Add REVIEW.md with automated PR review guidelines - #9
Closed
andypotanin wants to merge 2 commits into
Closed
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new root-level REVIEW.md intended to be auto-ingested by review agents, documenting repo-specific review policy for this GitHub Marketplace action (critical paths, contract expectations, conventions, and security focus areas).
Changes:
- Introduces
REVIEW.mdwith sections for critical areas, marketplace contract, conventions to enforce, and security review notes. - Encodes guidance intended to raise scrutiny on
action.yml, lifecycle resolution, state backend inputs, and credential/image handling.
Suppressed comments (2)
REVIEW.md:17
- This section also references consumers using
@v5, but current docs reference the maintained floating major tag as@v1.
- Consumers reference `@v5` (floating major). Any merged change lands on consumers immediately once the tag moves; review as if deploying to production.
REVIEW.md:24
- This says there are no workflows / no CI safety net, but the repo has CI and release verification workflows under
.github/workflows/that runmake testand actionlint. The current wording is factually incorrect and may lead reviewers to ignore CI signals.
- No workflows exist in this repo; there is no CI safety net. Review IS the test gate here, so be more thorough than usual: trace input flow end to end for every changed input.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -0,0 +1,29 @@ | |||
| # Review Guidelines - github-rabbit-action | |||
|
|
|||
| Public GitHub Marketplace composite action (`udx/github-rabbit-action`) that resolves environment/lifecycle, runs safety checks, then `docker run`s the R2A image (`usabilitydynamics/rabbit-automation-action`). `action.yml` is effectively the entire product; treat every change to it as production-facing for all consumers, who float on the `@v5` major tag. | |||
| - Safety checks in `action.yml` (manual-apply-to-production block and destroy-on-production block): any change that weakens, reorders, or adds bypasses to these checks is a production-destruction risk. Require explicit justification and a test/demo evidence link. | ||
| - Lifecycle resolution: `bin/merge-configs.sh`, `bin/lib/*.sh`, `src/configs/lifecycle-policy.yaml`. Production lifecycle must remain gated on protected branches; reject changes that let unprotected branches resolve to production. | ||
| - State backend inputs (`state_backend`, `state_backend_config`, `state_prefix_key`, `multi_repo`): wrong defaults or renames silently repoint or collide OpenTofu state across tenants. Renaming or changing the default of ANY input is a breaking change for marketplace consumers. | ||
| - Credential handling: AWS creds forwarded from env; GCP creds are copied into the workspace as `gcp-credentials.json`. Watch for changes that widen the credential surface (new copies, echoing env, credentials reaching uploaded artifacts or logs). |
|
|
||
| ## Conventions to Enforce | ||
|
|
||
| - Every `run:` step uses `shell: bash` with `set -euo pipefail`. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (2)
REVIEW.md:24
- This rule is written as an absolute (“rather than inlining … inside script bodies”), but the repo already has at least one safe inline expression inside a run block for informational output (step summary). As written, reviewers could flag existing patterns as violations; tightening the wording to focus on shell logic / untrusted input interpolation would better match the current action.yml practices.
- Pass GitHub expressions to steps via `env:` rather than inlining `${{ }}` inside script bodies (script injection risk on inputs and branch names).
REVIEW.md:10
- The repo’s public API/docs consistently refer to “Terraform state” (e.g., action.yml input descriptions), but this guideline calls it “OpenTofu state”. That mismatch may confuse reviewers/callers; consider using neutral wording like “Terraform/OpenTofu state” (or just “Terraform state”) to match existing terminology.
- State backend inputs (`state_backend`, `state_backend_config`, `state_prefix_key`, `multi_repo`): wrong defaults or renames silently repoint or collide OpenTofu state across tenants. Renaming or changing the default of ANY input is a breaking change for marketplace consumers.
Member
Author
|
Closing: moving this review policy into Devin's own configuration instead of repo files. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a REVIEW.md instruction file that Devin Review (and other review agents) ingest automatically when analyzing PRs in this repository. It encodes repo-specific review policy: critical paths, release/versioning gates, conventions to enforce, and security expectations.
Docs-only change: no release or deploy workflow matches a root-level REVIEW.md in this repo.