Enable code review - #1
Open
polaris-reviewer[bot] wants to merge 2 commits into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable code review
This PR wires up the code-reviewer GitHub App. It adds two files:
.github/workflows/code-reviewer.yml— runs the reviewer on every pull request.The action is pinned to an immutable commit SHA (
ckorhonen/code-reviewer@aeaffe6b9d61755f8b08486ad4b6915e3ae3bc23)so what runs on your code never changes without a reviewable bump.
.code-reviewer.yml— a starter configuration you can tune later.What runs, and where
The review runs entirely on your GitHub Actions runner. Your code and
diffs are read on the runner and are never sent to our servers. When the
review finishes, the Action optionally uploads a metadata-only envelope
(finding severities, file paths + line numbers, precision scores, model
health, and content hashes — never source, diffs, prompts, or raw model
output) authenticated with a short-lived GitHub Actions OIDC token.
Permissions this workflow requests
contents: read— check out the PR to review it.pull-requests: write— post the review summary comment.id-token: write— mint the OIDC token that authenticates themetadata upload (no long-lived credentials are stored).
Envelope upload is opt-in and additive — merging this PR changes no
existing behavior for SHA-pinned or fork-at-main consumers.