fix: bridge Action inputs to process.env for privacy guard validation

[rxolve]

GitHub Actions maps with: inputs to INPUT_* prefixed env vars, but review-engine's privacyGuard.validateEnvironment() checks process.env directly. Set ANTHROPIC_API_KEY and GITHUB_TOKEN on process.env after reading them via core.getInput().

[github-actions]

🤖 Dialectic PR Review

Framework: vanilla
Strategy: small
Files Reviewed: 1

Summary

The change introduces a security concern by exposing sensitive credentials to the global process environment. While functionally correct for bridging GitHub Actions inputs to review-engine expectations, it creates unnecessary security exposure and tight coupling that should be addressed.

Issues

🔐 Environment variable pollution with sensitive data

File: src/action.ts (Line 13)
Type: security
Confidence: high

Setting ANTHROPIC_API_KEY and GITHUB_TOKEN directly on process.env exposes sensitive credentials to all child processes and modules. This creates a security risk where any dependency or spawned process can access these tokens.

Suggestion:

Pass credentials as parameters to review-engine instead of polluting process.env. If review-engine requires env vars, consider using a more secure approach like temporary env scoping or credential injection at the module boundary.

---

🔧 Tight coupling between GitHub Actions and review-engine

File: src/action.ts (Line 13)
Type: maintainability
Confidence: medium

The code creates a bridge between GitHub Actions input format and review-engine's expected environment variables. This coupling makes the code harder to test and maintain, as it assumes specific environment variable names.

Suggestion:

Consider refactoring review-engine to accept credentials as parameters, or create a dedicated configuration object that can be passed to review-engine without modifying global state.

---

Metadata

• Tokens Used: 887
• Duration: 8.82s

Powered by Dialectic PR Review