konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(ci): add pr-review agent — scheduled AI review of open PRs #323

Merged
k.renner merged 1 commits from claude-bot/pr-review-bot into master 2026-07-21 14:32:45 +00:00
Conversation 0 Commits 1 Files Changed 3
+414
claude-bot commented 2026-07-21 10:23:38 +00:00
Member
Copy Link
Copy Source

What this adds

A scheduled PR review bot, built in the same shape as the existing
alert-monitor / issue-fix fleet (Woodpecker cron → headless claude →
Gitea API), but it reviews open pull requests instead of triaging alerts.

Files

  • .woodpecker/pr-review.yml — the pr-review cron pipeline.
  • ci/agents/pr-review/triage-prompt.md — Haiku model-selection rubric.
  • ci/agents/pr-review/prompt.md — the reviewer's task + report format.

What a run does

  1. Discovers open PRs across k.renner/{homelab, shelly-manager, authentik-samba-bridge, homeassistant}. Skips drafts/WIP and any PR already
    reviewed at its current head sha (dedup marker <!-- pr-review:sha=… -->),
    so pushed updates earn a fresh review and steady-state runs are no-ops.
    Capped at 5 PRs/run; overflow is logged and deferred, never dropped.
  2. Picks the model per PR — a cheap Haiku triage agent reads the diff + stats
    and classifies complexity: haiku (trivial), sonnet (normal), opus
    (large/multi-subsystem, or any security-sensitive path —
    auth/secrets/RBAC/NetworkPolicy/TLS/crypto — regardless of size).
  3. Reviews with the chosen model against a full checkout at the PR head, and
  4. Posts a detailed report as a Gitea PR review: COMMENT normally, or
    REQUEST_CHANGES when it finds a concrete blocking defect. It never
    approves     — a human still merges.

Security model

Static review only — no cluster access. Agent tools are Read,Glob,Grep,Write
with no Bash, so untrusted PR code cannot be executed and env-var tokens
cannot be read by the agent (same threat model as the rest of the fleet). PR
title/body/diff are treated as untrusted data.

Not active yet — activation steps (see the pipeline header)

  1. Create a dedicated review-bot Gitea account + PAT (scope write:repository).
  2. Add review-bot as a Read collaborator on all four target repos (3 are private).
  3. Add the PAT as Woodpecker secret review_bot_token on k.renner/homelab
    (cron-scoped).
  4. Register the cron: woodpecker repo cron add --repo k.renner/homelab --name pr-review --branch master --schedule '17 * * * *'.

🤖 Generated with Claude Code

## What this adds A scheduled **PR review bot**, built in the same shape as the existing `alert-monitor` / `issue-fix` fleet (Woodpecker cron → headless `claude` → Gitea API), but it reviews **open pull requests** instead of triaging alerts. ### Files - `.woodpecker/pr-review.yml` — the `pr-review` cron pipeline. - `ci/agents/pr-review/triage-prompt.md` — Haiku model-selection rubric. - `ci/agents/pr-review/prompt.md` — the reviewer's task + report format. ### What a run does 1. **Discovers** open PRs across `k.renner/{homelab, shelly-manager, authentik-samba-bridge, homeassistant}`. Skips drafts/WIP and any PR already reviewed at its **current head sha** (dedup marker `<!-- pr-review:sha=… -->`), so pushed updates earn a fresh review and steady-state runs are no-ops. Capped at 5 PRs/run; overflow is logged and deferred, never dropped. 2. **Picks the model per PR** — a cheap Haiku triage agent reads the diff + stats and classifies complexity: `haiku` (trivial), `sonnet` (normal), `opus` (large/multi-subsystem, or **any** security-sensitive path — auth/secrets/RBAC/NetworkPolicy/TLS/crypto — regardless of size). 3. **Reviews** with the chosen model against a full checkout at the PR head, and 4. **Posts** a detailed report as a Gitea PR review: `COMMENT` normally, or `REQUEST_CHANGES` when it finds a concrete blocking defect. It **never approves** — a human still merges. ### Security model Static review only — no cluster access. Agent tools are `Read,Glob,Grep,Write` with **no Bash**, so untrusted PR code cannot be executed and env-var tokens cannot be read by the agent (same threat model as the rest of the fleet). PR title/body/diff are treated as untrusted data. ### Not active yet — activation steps (see the pipeline header) 1. Create a dedicated `review-bot` Gitea account + PAT (scope `write:repository`). 2. Add `review-bot` as a Read collaborator on all four target repos (3 are private). 3. Add the PAT as Woodpecker secret `review_bot_token` on `k.renner/homelab` (cron-scoped). 4. Register the cron: `woodpecker repo cron add --repo k.renner/homelab --name pr-review --branch master --schedule '17 * * * *'`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude-bot added 1 commit 2026-07-21 10:23:38 +00:00
feat(ci): add pr-review agent — scheduled AI review of open PRs 9ad08ad931 
New Woodpecker cron pipeline that mirrors the alert-monitor / issue-fix
fleet pattern (cron -> headless `claude` -> Gitea API), but reviews open
pull requests instead of triaging alerts:

- .woodpecker/pr-review.yml: hourly `pr-review` cron. Discovers open PRs
  across k.renner/{homelab,shelly-manager,authentik-samba-bridge,
  homeassistant}, skips drafts/WIP and PRs already reviewed at their
  current head sha (dedup marker), caps at 5/run. For each: clones the PR
  head, has a cheap Haiku triage agent pick the model by complexity
  (haiku/sonnet/opus; security-sensitive paths force opus), runs the
  review with that model, and posts a detailed report as a Gitea PR
  review (COMMENT, or REQUEST_CHANGES on a real defect — never APPROVE).
- ci/agents/pr-review/triage-prompt.md: model-selection rubric.
- ci/agents/pr-review/prompt.md: the reviewer's task + report format.

Runs under a dedicated `review-bot` Gitea account (secret
review_bot_token) so reviews are visibly bot-authored and independently
revocable. Static review only — no cluster access; agent tools are
Read/Glob/Grep/Write with no Bash.

Not yet active: needs the review-bot account + token, the review_bot_token
Woodpecker secret, and the `pr-review` cron registered (see file header).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.renner merged commit 71c65fde79 into master 2026-07-21 14:32:45 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#323