mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 13:27:45 +00:00
Daan De Meyer
7c1609b4c2
Replace opaque built-in review behavior with explicit parallel review lenses for correctness, concurrency, security, architecture, coding style, and regression coverage, plus bounded domain-specific reviewers and independent validation. Prefetch pull request discussion in the setup job while letting the read-only review job fetch and inspect the full commit history without per-commit worktrees. Keep GitHub writes isolated to the setup and posting jobs, pin the Claude models and CLI, and bound execution below the AWS credential lifetime. Materialize review instructions from the trusted base revision and scope agent writes to the structured result directory so untrusted pull request content cannot widen the review authority. Treat the posting job as the authoritative trust boundary: validate all model-selected commits, paths, lines, and thread IDs, normalize degenerate line ranges, bound sanitized output, and surface GitHub API failures in the tracking comment before performing writes. Retain daandemeyer/systemd in the repository allowlist so the workflow can be exercised end to end on the personal fork. Manual runs against fork PR #15 covered OIDC authentication, sandboxing, result artifact handoff, tracking-comment updates, and validation of posted output. Signed-off-by: Daan De Meyer <daan@amutable.com>