[dschuff]

This tool runs an antigravity github action with a custom prompt that will post review comments on PRs. It's currently configured to run automatically on PRs posted by contributors, and will run on-demand when a contributor posts a comment with the content "/review"

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-actions]

🤖 Google Antigravity Code Review

I have reviewed the changes in this Pull Request and left inline feedback.

[dschuff]

This is another option for automated review. It looks like it works purely from actions. I tried it in my fork and it seems to work. Reviews look like this.

[tlively]

Cool, should we just enable this in addition to Gemini Code Assist and see which one is better? @kripken

[kripken]

Definitely worth experimenting with, but according to the bot's own feedback, (1) this risks exposing the secret key, and (2) does not expose the secret key so external PRs will not get reviewed. Do these not contradict each other..? 😆 Also, each sounds rather serious...

[dschuff]

The first comment is not about exposing the key per se, but allowing anyone to post a comment and trigger review on a PR that they don't own. As the comment notes, this allows redundant overuse of the API but not key leaks. Because the 3rd comment is also correct; secrets are not passed to forked pull requests. This seems more problematic actually, and maybe it's the real reason why a Github App like Gemini Code Assist could be better for external reviews. Let me see if there's a solution here.

[dschuff]

OK actually there's one additional subtlety here:

1. workflows run on: pull_request run in the untrusted context of the external fork, so no secrets get passed and review won't work directly.
2. on: issue_comment runs on main in the base repository, so it does have access to repository secrets. So as mentioned above the risk isn't secret leakage but quota abuse. But it does mean that we can still cause reviews to happen on forked PRs by adding the /review comment. I just uploaded a commit that adds extra checks to limit who can trigger the reviews. It also fixes the checkout so we get the PR commit even when triggered by the comment (that's comment 2).

[dschuff]

/review

[github-actions]

🤖 Google Antigravity Code Review

I have reviewed the changes in this Pull Request and left inline feedback.

[dschuff]

Fixed these issues. IIUC this will automatically trigger a review for non-forked PRs for contributors, but we could also just only trigger reviews via comments for everyone.

[tlively]

/review

[dschuff]

Interesting that the review is triggered by your comment, but then it doesn't post that it actually reviewed and didn't find anything, you have to look at the log to see it.

[tlively]

LGTM for experimentation.

[dschuff]

One thing to clarify before we land it: Would you prefer to have it automatically run for collaborators, or make it only review on demand even for us?

[tlively]

Automatically running is fine for now. I expect we'll fine tune all this once we have more experience with the different tools.