1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# ⚠️ SECURITY WARNING
#
# `pull_request_target` runs in the context of the BASE branch and has
# access to repository secrets. Only use this workflow if:
#
# 1. You trust all contributors with push access to forks, OR
# 2. You do not execute untrusted code (rs-guard only analyzes diffs,
# it does not build or run the PR code), OR
# 3. You restrict execution to organization members (see `if:` condition).
#
# For public repos that accept untrusted forks, consider using the standard
# `pull_request` event with a comment-based trigger instead.
name: AI Code Review (Fork-Safe)
on:
pull_request_target:
types:
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
cancel-in-progress: true
jobs:
review:
# Only run for non-draft PRs from the same repository.
# For trusted external contributors, add them to a team and adjust this condition.
if: |
github.event.pull_request.draft == false &&
github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
# Checkout the BASE branch (not the PR branch) for security.
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.base.sha }}
# Download rs-guard v1.0.0 and verify its SHA-256.
# The integrity check warns (but does not fail) if the checksums
# file is missing from the release.
- name: Download rs-guard
run: |
set -euo pipefail
curl -L --fail -o rs-guard-x86_64-unknown-linux-gnu \
https://github.com/nebulaideas/rs-guard/releases/download/v1.0.0/rs-guard-x86_64-unknown-linux-gnu
if curl -fsSL -o rs-guard-x86_64-unknown-linux-gnu.sha256 \
https://github.com/nebulaideas/rs-guard/releases/download/v1.0.0/rs-guard-x86_64-unknown-linux-gnu.sha256; then
sha256sum -c rs-guard-x86_64-unknown-linux-gnu.sha256
else
echo "::warning::No .sha256 file published for this release; skipping integrity check."
fi
chmod +x rs-guard-x86_64-unknown-linux-gnu
mv rs-guard-x86_64-unknown-linux-gnu rs-guard
- name: AI Code Review
run: ./rs-guard
env:
DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
REPO_FULL_NAME: ${{ github.repository }}