Skip to content

Commit a41b5a5

Browse files
superKalosuperKalo
authored
Merge pull request #2355 from AmbireTech/release/v2.96
Release / v2.96.0, v2.96.1 and v2.96.2
2 parents 9382aa3 + 94e0fbf commit a41b5a5

49 files changed

Lines changed: 2839 additions & 409 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/general-review.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: PR Agent - General Review
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, labeled]
6+
issue_comment:
7+
types: [created]
8+
workflow_dispatch:
9+
10+
jobs:
11+
review:
12+
if: >-
13+
(github.event.action == 'labeled' && github.event.label.name == 'review') ||
14+
github.event_name == 'workflow_dispatch' ||
15+
(github.event.sender.type != 'Bot' &&
16+
github.event_name == 'issue_comment' &&
17+
contains(github.event.comment.body, '/review'))
18+
runs-on: ubuntu-latest
19+
permissions:
20+
pull-requests: write
21+
contents: write
22+
23+
steps:
24+
- uses: actions/checkout@v6
25+
26+
- name: Run General PR Agent
27+
uses: The-PR-Agent/pr-agent@main
28+
env:
29+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30+
OPENROUTER__KEY: ${{ secrets.OPENROUTER__KEY }}
31+
CONFIG__MODEL: "openrouter/moonshotai/kimi-k2.6"
32+
# Without auto_review=true we cannot have triggers such as
33+
# workflow_dispatch and PR label
34+
github_action_config.auto_review: "true"
35+
github_action_config.auto_describe: "false"
36+
github_action_config.auto_improve: "false"

‎.github/workflows/security-review.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: PR Agent - Security Review
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, labeled]
6+
issue_comment:
7+
types: [created]
8+
workflow_dispatch:
9+
10+
jobs:
11+
security_review:
12+
if: >-
13+
(github.event.action == 'labeled' && github.event.label.name == 'security-review') ||
14+
github.event_name == 'workflow_dispatch' ||
15+
(github.event.sender.type != 'Bot' &&
16+
github.event_name == 'issue_comment' &&
17+
contains(github.event.comment.body, '/security-review'))
18+
runs-on: ubuntu-latest
19+
permissions:
20+
pull-requests: write
21+
contents: write
22+
23+
steps:
24+
- uses: actions/checkout@v6
25+
26+
# PR-Agent does not recognize "/security-review" as a native command.
27+
# We rewrite the event JSON so the agent sees "/review" instead.
28+
# How this works is:
29+
# 1. Only this workflow runs because of the if statement
30+
# 2. It replaces /security-review with /review
31+
# 3. It replaces the extra instructions
32+
- name: Rewrite event payload for PR-Agent
33+
if: github.event_name == 'issue_comment'
34+
run: |
35+
jq '(.comment.body // "") |= sub("/security-review"; "/review"; "i")' \
36+
"$GITHUB_EVENT_PATH" > "$GITHUB_EVENT_PATH.tmp" && \
37+
mv "$GITHUB_EVENT_PATH.tmp" "$GITHUB_EVENT_PATH"
38+
39+
- name: Run Security PR Agent
40+
uses: The-PR-Agent/pr-agent@main
41+
env:
42+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
OPENROUTER__KEY: ${{ secrets.OPENROUTER__KEY }}
44+
CONFIG__MODEL: "openrouter/anthropic/claude-opus-4.7"
45+
# Without auto_review=true we cannot have triggers such as
46+
# workflow_dispatch and PR label
47+
github_action_config.auto_review: "true"
48+
github_action_config.auto_describe: "false"
49+
github_action_config.auto_improve: "false"
50+
PR_REVIEWER__EXTRA_INSTRUCTIONS: |
51+
You are reviewing changes in a security-sensitive Web3 browser extension wallet. Focus exclusively on security, privacy, and compliance risks. Ignore style, performance, or general quality issues unless they have direct security impact.
52+
53+
Key areas to examine:
54+
- Sensitive data exposure or hard-coded secrets
55+
- Insecure deserialization, cryptographic issues
56+
- Improper access control
57+
- Input validation, sanitization, and output encoding
58+
- Logging of sensitive information
59+
- Changes in key areas like: keystore, signing logic, encryption and safety features
60+
- Edge cases in features that ensure the security of the user (e.g., phishing detection, transaction safety checks, etc.)
61+
62+
For every finding:
63+
- State the severity (Critical / High / Medium / Low)
64+
- Quote the exact vulnerable code
65+
- Explain the risk clearly
66+
- Provide concrete remediation steps or code fixes
67+
68+
Be thorough and precise.

