security-review.yml

name: Security Review
on:
  pull_request_target:
    types: [opened, reopened]
  issue_comment:
    types: [created]

jobs:
  security-review:
    runs-on: ubuntu-latest
    # Always runs on PR creation
    # Also runs if comment on PR contains "/security-review"
    if: >
      github.event_name == 'pull_request' ||
      (
        github.event_name == 'issue_comment' &&
        github.event.issue.pull_request != null &&
        contains(github.event.comment.body, '/security-review')
      )
    permissions:
      issues: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install litellm PyGithub
      - name: Run security review agent
        env:
          IGNORED_EXTENSIONS: .lock,.sum
          IGNORED_FILENAMES: package-lock.json,yarn.lock,poetry.lock,Gemfile.lock,Cargo.lock,composer.lock,pnpm-lock.yaml,pip.lock
          MAX_PATCH_CHARS_PER_FILE: 3000
          # e.g: "claude-sonnet-4-6", "gpt-4o", etc.
          MODEL: ${{ secrets.MODEL }}
          # Only API key for the chosen model is required
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          # Obtained automatically by GH Actions
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
          REPO_NAME: ${{ github.repository }}
          TRIGGER: ${{ github.event_name }}
        run: python scripts/agents/security_review_agent.py