ci(github-action): update action misospace/pr-reviewer-action (v1.1.5 → v1.2.0)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
misospace/pr-reviewer-action	action	minor	v1.1.5 → v1.2.0

Warnings (1)

Please correct - or verify that you can safely ignore - these warnings before you merge this PR.

• misospace/pr-reviewer-action: Could not determine new digest for update (github-tags package misospace/pr-reviewer-action)

---

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

misospace/pr-reviewer-action (misospace/pr-reviewer-action)

v1.2.0

Compare Source

Feature-heavy minor release. Everything is backward-compatible by default — every new input defaults to the previous behavior; existing workflows keep working unchanged.

Features

• Structured findings (#​181): the model now returns a normalized findings[] array (severity, file, line, message) exposed as a findings output, plus verdict_policy: findings_severity_gated to derive the verdict deterministically from findings (request_changes iff any blocker-severity finding; falls back to the model verdict when no findings).
• Inline review comments (#​182): opt-in inline_findings: true attaches diff-anchorable findings as native line-anchored review comments (inline_findings_max, default 20). Ignored for publish_mode: comment.
• Fast/smart model routing (#​186): review_routing_mode: auto routes low-risk PRs to a fast model and risk-flagged PRs (auth, secrets, migrations, security issues, …) to a smart model via ai_fast_* / ai_smart_* inputs. Fast defaults to the primary config, smart to the fallback config.
• Review escalation (#​187): when the fast review looks insufficient (request_changes verdict, unaddressed required checks, low confidence, blocker signals), the review is automatically re-run on the smart model; escalate_on_* inputs control the triggers. New outputs: review_route, escalation_reason.
• Required-check completeness validation (#​185): the classifier emits must_check items for risky PRs and the review is validated against them (validate_required_checks, default auto; required_check_validation_mode: warn/fail/metadata_only). New output: required_checks.
• Deterministic PR classification (#​163) now steers the review prompt with pr_kind, risk_flags, and must_check (#​178) — injection-safe, derived from file patterns rather than PR text.
• Token-aware context budgets (#​170): model_context_tokens sizes the corpus to the model's real context window — important for 8k–32k local models that the named modes silently overflowed.
• OpenAI-compat API knobs (#​168): ai_response_format (json_object/json_schema — strongly recommended for small local models), ai_temperature, ai_tokens_param (max_completion_tokens support).
• Graceful model-failure handling (#​174): on_model_failure: notice posts a visible request_changes notice instead of failing the check with nothing on the PR; plus a step-summary table (engine, verdict, route, token usage, truncation).

Fixes

• Skip-if-unchanged fingerprinting and incremental review actually work; fingerprint includes prompt/config/rules hashes (#​165).
• wait_for_ci.sh works on Checks-API-only repos and excludes its own run from the wait (#​176).
• Response parsing and SSE reassembly hardened for local models (#​166); model-call failure classes distinguished with HTTP error bodies captured (#​167, #​169).
• Tool harness planner contract fixed; executor tolerance and parse retry added (#​171).
• Classifier: renovate mixed-PR mislabeling fixed; multi-language risk patterns (#​172).
• Audit closeouts: #​164 (tool harness/precheck/corpus correctness + security) and #​184 (all 11 findings of audit #​183).
• Post-merge cleanup of routing/escalation rough edges (#​188).

Performance

• Parallelized context-collection I/O, deduplicated PR object/diff fetches, precheck short-circuit (#​175).
• Low-value bytes trimmed from the review corpus and planner context (#​177); corpus reordered so high-value evidence survives truncation (#​170).
• Linked-source fetching parallelized with a bounded enrichment time budget.

Security

• Model API keys and GitHub tokens passed via 0600 curl --config files instead of argv (#​179).
• @​-mentions neutralized in posted reviews; redact.py Python 3.9 compat (#​173).
• Random heredoc delimiters prevent model-controlled text from injecting step outputs.

Docs

• Local-model troubleshooting guide, smoke-test repo fix, run_command documentation (#​180); review guidance tuning (#​161).

New inputs

verdict_policy, inline_findings, inline_findings_max, review_routing_mode, ai_fast_model/ai_fast_base_url/ai_fast_api_format/ai_fast_api_key, ai_smart_model/ai_smart_base_url/ai_smart_api_format/ai_smart_api_key, escalate_on_risk_flags, escalate_on_incomplete_required_checks, escalate_on_fast_request_changes, escalate_on_fast_low_confidence, escalate_on_tool_or_evidence_blockers, validate_required_checks, required_check_validation_mode, model_context_tokens, ai_response_format, ai_temperature, ai_tokens_param, on_model_failure, ci_status_check/ci_timeout_sec/ci_interval_sec/ci_skip_on_timeout, review_scope.

New outputs: findings, verdict_source, required_checks, review_route, escalation_reason, effective_review_scope, ci_status_skipped, ci_status_final.

Behavior notes

• review_scope defaults to auto: full review first, then incremental reviews on later pushes when safe — a meaningful token saving on long-lived PRs.
• tool_planning_timeout_sec documentation now matches the actual default (60s).

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[its-miso]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: review@https://litellm.jory.dev/v1 (openai)

Recommendation

Approved. This is a routine dependency update for the misospace/pr-reviewer-action GitHub Action, moving from v1.1.5 to v1.2.0 via a specific commit SHA.

Change-by-change findings

• .github/workflows/ai-pr-review.yaml: Updated the uses field for misospace/pr-reviewer-action from the v1.1.5 tag to the v1.2.0 commit SHA (ff03870002ecee692bfcfe9ad6e5dd1cb3ddd). This ensures the workflow uses the latest feature-heavy release.

Linked Issue Fit

• The PR is a Renovate-style automated update. The release notes indicate that v1.2.0 is a backward-compatible minor release, which aligns with the goal of updating dependencies without breaking existing workflows.

Evidence Provider Findings

• GitHub Release Data: Verified that v1.2.0 exists and is a non-prerelease, immutable release published on 2026-06-10. The release notes confirm backward compatibility for existing inputs.
• Warning Check: A warning was noted during the automated process: Could not determine new digest for update. This is common for GitHub Actions and does not block the update.

Standards Compliance

• Dependency Updates: The update follows the repository's semver-based release process.
• Security: The update uses a specific commit SHA for the action, which is a best practice for pinning dependencies to prevent unexpected changes from upstream tags.