Skip to content

ci: use Opus 5 for PR review and mount upstream ANTLR for comparison #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tinovyatkin merged 1 commit into from
Jul 24, 2026
Merged

ci: use Opus 5 for PR review and mount upstream ANTLR for comparison #189

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 26 additions & 1 deletion .github/workflows/claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,23 @@ jobs:
with:
fetch-depth: 0

# This runtime is a port of ANTLR's reference implementation, so a faithful
# review of changes to the ported algorithms usually needs to compare
# against upstream behavior. Clone the reference tree into a side directory
# (kept out of the checkout above via a distinct `path`) the reviewer can
# read and grep. Pinned to the v4.13.2 tag the runtime targets everywhere
# else (see CLAUDE.md) — `master`/`dev` would surface post-4.13.2 changes a
# reviewer could wrongly flag as divergence. Shallow single-tag snapshot:
# the reviewer reads source, not git history. The directory name is
# deliberately non-hidden so ripgrep-backed search (Grep) descends into it.
- name: Checkout upstream ANTLR (reference for review comparisons)
uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Files:"
git ls-files | rg '(^|/)(claude-code-review\.yml|policy|security|README|SECURITY|CODEOWNERS|zizmor|unpin|pinned|workflow)' || true

echo
echo "Workflow around checkout:"
if [ -f .github/workflows/claude-code-review.yml ]; then
  nl -ba .github/workflows/claude-code-review.yml | sed -n '1,140p'
fi

echo
echo "Search unpinned policy/terms:"
rg -n -i "unpin|pinned|pinned action|full commit sha|immutable|checkout|zizmor|actions/checkout|tag|sha" .github README.md SECURITY.md CODEOWNERS 2>/dev/null | head -200 || true

Repository: ophi-dev/antlr-rust-runtime

Length of output: 847

🌐 Web query:

actions checkout v7 release commit SHA

💡 Result:

The release v7.0.0 of actions/checkout was published on June 18, 2026 [1]. The commit SHA for this specific tag (v7.0.0) is 3d3c42e5aac5ba805825da76410c181273ba90b1 [2]. As of today, July 24, 2026, the latest release in the v7 series is v7.0.1, which was released on July 20, 2026 [3][4]. You can always verify the most current commit SHAs by checking the tags page in the official GitHub repository [3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflows:"
for f in .github/workflows/*.yml; do
  printf '\n--- %s ---\n' "$f"
  awk '{printf "%5d  %s\n", NR, $0}' "$f" | sed -n '1,140p'
done

echo
echo "README/SECURITY/CODEOWNERS/policy files:"
for f in README.md SECURITY.md CODEOWNERS .github/dependabot.yml; do
  if [ -f "$f" ]; then
    printf '\n--- %s ---\n' "$f"
    awk '{printf "%5d  %s\n", NR, $0}' "$f" | sed -n '1,220p'
  else
    echo "missing: $f"
  fi
done

echo
echo "Policy-related text:"
rg -n -i "unpin|pinned|pinned action|full commit sha|immutable|checkout|zizmor|github actions security|actions/checkout|`@v`" README.md .github 2>/dev/null || true

Repository: ophi-dev/antlr-rust-runtime

Length of output: 50385

🌐 Web query:

GitHub actions checkout v7.0.1 commit SHA actions/checkout v7.0.1

💡 Result:

The GitHub Actions checkout action version v7.0.1 corresponds to the commit SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 [1]. This release was published on July 20, 2026 [2][3]. The commit associated with this release, titled "prep v7.0.1 release (#2531)", finalized the version bump from v7.0.0 to v7.0.1 [4][1].

Citations:

Pin the checkout action to an immutable commit SHA.

actions/checkout@v7 is an unpinned branch/tag reference. Replace it with the current full-length commit SHA for the desired v7 commit and leave the version in a comment.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 53-53: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/claude-code-review.yml at line 53, Update the
actions/checkout step in the workflow to reference the desired v7 release using
its full immutable commit SHA instead of the mutable actions/checkout@v7 tag,
and retain the version identifier in an inline comment.

Source: Linters/SAST tools

with:
repository: antlr/antlr4
ref: "4.13.2"
path: antlr-upstream
fetch-depth: 1
Comment on lines +52 to +58

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable credential persistence for the reference checkout.

This checkout is read-only and public, so add persist-credentials: false. The following Claude step can inspect the workspace, making an unnecessary persisted token an avoidable exposure. The checkout action documents this input as the opt-out for persisted credentials. (github.com)

Proposed fix 
         with:
           repository: antlr/antlr4
           ref: "4.13.2"
           path: antlr-upstream
           fetch-depth: 1
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Checkout upstream ANTLR (reference for review comparisons)
uses: actions/checkout@v7
with:
repository: antlr/antlr4
ref: "4.13.2"
path: antlr-upstream
fetch-depth: 1
- name: Checkout upstream ANTLR (reference for review comparisons)
uses: actions/checkout@v7
with:
repository: antlr/antlr4
ref: "4.13.2"
path: antlr-upstream
fetch-depth: 1
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 52-58: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 53-53: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/claude-code-review.yml around lines 52 - 58, Add
persist-credentials: false to the actions/checkout step named “Checkout upstream
ANTLR (reference for review comparisons),” while preserving its existing
repository, ref, path, and fetch-depth settings.

Sources: MCP tools, Linters/SAST tools


- name: Install Dependencies
run: |
sudo apt-get update
Expand Down Expand Up @@ -90,7 +107,7 @@ jobs:
use_sticky_comment: true
claude_args: |
--effort max
--model "claude-opus-4-8[1m]"
--model "claude-opus-5[1m]"
--no-chrome
--dangerously-skip-permissions
plugins: "code-review@claude-code-plugins"
Expand All @@ -104,6 +121,14 @@ jobs:
prompt: |
/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}

UPSTREAM REFERENCE: This crate ports ANTLR (antlr/antlr4). A read-only
checkout of tag v4.13.2 — the version it targets — is at `antlr-upstream/`
(Java runtime: `runtime/Java/src/org/antlr/v4/runtime/`; generator:
`tool/`). For changes to ported logic (ATN/prediction, lexer/parser
simulation, serialized-ATN decoding, generated-code shape), compare
against it and cite the upstream file:line. Flag unintended divergence
from ANTLR semantics; treat documented deviations as intentional.

IMPORTANT (non-interactive CI run): You cannot pause and resume. Any
sub-agents you spawn return their results synchronously within this same
session — never end your turn saying you will "wait for" them. Once their
Expand Down
Loading