From 71046366c36e9f2136ff93bbd39ab9da4a40259f Mon Sep 17 00:00:00 2001 From: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Date: Sat, 25 Jul 2026 18:43:19 +0200 Subject: [PATCH 1/6] chore(ci): opt in to the PR-Agent third reviewer (pilot) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds the caller for cuioss-organization's reusable-pr-agent-review.yml (v0.14.0), making this repo one of the two pilot repos for the org's third automated reviewer — open-source PR-Agent on Google Gemini, beside CodeRabbit and Sourcery. This is the Java/Maven half of the pilot. Nothing is configured here: review tuning is central in cuioss/pr-agent-settings, and the org skip rules (dependabot[bot], cuioss-release-bot[bot], the skip-bot-review label, fork PRs) live in the reusable workflow's job-level if: guard. Co-Authored-By: Claude --- .github/workflows/pr-agent.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/workflows/pr-agent.yml diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml new file mode 100644 index 00000000..39449feb --- /dev/null +++ b/.github/workflows/pr-agent.yml @@ -0,0 +1,28 @@ +# Third automated PR reviewer (PR-Agent on Google Gemini), beside CodeRabbit and Sourcery. +# +# All review tuning is central in cuioss/pr-agent-settings (.pr_agent.toml) — nothing is +# configured here. The org skip rules (dependabot[bot], cuioss-release-bot[bot], the +# skip-bot-review label, fork PRs) are enforced by the reusable workflow's job-level `if:` +# guard, because PR-Agent's own ignore_pr_* settings are inert in GitHub Action mode. +# +# See https://github.com/cuioss/pr-agent-settings/blob/main/README.adoc + +name: PR Agent Review + +on: + pull_request: + types: [opened, reopened, ready_for_review] + # On-demand commands (/review, /ask, /improve, /help). Also how a re-review is requested + # after pushing fixes — there is deliberately no automatic re-review on every push. + issue_comment: + types: [created] + +permissions: + contents: read + pull-requests: write + issues: write + +jobs: + review: + uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@830c2dd2ffe4850be37c5faa0a0d112713dfd7e3 # v0.14.0 + secrets: inherit From 5ec5c406ee2747266d9ea02d30ac7291dcb4e65f Mon Sep 17 00:00:00 2001 From: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Date: Sat, 25 Jul 2026 19:06:42 +0200 Subject: [PATCH 2/6] chore(ci): pin the reviewer workflow at v0.14.1 v0.14.1 carries the published-review fail-closed gate: PR-Agent's action exits 0 even when every model call fails, so v0.14.0 would report a green check with no review posted. Co-Authored-By: Claude --- .github/workflows/pr-agent.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index 39449feb..ce66db80 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -24,5 +24,5 @@ permissions: jobs: review: - uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@830c2dd2ffe4850be37c5faa0a0d112713dfd7e3 # v0.14.0 + uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@19d5894332b91eb52396659568933c4a751346a4 # v0.14.1 secrets: inherit From 4b672fa1a5804ad238a55c1292074eb509669da6 Mon Sep 17 00:00:00 2001 From: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Date: Sat, 25 Jul 2026 21:46:01 +0200 Subject: [PATCH 3/6] =?UTF-8?q?chore(ci):=20Vertex=20AI=20reviewer=20?= =?UTF-8?q?=E2=80=94=20grant=20id-token:=20write,=20pin=20v0.15.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.15.0 moves the reviewer from AI Studio to Gemini on Vertex AI with Workload Identity Federation: keyless, and it draws on the GCP free-trial credits. The caller must grant id-token: write so the job can mint the OIDC token the federation exchanges for short-lived GCP credentials. Co-Authored-By: Claude --- .github/workflows/pr-agent.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index ce66db80..63224195 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -21,8 +21,11 @@ permissions: contents: read pull-requests: write issues: write + # Required: mints the OIDC token Workload Identity Federation exchanges for the short-lived + # GCP credentials the reviewer uses to reach Gemini on Vertex AI. + id-token: write jobs: review: - uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@19d5894332b91eb52396659568933c4a751346a4 # v0.14.1 + uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@0f9c794859ef77d2780f10a27054b45b3dd98d71 # v0.15.0 secrets: inherit From 17da4428269bcf76ede50d4e3c7f82ccefdb80b2 Mon Sep 17 00:00:00 2001 From: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Date: Sat, 25 Jul 2026 22:53:35 +0200 Subject: [PATCH 4/6] chore(ci): pin the reviewer workflow at v0.15.1 v0.15.1 drops the AI Studio passthrough: with GEMINI_API_KEY deleted it advertised a fallback route that could not work. REVIEW_APP_ID and REVIEW_APP_PRIVATE_KEY are now the reviewer's only secrets. Co-Authored-By: Claude --- .github/workflows/pr-agent.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index 63224195..f185a078 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -27,5 +27,5 @@ permissions: jobs: review: - uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@0f9c794859ef77d2780f10a27054b45b3dd98d71 # v0.15.0 + uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@b07a4047beb44dd11a9d6e11ab3cf1963aa4a010 # v0.15.1 secrets: inherit From 74817158d81d4a31a3f39b844224ed655627363b Mon Sep 17 00:00:00 2001 From: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Date: Sun, 26 Jul 2026 00:15:08 +0200 Subject: [PATCH 5/6] chore(ci): pin the reviewer workflow at v0.15.2 v0.15.2 keys the fail-closed gate on the reviewer step's structured output rather than a published comment: a clean review publishes nothing by design, which the previous gate wrongly treated as failure. Co-Authored-By: Claude --- .github/workflows/pr-agent.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index f185a078..0d00f23f 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -27,5 +27,5 @@ permissions: jobs: review: - uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@b07a4047beb44dd11a9d6e11ab3cf1963aa4a010 # v0.15.1 + uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@83b3ab36e40dedbeda0ee74ac71876183b70b649 # v0.15.2 secrets: inherit From df4c67771ab4b7dd3ca1446f32b5ea393da069e1 Mon Sep 17 00:00:00 2001 From: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Date: Sun, 26 Jul 2026 09:15:51 +0200 Subject: [PATCH 6/6] chore(ci): least-privilege secrets, pin v0.15.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maps REVIEW_APP_ID and REVIEW_APP_PRIVATE_KEY explicitly instead of secrets: inherit — those two are the whole requirement now that Vertex AI is keyless, and inherit exposed every secret this repo can see to the called workflow. CodeRabbit finding on this PR. v0.15.3 also gates command-triggered runs (/review and friends) on author_association: an issue_comment event runs with full secrets and the OIDC token even for a fork's PR, so the trigger is now restricted to OWNER/MEMBER/COLLABORATOR. Co-Authored-By: Claude --- .github/workflows/pr-agent.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index 0d00f23f..0db59a44 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -27,5 +27,10 @@ permissions: jobs: review: - uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@83b3ab36e40dedbeda0ee74ac71876183b70b649 # v0.15.2 - secrets: inherit + uses: cuioss/cuioss-organization/.github/workflows/reusable-pr-agent-review.yml@ab447694b019d30edc56f2ff7c5100ba731ca590 # v0.15.3 + # Map only what the reviewer needs. `secrets: inherit` would hand it every secret this + # repo can see (GPG keys, Sonatype credentials, SONAR_TOKEN, …) for no reason; these two + # are the whole requirement, because Vertex AI is reached keylessly. + secrets: + REVIEW_APP_ID: ${{ secrets.REVIEW_APP_ID }} + REVIEW_APP_PRIVATE_KEY: ${{ secrets.REVIEW_APP_PRIVATE_KEY }}