From 4e08f37242e6608e89e0a6962031b1a0c0b9483b Mon Sep 17 00:00:00 2001 From: Derek Misler Date: Fri, 13 Feb 2026 16:24:03 -0500 Subject: [PATCH] WIP [2026-02-13 16:24:03] Signed-off-by: Derek Misler --- review-pr/README.md | 28 ---------------------------- 1 file changed, 28 deletions(-) diff --git a/review-pr/README.md b/review-pr/README.md index 490cbcf..5c0f177 100644 --- a/review-pr/README.md +++ b/review-pr/README.md @@ -8,34 +8,6 @@ AI-powered pull request review using a multi-agent system. Analyzes code changes Add `.github/workflows/pr-review.yml` to your repo with this **minimal but safe setup**: -```yaml -name: PR Review -on: - issue_comment: # Enables /review command in PR comments - types: [created] - pull_request_review_comment: # Captures feedback on review comments for learning - types: [created] - pull_request_target: # Triggers auto-review on PR open; uses base branch context so secrets work with forks - types: [ready_for_review, opened] - -permissions: - contents: read - -jobs: - review: - uses: docker/cagent-action/.github/workflows/review-pr.yml@latest - # Scoped to the job so other jobs in this workflow aren't over-permissioned - permissions: - contents: read # Read repository files and PR diffs - pull-requests: write # Post review comments and approve/request changes - issues: write # Create security incident issues if secrets are detected in output - secrets: - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} - CAGENT_ORG_MEMBERSHIP_TOKEN: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }} # PAT with read:org scope; gates auto-reviews to org members only - CAGENT_REVIEWER_APP_ID: ${{ secrets.CAGENT_REVIEWER_APP_ID }} # GitHub App ID; reviews appear as your app instead of github-actions[bot] - CAGENT_REVIEWER_APP_PRIVATE_KEY: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }} # GitHub App private key; paired with App ID above -``` - > **Why explicit secrets instead of `secrets: inherit`?** This follows the principle of least privilege — the called workflow only receives the secrets it actually needs, not every secret in your repository. This is the recommended approach for public repos and security-conscious teams. ### Customizing for your organization