Skip to content

update cagent-action to latest (with better permissions) #13665

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
derekmisler wants to merge 3 commits into
base: main
Choose a base branch
from
+16 −34
Open

update cagent-action to latest (with better permissions) #13665

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4b44171
update cagent-action to latest (with better permissions)
derekmisler Mar 24, 2026
c0803d3
Update .github/workflows/pr-review.yml
derekmisler Mar 24, 2026
02f9e0f
Update .github/workflows/pr-review.yml
derekmisler Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 16 additions & 34 deletions .github/workflows/pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,44 +1,26 @@
name: PR Review

on:
pull_request_target:
types: [opened, ready_for_review]
issue_comment:
issue_comment: # Enables /review command in PR comments
types: [created]
pull_request_review_comment:
pull_request_review_comment: # Captures feedback on review comments for learning
types: [created]
pull_request: # Triggers auto-review on PR open (same-repo branches only; fork PRs use /review)
types: [ready_for_review, opened]

# Serialize reviews per PR; do not cancel in-progress runs
# so no review is silently dropped mid-execution.
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: false
Comment on lines -11 to -15
Copy link
Author

@derekmisler derekmisler Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is already baked into the action.

permissions:
contents: read # Required at top level so `GITHUB_TOKEN` for `issue_comment` events can read repository contents.

jobs:
review:
# Only run on the upstream repo (not forks) to prevent credential leaks.
# Skip draft PRs (ready_for_review will fire when promoted).
# Skip bot actors to avoid reviewing Dependabot and automation PRs.
# Require collaborator-level access for comment-triggered events.
# Only trigger on PR comments, not plain issue comments.
if: >-
github.repository == 'docker/compose' &&
(github.event_name != 'pull_request_target' || github.event.pull_request.draft == false) &&
(github.event_name == 'pull_request_target' ||
(github.event_name == 'issue_comment' &&
github.event.issue.pull_request &&
contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
(github.event_name == 'pull_request_review_comment' &&
contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))) &&
!endsWith(github.actor, '[bot]')
Comment on lines -19 to -33
Copy link
Author

@derekmisler derekmisler Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also now included in the action.

uses: docker/cagent-action/.github/workflows/review-pr.yml@3a12dbd0c6cd7dda3d4e05f24f0143c9701456de # v1.2.13
uses: docker/cagent-action/.github/workflows/review-pr.yml@dba0ca51938c78afb363625363c50582243218d6 # v1.3.1
# Scoped to the job so other jobs in this workflow aren't over-permissioned
permissions:
contents: read # Read repository files and PR diffs
pull-requests: write # Post review comments and approve/request changes
issues: write # Create security incident issues if secrets are detected in output
checks: write # (Optional) Show review progress as a check run on the PR
secrets:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
CAGENT_ORG_MEMBERSHIP_TOKEN: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }}
CAGENT_REVIEWER_APP_ID: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
CAGENT_REVIEWER_APP_PRIVATE_KEY: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}
permissions:
contents: read # to fetch code
pull-requests: write # to post review comments
issues: write # to reply to issue/PR comments
checks: write # to update check statuses
CAGENT_ORG_MEMBERSHIP_TOKEN: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }} # PAT with read:org scope; gates auto-reviews to org members only
CAGENT_REVIEWER_APP_ID: ${{ secrets.CAGENT_REVIEWER_APP_ID }} # GitHub App ID; reviews appear as your app instead of github-actions[bot]
CAGENT_REVIEWER_APP_PRIVATE_KEY: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }} # GitHub App private key; paired with App ID above
Loading