pr-review

{
  "repo": "Levanto/Levanto-Aion",
  "review": {
    "summary": "This PR is a broad CI/review-pipeline correctness change (changed-file scoping, cache dirs, mypy hyphenated-dir handling, host-path build resolution, docker CLI install, and prompt-injection hardening of the review-agent). The injection hardening is a real improvement but incomplete: untrusted PR body/diff content is not neutralized for a forged `</UNTRUSTED-PR-DATA>` delimiter, leaving a marker-escape bypass on the merge gate (major). Confidence is high on the reviewable files; two diffs (ci-quality-agent and workflow.py) were tail-truncated, though the on-disk versions I checked handle the skip paths correctly.",
    "verdict": "changes_requested",
    "findings": [
      {
        "file": "agents/review-agent/agent.py",
        "lens": "security",
        "line": 109,
        "finding": "The attacker-controlled PR body (and diff hunks via _render_diff_section) are interpolated raw inside the <UNTRUSTED-PR-DATA> markers with no escaping of a literal closing `</UNTRUSTED-PR-DATA>`, so a PR body or diff line containing that token can close the trust boundary early and inject instructions that appear outside it — defeating this PR's own headline prompt-injection defense on a merge-gating reviewer.",
        "severity": "major"
      },
      {
        "file": "agents/build-agent/agent.py",
        "lens": "operational",
        "line": 112,
        "finding": "When BUILD_AGENT_HOST_REPO is unset (the documented default), the build agent returns report.passed=True, so the `aion/build` commit status reports green without building anything and a broken Dockerfile can merge behind a misleading success check.",
        "severity": "minor"
      },
      {
        "file": "agents/ci-quality-agent/agent.py",
        "lens": "operational",
        "line": 110,
        "finding": "The _mypy_safe filter permanently excludes every hyphenated directory (orchestrator-api, all *-agent, base-agent, vector-db) and mypy is skipped entirely in whole-repo mode, so type checking no longer covers the majority of the codebase while still reporting a passing mypy check.",
        "severity": "minor"
      },
      {
        "file": "apps/worker-runtime/Dockerfile",
        "lens": "security",
        "line": 58,
        "finding": "The static docker CLI binary is fetched via `curl ... | tar` with only a version pin and TLS — no SHA256/signature verification — leaving the image build vulnerable to a tampered or mirror-compromised artifact.",
        "severity": "minor"
      },
      {
        "file": "apps/orchestrator-api/app/api/routes/webhooks.py",
        "lens": "operational",
        "line": 128,
        "finding": "Push-event changed_files is derived from the payload `commits[*]` arrays, which GitHub truncates for large pushes (max ~2000 commits, and file lists omitted/abbreviated), so the resulting manifest can be incomplete and silently scope ci-quality to a subset of the actually-changed files.",
        "severity": "minor"
      }
    ]
  },
  "base_ref": "main",
  "head_sha": "c968f270c0bc019a30afae6a18838a41463adc43",
  "pr_number": 16,
  "post-comment": {
    "posted": {
      "posted": true,
      "pr_number": 16,
      "body_chars": 2831,
      "comment_id": 4529882979
    }
  },
  "changed_files": [
    "agents/build-agent/agent.py",
    "agents/ci-quality-agent/agent.py",
    "agents/ci-quality-agent/tests/test_agent.py",
    "agents/review-agent/agent.py",
    "agents/review-agent/prompts/system.md",
    "apps/orchestrator-api/app/api/routes/webhooks.py",
    "apps/worker-runtime/Dockerfile",
    "docs/MODEL_ROUTING.md",
    "docs/QUICKSTART.md",
    "docs/README.md",
    "infra/scripts/sync-claude-credentials.sh",
    "pyproject.toml",
    "workflows/ci-pipeline/workflow.py"
  ],
  "dashboard_url": "http://aion.levanto.in/runs/416ede06-c87d-42f8-a5fa-df93c7b44051",
  "status-failure-review": {
    "posted": {
      "sha": "c968f270c0bc019a30afae6a18838a41463adc43",
      "state": "failure",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/416ede06-c87d-42f8-a5fa-df93c7b44051"
    }
  },
  "status-pending-review": {
    "posted": {
      "sha": "c968f270c0bc019a30afae6a18838a41463adc43",
      "state": "pending",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/416ede06-c87d-42f8-a5fa-df93c7b44051"
    }
  }
}