pr-review

{
  "repo": "Levanto/Levanto-Aion",
  "review": {
    "summary": "This PR fixes a real set of CI-pipeline correctness bugs (changed-files scoping, mypy hyphenated-dir crash, writable cache dirs, state-name rename, webhook changed_files population) and adds genuine prompt-injection framing to the review-agent. However, two major issues block approval: the injection defense is bypassable via unescaped closing-marker injection in PR content, and the build-agent reports passed=True when its host-repo env var is unset, turning the build gate into a false green. Confidence is high — findings are confirmed against the actual source files, not just the PR description.",
    "verdict": "changes_requested",
    "findings": [
      {
        "file": "agents/review-agent/agent.py",
        "lens": "security",
        "line": 108,
        "finding": "The new prompt-injection defense inlines attacker-controlled pr_title, pr_body, and diff hunks between <UNTRUSTED-PR-DATA> markers without escaping or neutralizing literal occurrences of the closing marker, so a PR containing '</UNTRUSTED-PR-DATA>' followed by injected instructions can break out of the data region the system prompt protects and flip the merge-gating verdict.",
        "severity": "major"
      },
      {
        "file": "agents/build-agent/agent.py",
        "lens": "operational",
        "line": 110,
        "finding": "When BUILD_AGENT_HOST_REPO is unset (the documented default), the agent returns BuildReport(passed=True), so the aion/build merge gate reports green without building any image — a false-positive gate that lets broken Dockerfiles pass CI; a skipped/neutral status would be safer than passed=True.",
        "severity": "major"
      },
      {
        "file": "apps/worker-runtime/Dockerfile",
        "lens": "security",
        "line": 60,
        "finding": "The pinned docker CLI tarball is piped from download.docker.com straight into tar with no SHA256 checksum or signature verification, so the build trusts transport security alone for a binary placed on PATH inside the privileged worker image.",
        "severity": "minor"
      },
      {
        "file": "apps/orchestrator-api/app/api/routes/webhooks.py",
        "lens": "operational",
        "line": 128,
        "finding": "Push-event changed_files is derived from payload commits[*].{added,modified,removed}, but GitHub truncates/omits commits for large pushes (>20 commits / >2000 files), so CI can be scoped to an incomplete file set and silently skip linting files that actually changed.",
        "severity": "minor"
      },
      {
        "file": "agents/ci-quality-agent/agent.py",
        "lens": "operational",
        "line": 105,
        "finding": "Whole-repo mode (empty changed_files, e.g. manual workflow submissions) skips mypy entirely and reports it as passed, so type checking is silently dropped for an entire class of runs rather than degraded with a clear non-passing signal.",
        "severity": "minor"
      }
    ]
  },
  "base_ref": "main",
  "head_sha": "6b2916da82cb96abfa775216fa80c0c5db50c022",
  "pr_number": 16,
  "post-comment": {
    "posted": {
      "posted": true,
      "pr_number": 16,
      "body_chars": 2790,
      "comment_id": 4529899127
    }
  },
  "changed_files": [
    "agents/build-agent/agent.py",
    "agents/ci-quality-agent/agent.py",
    "agents/ci-quality-agent/tests/test_agent.py",
    "agents/review-agent/agent.py",
    "agents/review-agent/prompts/system.md",
    "apps/orchestrator-api/app/api/routes/webhooks.py",
    "apps/worker-runtime/Dockerfile",
    "docs/MODEL_ROUTING.md",
    "docs/QUICKSTART.md",
    "docs/README.md",
    "infra/scripts/sync-claude-credentials.sh",
    "pyproject.toml",
    "workflows/ci-pipeline/workflow.py"
  ],
  "dashboard_url": "http://aion.levanto.in/runs/237fd62e-90a1-483c-a40a-d62e6e6dcf24",
  "status-failure-review": {
    "posted": {
      "sha": "6b2916da82cb96abfa775216fa80c0c5db50c022",
      "state": "failure",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/237fd62e-90a1-483c-a40a-d62e6e6dcf24"
    }
  },
  "status-pending-review": {
    "posted": {
      "sha": "6b2916da82cb96abfa775216fa80c0c5db50c022",
      "state": "pending",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/237fd62e-90a1-483c-a40a-d62e6e6dcf24"
    }
  }
}