‎.github/workflows/tests.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,14 @@ on:
1111
- v2
1212
- main
1313
- 'release/*'
14+
types: [opened, synchronize, reopened, ready_for_review]
1415
jobs:
1516
tests:
1617
name: Tests
1718
runs-on: ubuntu-latest
1819
environment: tests
20+
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false || github.event_name == 'workflow_dispatch'
21+
1922
concurrency:
2023
group: ${{ github.workflow }}-${{ github.ref }}
2124
steps:

‎.pr_agent.toml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
[config]
2+
response_language = "en"
3+
4+
# ─────────────────────────────────────────────
5+
# Token & Cost Guardrails
6+
# ─────────────────────────────────────────────
7+
# Cap context for OpenRouter models (safety net for large PRs).
8+
# The models support 256k+; we clamp to 256k
9+
# to prevent runaway costs while leaving room for deep reviews.
10+
custom_model_max_tokens = 256000
11+
12+
# Increase timeout from default 120s → 300s (5 min).
13+
# Security reviews with large diffs on heavy models need headroom.
14+
ai_timeout = 300
15+
16+
# If a diff is too large, clip it rather than skipping entirely.
17+
large_patch_policy = "clip"
18+
19+
# ─────────────────────────────────────────────
20+
# Ignore Patterns
21+
# ─────────────────────────────────────────────
22+
[ignore]
23+
glob = [
24+
# Lockfiles
25+
"**/*.lock",
26+
"**/package-lock.json",
27+
"**/yarn.lock",
28+
29+
# Build artifacts & deps
30+
"artifacts/**",
31+
"cache/**",
32+
"coverage/**",
33+
"node_modules/**",
34+
"dist/**",
35+
"patches/**",
36+
37+
# Minified assets
38+
"**/*.min.js",
39+
"**/*.min.css",
40+
41+
# Logs
42+
"*.log",
43+
44+
# Tests
45+
"**/*.test.ts",
46+
"**/*.spec.ts",
47+
"**/*.test.js",
48+
"**/*.spec.js",
49+
50+
# Generated / declaration files
51+
"**/*.d.ts",
52+
53+
# CI/CD
54+
"**/.github/**",
55+
]
56+
57+
# ─────────────────────────────────────────────
58+
# General Review Settings (/review)
59+
# ─────────────────────────────────────────────
60+
[pr_reviewer]
61+
extra_instructions = """
62+
You are reviewing changes in a security-sensitive Web3 browser extension wallet.
63+
64+
Focus on the diff in front of you and assess it for correctness, security, reliability, and maintainability.
65+
66+
Prioritize issues such as:
67+
- Requests without error handling and timeouts
68+
- Inefficient algorithms or data structures
69+
- Inconsistent naming conventions or formatting
70+
- Unnecessary complexity or duplication
71+
- Missing comments or documentation for complex logic
72+
- Unhandled exceptions and edge cases
73+
- Swallowed errors and edge case return statements that should at least log an error
74+
75+
Be constructive, concise, and actionable. Keep feedback grounded in the actual changes rather than using a fixed checklist.
76+
"""
77+
78+
# UX: update the same comment on re-run instead of posting a new one.
79+
persistent_comment = true
80+
81+
# Post a final "Review completed" message so devs know the agent is done.
82+
final_update_message = true
83+
84+
# Publish even when there are no major findings (avoids silent failures).
85+
publish_output_no_suggestions = true
86+
87+
# Enable built-in security sub-section even in general reviews (defense in depth).
88+
require_security_review = true
89+
90+
# Also scan for missing tests, TODOs, and ticket references.
91+
require_tests_review = true
92+
require_todo_scan = true
93+
require_estimate_effort_to_review = true
94+
require_ticket_analysis_review = true
95+
96+
# Keep the review header but suppress noisy help text.
97+
enable_intro_text = true
98+
enable_help_text = false

0 commit comments

Comments
 (0)