mirror of
https://github.com/expo/code-review-cli.git
synced 2026-11-14 17:49:25 -10:00
Brent Vatne
601b19afc1
ecr ci now loads all review configuration (config.jsonc, routing, prompts,
models, auth mapping) from the PR's immutable base commit, materialized via
the GitHub API — never from the PR head — failing closed with one terminal
comment when the base can't be materialized. The PR head is materialized
separately (pinned to its immutable OID, mandatory in CI) purely as source
content, and is scrubbed of ambient runtime config (opencode.json{,c},
.opencode/ plugins, AGENTS.md, CLAUDE.md, .claude/, .mcp.json, .cursor*,
.env*) before the OpenCode server starts, closing a fork-reachable code
execution path through the /review command workflow.
- git fetches append `-c credential.helper=!gh auth git-credential` so
base-SHA checkouts with persist-credentials:false still fetch private repos
(token never in argv or .git/config)
- run log + patch workspace anchor at the workspace (runsDir), never the
temporary trusted root, so the artifact upload path keeps resolving
- a scope config that is new in a PR reviews with the root config and
activates after merge (hasScopeConfig fallback)
- scaffolded workflows check out the base SHA with persist-credentials:false;
the repo's own self-review workflow runs the engine from base source
- escape hatch: ecr ci --unsafe-config-from-head (loud warning, never
scaffolded, removal scheduled)