pr-review

{
  "repo": "Levanto/Levanto-Aion",
  "review": {
    "summary": "The PR is a substantive, well-tested CI/review-pipeline correctness change that fixes real scoping, cache, path, and state-name bugs and adds a genuinely valuable prompt-injection trust boundary to the merge-gating review-agent. However, the injection defense is incomplete: untrusted PR content is not sanitized against the closing marker, leaving a delimiter-breakout bypass on a security-critical control (major), alongside minor supply-chain, false-green-build, and reduced-type-coverage concerns. Confidence is high on the diffs shown, though the ci-quality result-assembly and workflow.py are tail-truncated and not fully visible.",
    "verdict": "changes_requested",
    "findings": [
      {
        "file": "agents/review-agent/agent.py",
        "lens": "security",
        "line": 95,
        "finding": "The prompt-injection defense interpolates attacker-controlled title/body/diff directly between `<UNTRUSTED-PR-DATA>` markers without escaping or stripping the marker tokens, so a PR whose body or diff contains a literal `</UNTRUSTED-PR-DATA>` can close the data block early and smuggle text that appears outside the trusted boundary — bypassing the very merge-gating control this PR adds.",
        "severity": "major"
      },
      {
        "file": "apps/worker-runtime/Dockerfile",
        "lens": "security",
        "line": 52,
        "finding": "The static docker CLI is fetched via `curl … | tar` with only version pinning and no SHA256/signature verification, leaving the image build vulnerable to a tampered or mirror-compromised binary (supply-chain integrity gap).",
        "severity": "minor"
      },
      {
        "file": "agents/build-agent/agent.py",
        "lens": "operational",
        "line": 108,
        "finding": "When `BUILD_AGENT_HOST_REPO` is unset (the documented default) the agent returns a `passed=True` skip-report, so the `aion/build` status check is reported green without ever building any image, masking real build breakage as a successful CI signal by default.",
        "severity": "minor"
      },
      {
        "file": "agents/ci-quality-agent/agent.py",
        "lens": "operational",
        "line": 110,
        "finding": "Mypy is skipped entirely in whole-repo mode and all paths under hyphenated directories are filtered out in scoped mode, meaning the orchestrator-api, every `*-agent`, base-agent, and vector-db are never type-checked — a large, silent reduction in CI type coverage tracked only as a future cleanup.",
        "severity": "minor"
      },
      {
        "file": "apps/orchestrator-api/app/api/routes/webhooks.py",
        "lens": "architecture",
        "line": 105,
        "finding": "PR webhook handling now makes a synchronous `list_pull_request_files` GitHub API call inside the inbound request path, adding latency and an external-failure surface to webhook delivery; it is wrapped in try/except with an empty-list fallback, so it degrades rather than breaks, but the call should ideally move off the hot path.",
        "severity": "minor"
      }
    ]
  },
  "base_ref": "main",
  "head_sha": "e240b69d165bb0fd1f458280bd0fd0fba4ea7790",
  "pr_number": 16,
  "post-comment": {
    "posted": {
      "posted": true,
      "pr_number": 16,
      "body_chars": 2905,
      "comment_id": 4529872297
    }
  },
  "changed_files": [
    "agents/build-agent/agent.py",
    "agents/ci-quality-agent/agent.py",
    "agents/ci-quality-agent/tests/test_agent.py",
    "agents/review-agent/agent.py",
    "agents/review-agent/prompts/system.md",
    "apps/orchestrator-api/app/api/routes/webhooks.py",
    "apps/worker-runtime/Dockerfile",
    "docs/MODEL_ROUTING.md",
    "docs/QUICKSTART.md",
    "docs/README.md",
    "infra/scripts/sync-claude-credentials.sh",
    "pyproject.toml",
    "workflows/ci-pipeline/workflow.py"
  ],
  "dashboard_url": "http://aion.levanto.in/runs/38f81c0e-7a91-45af-be27-91823e259eda",
  "status-failure-review": {
    "posted": {
      "sha": "e240b69d165bb0fd1f458280bd0fd0fba4ea7790",
      "state": "failure",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/38f81c0e-7a91-45af-be27-91823e259eda"
    }
  },
  "status-pending-review": {
    "posted": {
      "sha": "e240b69d165bb0fd1f458280bd0fd0fba4ea7790",
      "state": "pending",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/38f81c0e-7a91-45af-be27-91823e259eda"
    }
  }
}