Skip to content

Add GitHub caller workflow for reusable code review #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
xdanger wants to merge 1 commit into from
Closed

Add GitHub caller workflow for reusable code review #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .github/workflows/code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: Code Review

on:
pull_request:
types: [opened, ready_for_review, reopened, synchronize]

permissions:
actions: read
contents: read
id-token: write

@greptile-apps greptile-apps Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 id-token: write is a highly privileged permission

id-token: write allows the workflow to request an OIDC JWT from GitHub's token endpoint, which can be exchanged for credentials with cloud providers (AWS, GCP, Azure, etc.). Unless taptap/.github/.github/workflows/code-review.yml explicitly needs OIDC authentication, granting this permission unnecessarily widens the attack surface.

If you've confirmed the upstream reusable workflow requires it, this is fine to keep. Otherwise consider removing it.

Suggested change
id-token: write
id-token: none

issues: write
pull-requests: write

jobs:
code-review:
if: >-
github.event.pull_request &&

@greptile-apps greptile-apps Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Redundant truthiness check on github.event.pull_request

Because this workflow only triggers on the pull_request event, github.event.pull_request is always a non-null object. The first term of the if expression is always truthy and can be removed to keep the condition cleaner.

Suggested change
github.event.pull_request &&
if: >-
!github.event.pull_request.draft &&
github.event.pull_request.head.repo.full_name == github.repository

!github.event.pull_request.draft &&
github.event.pull_request.head.repo.full_name == github.repository
Comment on lines +7 to +19

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Permissions are granted at the workflow level, which applies to all jobs. Since this workflow currently has a single job that calls a reusable workflow, consider moving permissions: under the code-review job (and trimming any scopes that aren’t required by the reusable workflow) to better follow least-privilege principles.

Suggested change
permissions:
actions: read
contents: read
id-token: write
issues: write
pull-requests: write
jobs:
code-review:
if: >-
github.event.pull_request &&
!github.event.pull_request.draft &&
github.event.pull_request.head.repo.full_name == github.repository
jobs:
code-review:
if: >-
github.event.pull_request &&
!github.event.pull_request.draft &&
github.event.pull_request.head.repo.full_name == github.repository
permissions:
actions: read
contents: read
id-token: write
issues: write
pull-requests: write

Copilot uses AI. Check for mistakes.
uses: taptap/.github/.github/workflows/code-review.yml@main

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pin reusable workflow to immutable revision

Reference taptap/.github/.github/workflows/code-review.yml by a commit SHA instead of @main; using a mutable branch means upstream changes can silently alter this job’s behavior and, in the worst case, execute attacker-controlled workflow logic with this workflow’s write-scoped GITHUB_TOKEN and ANTHROPIC_API_KEY. Pinning to an immutable SHA keeps reviews reproducible and prevents supply-chain drift.

Useful? React with 👍 / 👎.

@greptile-apps greptile-apps Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Reusable workflow pinned to @main, not a commit SHA

Referencing an external reusable workflow at @main means any commit pushed to that branch is automatically trusted and executed with this repository's secrets and permissions. If taptap/.github is ever compromised or has a breaking change, this workflow is affected without any explicit approval in this repo — this is a supply-chain security risk.

GitHub's own security hardening guide recommends pinning third-party actions/reusable workflows to a full commit SHA:

Suggested change
uses: taptap/.github/.github/workflows/code-review.yml@main
uses: taptap/.github/.github/workflows/code-review.yml@<full-commit-sha>

Replace <full-commit-sha> with the current HEAD SHA of taptap/.github (e.g. uses: taptap/.github/.github/workflows/code-review.yml@a1b2c3d...). This way upgrades are always explicit and auditable.

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reusable workflow is referenced by a mutable ref (@main). This is a supply-chain risk because behavior can change without review in this repo. Prefer pinning to an immutable commit SHA (or a protected, versioned tag) for the uses: reference.

Suggested change
uses: taptap/.github/.github/workflows/code-review.yml@main
uses: taptap/.github/.github/workflows/code-review.yml@3b2c9e1a4f5d6b7c8d9e0f1a2b3c4d5e6f7a8b9c

Copilot uses AI. Check for mistakes.
secrets:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
Loading