* feat: advisory AI review of needs-human and scout PRs with OpenCode V2
A scheduled workflow runs `opencode run` (V2, pinned and checksummed)
with a read-only catalog-reviewer agent over evidence bundles for open
PRs labeled needs-human or scout and for unreviewed scout candidates.
PRs get one verdict comment and an ai-* label; confident scout accepts
get a bot PR. It never merges or closes.
The model runs in a job with no GitHub token; the agent may only read,
glob and grep inside the repository (a self-test proves it before each
run); verdicts are schema-validated and rendered by our own code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* fix(ai-review): address CodeQL and SonarCloud security findings
Enforce HTTPS on the OpenCode download, run opencode by absolute path,
escape summary cells with escapeCell, rely on HTML escaping instead of
comment-stripping regexes, validate item IDs before routing API calls,
and bound verdict parsing on runaway output.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---------
Co-authored-by: John Smith <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
GitHub creates pull_request runs for PRs opened or updated by github-actions[bot] as action_required, and that run (not a workflow_dispatch run on the same commit) is what the required check on main binds to. The README workflow, openPullRequest (submissions, scout, health) and reprobe now approve the held validate run. Generated files are allowed only on PRs opened by github-actions[bot] from this repo's bot/readme-* branches.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
validate-pr.yml now runs on every PR (README-only PRs previously got no feedback), drops tj-actions/changed-files, runs unit tests, scripts/check-pr.js and a README/registry generation dry run, and supports workflow_dispatch so bot branches get the check. New plugin entries that are V1-only are blocked; declared compat must match what is detected. triage.yml labels PRs (ready, needs-v2, needs-metadata, needs-human, category) and keeps one results comment, using base-branch code only and reading PR files as data. The README workflow uses full history and Node 24.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
