feat: add marketplace PR auto-review and merge workflow#1638
Merged
Conversation
PIV Task 1: Bun script that downloads marketplace entry source files at pinned SHA via GitHub Contents API, preserving directory structure.
PIV Task 2: Bun script that validates all .yaml files in source artifacts against the Archon workflow schema using parseWorkflow.
PIV Task 3: deterministic regex/heuristic scanner with 9 categories (rce, exfil, reverse_shell, cred_leak, obfuscation, unsafe_permissions, path_escape, shell_exec, suspicious_network). Reads $ARTIFACTS_DIR/source/ recursively, outputs JSON with severity + findings. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PIV Task 4: 9 malicious fixtures (one per scanner category), 3 benign fixtures (zero false positives), empty-dir test. All 13 tests pass.
PIV Task 5: DAG workflow with 9 nodes — fetch PR metadata, verify scope, parse entry, fetch source, validate schema + security scan (parallel), AI review, decide, and act (post GitHub review).
PIV Task 6: Triggers on PRs touching marketplace.ts, runs the marketplace-pr-review-and-merge workflow via CLI.
…igger Changes: - Switch GH Action from pull_request to pull_request_target for fork PR secret access - Add ANTHROPIC_API_KEY and contents:write permission to GH Action - Add auto_merge decision: clean PRs (scan none + AI approval) are auto-merged - Update ai-review prompt and output_format with auto_merge recommendation - Update decide script with 4-value decision matrix (no trust gating) - Add auto_merge case arm to act node with squash merge Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (18)
📝 WalkthroughWalkthroughThis PR introduces a complete automated marketplace submission system: benign and malicious test fixtures, a security scanner using regex pattern detection, a schema validator for workflow YAML, a source fetcher from GitHub, comprehensive tests, an orchestration workflow for PR review and merge decisions, and a GitHub Actions trigger. ChangesMarketplace Submission Automation System
Sequence DiagramssequenceDiagram
participant GH as GitHub PR
participant Fetch as Fetch Metadata
participant Scope as Scope Check
participant Parse as Parse Entry
participant Source as Fetch Source
participant Schema as Validate Schema
participant Scan as Security Scan
participant AI as AI Review
participant Decide as Decision Logic
participant Act as Take Action
GH->>Fetch: Trigger on PR opened/updated
Fetch->>Scope: PR metadata ready
Scope->>Parse: Scope OK?
Parse->>Source: Entry extracted
Source->>Schema: Source downloaded
Source->>Scan: Source downloaded
Schema-->>AI: Valid?
Scan-->>AI: Findings & severity
Parse-->>AI: Entry details
Fetch-->>AI: PR metadata
AI->>Decide: Risk assessment
Decide->>Act: Decision (merge/approve/changes)
Act->>GH: Submit review & merge if approved
sequenceDiagram
participant Job as Workflow Job
participant Entry as entry.json
participant GH as GitHub API
participant Local as Local Filesystem
Job->>Entry: Read sourceUrl & sha
Entry-->>Job: GitHub blob or tree URL
Job->>GH: gh api fetch at ref
alt Blob URL
GH-->>Job: Single file content
Job->>Local: Save file
else Tree URL
GH-->>Job: Directory contents listing
loop Each item recursively
Job->>GH: Fetch item content
GH-->>Job: Base64-encoded file
Job->>Local: Decode and save
end
end
Job-->>Job: Collect files and errors
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Merged
cropse
pushed a commit
to cropse/Archon
that referenced
this pull request
May 19, 2026
* feat: add marketplace-fetch-source script PIV Task 1: Bun script that downloads marketplace entry source files at pinned SHA via GitHub Contents API, preserving directory structure. * feat: add marketplace-validate-schema script PIV Task 2: Bun script that validates all .yaml files in source artifacts against the Archon workflow schema using parseWorkflow. * feat: add marketplace-security-scan script PIV Task 3: deterministic regex/heuristic scanner with 9 categories (rce, exfil, reverse_shell, cred_leak, obfuscation, unsafe_permissions, path_escape, shell_exec, suspicious_network). Reads $ARTIFACTS_DIR/source/ recursively, outputs JSON with severity + findings. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test: add marketplace-security-scan tests and fixtures PIV Task 4: 9 malicious fixtures (one per scanner category), 3 benign fixtures (zero false positives), empty-dir test. All 13 tests pass. * feat: add marketplace-pr-review-and-merge workflow PIV Task 5: DAG workflow with 9 nodes — fetch PR metadata, verify scope, parse entry, fetch source, validate schema + security scan (parallel), AI review, decide, and act (post GitHub review). * feat: add GitHub Actions trigger for marketplace auto-review PIV Task 6: Triggers on PRs touching marketplace.ts, runs the marketplace-pr-review-and-merge workflow via CLI. * feat: add auto-merge for clean submissions and pull_request_target trigger Changes: - Switch GH Action from pull_request to pull_request_target for fork PR secret access - Add ANTHROPIC_API_KEY and contents:write permission to GH Action - Add auto_merge decision: clean PRs (scan none + AI approval) are auto-merged - Update ai-review prompt and output_format with auto_merge recommendation - Update decide script with 4-value decision matrix (no trust gating) - Add auto_merge case arm to act node with squash merge Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packages/docs-web/src/data/marketplace.ts) require manual maintainer review for safety and schema correctness.marketplace-pr-review-and-merge) that fetches PR metadata, verifies scope, parses the new entry, downloads source at pinned SHA, runs parallel schema validation and deterministic security scanning, runs a Haiku AI review, decides an action, and posts a GitHub review comment.@archon/*package code was modified — this is entirely workflow/script/CI additions.UX Journey
Before
After
Architecture Diagram
Before
After
Connection inventory:
Label Snapshot
risk: lowsize: Lworkflows,ci,testsworkflows:maintainer,ci:marketplaceChange Metadata
featureworkflowsLinked Issue
Validation Evidence (required)
All six checks passed: check:bundled, check:bundled-skill, type-check, lint, format:check, tests (including 13 new marketplace-security-scan tests).
none.Security Impact (required)
pull-requests: writeto post review comments and close PRs.marketplace-fetch-source.tscalls GitHub Contents API viagh api(authenticated, rate-limited at 5000/hr).GITHUB_TOKENfrom Actions environment, never logged.$ARTIFACTS_DIRonly (per-run ephemeral directory).pull-requests: writeis the minimum needed for v0 (review-only). Auto-merge deferred to v1 whencontents: writeis needed.Compatibility / Migration
Human Verification (required)
bun run cli validate workflows), scanner correctly catches all 9 malicious categories and zero benign false positives.GH_TOKEN).Side Effects / Blast Radius (required)
suspicious_networkpattern could false-positive if a benign submission fetches from a non-allowlisted but legitimate host. Maintainer can override by manually approving.Rollback Plan (required)
.archon/workflows/maintainer/marketplace-pr-review-and-merge.yamland.github/workflows/marketplace-auto-review.yml— stops all automation immediately.Risks and Mitigations
execFileSync(shell_exec pattern)child_process\.exec\(notexecFileSync. Verified by benignclean-script.tsfixture test.suspicious_networkfalse positives ongithub.comURLsgithub.comandarchon.diy. Verified byclean-fetch.tsfixture test.gh apiuses authenticated requests (5000 req/hr).Summary by CodeRabbit
New Features
Tests