[CI] ci: add @aiter-bot review (self-hosted GLM PR reviewer)

[zufayu]

Why aiter-bot (and not just Copilot review)

	Copilot review	aiter-bot
Domain knowledge	generic model reading the diff	SKILL.md / rules.md — aiter failure modes distilled from 200+ merged PRs (dispatch gate holes, gfx arch gating, tuned-config collisions, perf-claim scrutiny, AI-code tells)
Evidence	reads the diff; executes nothing — every claim unverified	can run the PR's test target base-vs-head on a locked GPU and time it (deterministic correctness + perf, with a reproducer) when validation is enabled — opt-in, off by default; otherwise runtime claims are marked [inferred]
Self-check	emits; does not audit itself	an independent refuter (a second GLM pass by default; cross-family with an Opus endpoint is stronger) kills false positives, then 7 mechanical gates check every finding is grounded (citations anchor to changed files, evidence exists, verdicts match runtime state)
Cost / privacy	always-on SaaS; code leaves your boxes	on-demand, self-hosted runner + your own model — code never leaves your infra
Ownership	black box	the methodology is a skill in this repo you own and evolve

Advisory and complementary — not a Copilot replacement.

---

What it is

Comment @aiter-bot review on any PR and aiter-bot posts one review card. Push fixes and comment again for a fresh pass — the same commit is deduped, so it never spams. One command, nothing else to remember. Runs on a self-hosted runner, posts as the aiter-bot account, and is advisory — it never gates merge.

How it works

flowchart TD
    A["aiter-team member comments:<br/><b>@aiter-bot review</b> on a PR"] --> B{"Gate: commenter on the<br/>allowlist? real trigger line?<br/>(quoted '&gt;' lines ignored)"}
    B -- no --> Z["ignored (just a notice)"]
    B -- yes --> C["aiter-bot adds a 👀 reaction"]
    C --> D["self-hosted runner (box308)"]
    D --> E["fetch: PR diff, merge-target<br/>worktree, validation triage"]
    E --> F["GLM worker &rarr; review card<br/>(SKILL.md Steps 1b&ndash;8)"]
    F --> G["independent refuter (Step 7.7)<br/>&mdash; a second pass kills false positives"]
    G --> H["7 gates verify the card"]
    H --> V{"review verdict"}
    V -- "&check; no findings / &#9888; needs work" --> P["aiter-bot posts the card on the PR"]
    V -- "&#128308; HIGH RISK" --> R["posted too (advisory) +<br/>a HIGH RISK warning<br/>annotation in the checks"]
    P -. "push fixes, comment<br/><b>@aiter-bot review</b> again<br/>(new head &rarr; fresh pass,<br/>same commit &rarr; deduped)" .-> A

Loading

Each run posts one card: a one-line summary, a Review / Validation / Perf verdict line, and ≤5 ranked findings (problem → impact → Author must… / Reviewer should ask…, each tagged [verified] / [inferred]). A 🔴 HIGH RISK card is posted too — it is exactly what the reviewer asked to see — and stays advisory (never a merge gate); a warning annotation also flags it in the checks.

Example review

A real card aiter-bot posted for PR #5599 (a data-only config PR, so validation/perf are correctly NOT RUN, with one [verified] process finding):

ROCm/aiter PR #5599 — [Config] configs: GLM-5.3 routed MoE rows for gfx950

Adds a gfx950-specific GLM-5.3-Flash fused-MoE tuned-config table (six rows: M=4/8 → one-stage 16x128, M=2048–16384 → one-stage 64x256) plus its 15-shape untuned tuner-input ladder, moving that dispatch key off the generic fallback kernel.

Review (advisory): ⚠️ NEEDS WORK
Validation (deterministic): NOT RUN — triage required a target but the PR ships none; the changed paths are a tuned-config table plus its untuned tuner input — data-only, nothing a test target could cover, so the missing target is not a defect on this diff
Perf (advisory): NOT RUN — the PR ships no benchmark entry point, and it cannot be re-measured on this box (gfx942-only; the rows are gfx950-only)

📝 [verified] The duplicate-shape guard for the tuned_fmoe config family runs only in the daily Tuning Tests job, not in PR CI, so nothing enforces no-collision for the new CSV against config PRs landing while this one sits in queue — a racing duplicate dispatch key would make the first fused-MoE call on main raise RuntimeError and auto-rewrite the installed CSVs. Reviewer should ask for a fresh guard run (or a green post-merge Tuning Tests result) before relying on the new rows.

Who can use it, & safety

• Who can trigger it — set the AITER_REVIEW_AUTHORIZED repo variable (required): the job runs only for the comma-separated GitHub logins in that variable, checked at the job level before any checkout, so an unlisted commenter never starts a runner job. Until you set it, the bot ignores every comment — no spam, but no reviews either. authorized.txt in the skill dir seeds the initial list (zufayu) and is re-checked (exact match) inside the job; copy its logins into the variable at merge. A command in a quoted (>) line is ignored.
• Inert until merged to the default branch (issue_comment only triggers from there). The box308 runner and aiter-bot token are already provisioned — safe to merge and wire incrementally.
• permissions: contents: read; comments use the aiter-bot token, not GITHUB_TOKEN.
• By default reads the PR diff as data and executes no PR code (REVIEW_AUTO_VALIDATE=0); enabling validation (opt-in, per-need) runs the PR's own test target on a locked GPU. Runs in the base (main) context; comment body read via env, not shell-interpolated.
• The review agent runs headless (--dangerously-skip-permissions) and reads the PR diff, title and description as prompt input — untrusted content from any PR author, so indirect prompt injection is in scope. Containment relied on: the aiter-bot token is never in the review step's environment (only the claim / publish / notify steps carry it), the runner is a dedicated self-hosted box, and no PR code runs by default. Keep the runner's credentials and network egress minimal — the agent's blast radius is that box. Because the agent can read the runner account's files (not just its environment), that account's GitHub credential should be a dedicated read-only token (e.g. the aiter-bot public_repo PAT), never a personal one.