From 2c0ada172a692cbb2b518464767f22c072a4e6ef Mon Sep 17 00:00:00 2001 From: Jakob Ankarhem Date: Mon, 7 Sep 2026 17:31:30 +0200 Subject: [PATCH] ci(review): cap review jobs at 15 minutes and deduplicate prompt Add timeout-minutes: 15 to all three AI review jobs so a hung reviewer cannot burn runner minutes indefinitely, and hoist the duplicated OpenCode review prompt into a workflow-level REVIEW_PROMPT env variable referenced by both jobs. --- .github/workflows/review.yml | 77 +++++++++++++++--------------------- 1 file changed, 31 insertions(+), 46 deletions(-) diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml index 69a8b0f..b285aec 100644 --- a/.github/workflows/review.yml +++ b/.github/workflows/review.yml @@ -12,6 +12,32 @@ concurrency: permissions: contents: read +# Shared review prompt for the OpenCode-based reviewer jobs. +env: + REVIEW_PROMPT: | + Review this pull request. Do not modify any files — review only. + + Approach: + - Read the PR description and the full diff before commenting; understand the intent of the change. + - Verify claims by reading the surrounding code, not just the diff hunks. If you are unsure whether something is a real bug, investigate before flagging it. + + Report only issues that matter: + - Architectural issues: breaks SOLID principles, it should be elegant, extensible, maintainable and testable code + - Correctness: bugs, broken logic, unhandled errors, edge cases + - Security: leaked secrets or credentials, injection, unsafe permissions + - Breaking changes: API, CLI, or config changes that break existing users or workflows + - Performance or resource problems introduced by this change + - Missing test coverage for significant new behavior + + Do not: + - Restate or summarize the diff + - Add praise or filler + + Output: + - One comment, most important issues first. + - For each issue: file and line, what is wrong, why it matters, and a concrete suggested fix. + - If the PR is good, say so in one or two sentences and stop. + jobs: opencode-review: # Skip automated branches (e.g. dependency bots) and untrusted authors. @@ -19,6 +45,7 @@ jobs: !startsWith(github.event.pull_request.head.ref, 'auto/') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association || '') runs-on: ubuntu-latest + timeout-minutes: 15 permissions: id-token: write # required by the opencode action contents: read @@ -43,29 +70,7 @@ jobs: ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }} with: model: zai-coding-plan/glm-5.3-flash - prompt: | - Review this pull request. Do not modify any files — review only. - - Approach: - - Read the PR description and the full diff before commenting; understand the intent of the change. - - Verify claims by reading the surrounding code, not just the diff hunks. If you are unsure whether something is a real bug, investigate before flagging it. - - Report only issues that matter: - - Architectural issues: breaks SOLID principles, it should be elegant, extensible, maintainable and testable code - - Correctness: bugs, broken logic, unhandled errors, edge cases - - Security: leaked secrets or credentials, injection, unsafe permissions - - Breaking changes: API, CLI, or config changes that break existing users or workflows - - Performance or resource problems introduced by this change - - Missing test coverage for significant new behavior - - Do not: - - Restate or summarize the diff - - Add praise or filler - - Output: - - One comment, most important issues first. - - For each issue: file and line, what is wrong, why it matters, and a concrete suggested fix. - - If the PR is good, say so in one or two sentences and stop. + prompt: ${{ env.REVIEW_PROMPT }} muse-review: # Muse Spark 1.3 via the OpenCode Zen contributor-free route (billed to the @@ -79,6 +84,7 @@ jobs: !startsWith(github.event.pull_request.head.ref, 'auto/') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association || '') runs-on: ubuntu-latest + timeout-minutes: 15 permissions: id-token: write # required by the opencode action contents: read @@ -103,29 +109,7 @@ jobs: OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} with: model: opencode/muse-spark-1.3-contributor-free - prompt: | - Review this pull request. Do not modify any files — review only. - - Approach: - - Read the PR description and the full diff before commenting; understand the intent of the change. - - Verify claims by reading the surrounding code, not just the diff hunks. If you are unsure whether something is a real bug, investigate before flagging it. - - Report only issues that matter: - - Architectural issues: breaks SOLID principles, it should be elegant, extensible, maintainable and testable code - - Correctness: bugs, broken logic, unhandled errors, edge cases - - Security: leaked secrets or credentials, injection, unsafe permissions - - Breaking changes: API, CLI, or config changes that break existing users or workflows - - Performance or resource problems introduced by this change - - Missing test coverage for significant new behavior - - Do not: - - Restate or summarize the diff - - Add praise or filler - - Output: - - One comment, most important issues first. - - For each issue: file and line, what is wrong, why it matters, and a concrete suggested fix. - - If the PR is good, say so in one or two sentences and stop. + prompt: ${{ env.REVIEW_PROMPT }} claude-review: # Skip automated branches (e.g. dependency bots) and untrusted authors. @@ -133,6 +117,7 @@ jobs: !startsWith(github.event.pull_request.head.ref, 'auto/') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association || '') runs-on: ubuntu-latest + timeout-minutes: 15 permissions: contents: read pull-requests: write -- 2.54.0