From c35f673bc131aa26f567e24466e3a6757345154e Mon Sep 17 00:00:00 2001 From: Saffron Worker Date: Sun, 7 Jun 2026 14:04:42 -0600 Subject: [PATCH] docs: tune AI PR review guidance Add repo-specific review conventions for AI PR reviewer. - Security-sensitive areas for app/web repos (auth, file serving, SSRF, etc.) - Compact Renovate digest-only review guidance for infra repos - Defaults to action's auto-discovered standards_file_candidate (.github/ai-review-rules.md) --- .github/ai-review-rules.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .github/ai-review-rules.md diff --git a/.github/ai-review-rules.md b/.github/ai-review-rules.md new file mode 100644 index 00000000..c2580cdb --- /dev/null +++ b/.github/ai-review-rules.md @@ -0,0 +1,35 @@ +# AI PR Review: dispatch + +## Security review conventions + +Dispatch is a Next.js/TypeScript Kanban and work dispatch layer. Contains both application logic and infrastructure concerns. + +Security-sensitive areas: +- **API routes** (`src/app/api/`): bearer-token auth (`DISPATCH_AGENT_TOKEN`), input validation before DB operations +- **Prisma ORM**: schema migrations, relation integrity (nullable foreign keys hide bugs — keep them strict) +- **GitHub tokens** (`GITHUB_TOKEN`): never log or persist to disk +- **Agent tokens** (`DISPATCH_AGENT_TOKEN`): bearer auth for agent API, never log +- **Automation sync**: pipeline syncs issue data from GitHub; validate incoming data shapes +- **Webhook/ingestion endpoints** (`pr-followup`, `pr-fix-queue`): validate webhook payloads, authenticate sources + +## Compact Renovate digest-only reviews + +For Renovate digest-only container image updates where the repository and tag are unchanged and the diff only changes `@sha256:` values, keep `review_markdown` compact. + +Prefer: +- short recommendation +- changed files summary +- non-blocking caveats, if any + +Do not include separate Standards Compliance, Linked Issue Fit, Evidence Provider Findings, Tool Harness Findings, or Unknowns sections unless they contain an actual warning or blocker. + +Do not include internal planner/tool-harness diagnostics such as missing `requests[]` unless they affect the recommendation. + +Missing OCI revision/source labels are a non-blocking caveat for same-tag digest refreshes when repository, tag, and created timestamp evidence are consistent. + +## Review tone + +- Be direct and practical. +- Flag only real defects, regressions, or meaningful risks as blocking. +- Do not nitpick formatting, naming, or style unless it affects readability or correctness. +- Prefer `approve` or non-blocking comments for PRs that look reasonable overall.