure
61a39fb Used NO_PUSH — no PUSH_ONLY preset.

📊 Changes

3 files changed (+157 additions, -6 deletions)

View changed files

➕ .github/workflows/new-pr-review.yml (+46 -0)
➕ .opencode/agents/auto-reviewer.md (+102 -0)
📝 .opencode/agents/reviewer.md (+9 -6)

📄 Description

Every PR currently requires a manual /bonk invocation for AI review. This adds an automated review that runs on every new PR, using a read-only scoped token so the reviewer agent physically cannot push code.

Depends on ask-bonk/ask-bonk#138 which adds the token_permissions input.

.github/workflows/new-pr-review.yml — triggers on pull_request: [opened], uses token_permissions: READ_ONLY to scope the installation token to read-only (can comment/review, cannot push), runs the reviewer agent with Kimi K2, skips bot/dependabot PRs, 15min timeout
.github/bonk_reviewer.md — hardened reviewer prompt with anti-injection anchoring (system boundary at top and bottom), vinext-specific review checklist (server parity, RSC/SSR boundary, Next.js compat), clear read-only constraints

# The key security line:
token_permissions: READ_ONLY
# Results in: { contents: "read", issues: "write", pull_requests: "write", metadata: "read" }

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/227 **Author:** [@elithrar](https://github.com/elithrar) **Created:** 3/2/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/auto-pr-review` --- ### 📝 Commits (4) - [`1bc6b61`](https://github.com/cloudflare/vinext/commit/1bc6b6171ec6921beab849735583dee12273078f) add automated PR review workflow with read-only token - [`3c9d8fa`](https://github.com/cloudflare/vinext/commit/3c9d8fae8705efab721b988928a054fdb555d518) harden auto-review: base branch checkout, drop install, no approve - [`ab0fd10`](https://github.com/cloudflare/vinext/commit/ab0fd10887fa409bd3cbf5e65572e3a5f3fbc6cb) harden reviewer agents: fix permissions, env var, prompt structure - [`61a39fb`](https://github.com/cloudflare/vinext/commit/61a39fbcbc5a15c74637e137aa9c6fc3c018be5e) Used `NO_PUSH` — no `PUSH_ONLY` preset. ### 📊 Changes **3 files changed** (+157 additions, -6 deletions) <details> <summary>View changed files</summary> ➕ `.github/workflows/new-pr-review.yml` (+46 -0) ➕ `.opencode/agents/auto-reviewer.md` (+102 -0) 📝 `.opencode/agents/reviewer.md` (+9 -6) </details> ### 📄 Description Every PR currently requires a manual `/bonk` invocation for AI review. This adds an automated review that runs on every new PR, using a read-only scoped token so the reviewer agent physically cannot push code. Depends on ask-bonk/ask-bonk#138 which adds the `token_permissions` input. - `.github/workflows/new-pr-review.yml` — triggers on `pull_request: [opened]`, uses `token_permissions: READ_ONLY` to scope the installation token to read-only (can comment/review, cannot push), runs the `reviewer` agent with Kimi K2, skips bot/dependabot PRs, 15min timeout - `.github/bonk_reviewer.md` — hardened reviewer prompt with anti-injection anchoring (system boundary at top and bottom), vinext-specific review checklist (server parity, RSC/SSR boundary, Next.js compat), clear read-only constraints ```yaml # The key security line: token_permissions: READ_ONLY # Results in: { contents: "read", issues: "write", pull_requests: "write", metadata: "read" } ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>