Conversation
Updates checkout (v4->v7), setup-python (v5->v6), upload-artifact (v4->v7), download-artifact (v4->v8), and the docker actions (buildx v3->v4, login v3->v4, metadata v5->v6, build-push v6->v7) to their latest majors, which run on Node 24 and silence the runner deprecation warning.
The reviewer only sees the diff, so it was emitting confident Critical/Medium findings on things it could not actually check - most notably dependency version claims (a false "requires SDK 2.x" Critical on whisper-service#32). Three changes: 1. Verifiability guardrail. New system-prompt rule: a finding may not be critical/medium if it rests on something outside the diff/guidance/manifests; it must be a nit (or go in "skipped"). A deterministic backstop (downgrade_unverifiable) caps any critical/medium whose own body admits it could not be verified down to nit, annotated. 2. Dependency-manifest context. When the diff adds imports or edits a manifest (diff_touches_dependencies), fetch the declared manifests at the PR head - searching the changed files' own directories plus the repo root, discovered via one recursive git-tree call - and feed them to the model so version/ import claims are checked against real declared versions. Lockfiles excluded; each manifest truncated. 3. Fix a latent guidance bug. read_guidance/read_dependency_manifests used `Accept: raw` + `-q .`, which makes gh try to jq-parse non-JSON file bytes and silently return nothing - so AGENTS.md/CLAUDE.md never reached the model on repos that have them. Both now use the JSON contents API and base64-decode, which also correctly handles JSON manifests like package.json. Verified on the original failure case (whisper-service#32): the false Critical is gone (model cites "sentry-sdk 2.19.2 is in requirements.txt"), and a real diff-verifiable Medium surfaced instead. Full gate green (220 tests, ruff, mypy).
Reviews posted as the user should read like the user wrote them. Remove the 🔴/🟠/🟡 circle markers from finding labels and the summary tally, keeping the plain Critical/Medium/Nit labels (bold in context) and turning the recap into a clean bulleted list. The prior-thread severity parser in hosts.py keyed off the emoji; make the emoji optional so re-reviews still parse both older (emoji) and newer (plain) comments. Full gate green (222 tests, ruff, mypy).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v1.7.0
Minor release: backward-compatible feature additions, a bug fix, and a review-output style change. No breaking changes to the CLI or public API.
Dependency-aware, false-positive-resistant reviews (
96a08c1)downgrade_unverifiable) that caps any self-admitted-unverifiable finding to a non-blocking nit.read_guidance/manifest reads usedAccept: raw+-q ., which madeghtry tojq-parse non-JSON file bytes and silently return nothing - soAGENTS.md/CLAUDE.mdnever actually reached the model on repos that have them. Both now use the JSON contents API + base64 decode (also handles JSON manifests likepackage.json).Verified on the original failure case (whisper-service#32): the old false Critical is gone (model cites "sentry-sdk 2.19.2 is in requirements.txt") and a real diff-verifiable Medium surfaced instead.
Human-looking reviews (
bcaa3bb)Housekeeping
590d281).Full gate green: 222 tests, ruff, mypy.