Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@ Each example includes a complete workflow file that you can copy to your `.githu
| `pull_number` | The number of the pull request being reviewed | Yes | `${{ github.event.pull_request.number }}` |
| `repo_name` | The full name (owner/repo) of the repository | Yes | `${{ github.repository }}` |
| `custom_guidelines` | Custom guidelines to include in PR reviews | No | See [Custom Guidelines](#custom-guidelines) section |
| `model` | Optional model name to use; passed directly to augment agent | No | e.g. `sonnet4`, from `auggie --list-models` |

## How It Works

Expand Down
6 changes: 5 additions & 1 deletion action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ inputs:
custom_guidelines:
description: "Optional custom guidelines to include in the PR review process. These will be added to the default guidelines."
required: false
model:
description: "Optional model name to use; passed directly to augmentcode/augment-agent."
required: false

runs:
using: "composite"
Expand All @@ -44,11 +47,12 @@ runs:
CUSTOM_GUIDELINES: ${{ inputs.custom_guidelines }}

- name: Run Augment Agent
uses: augmentcode/augment-agent@6f08f56902d6728a0ffbbb2004c136c06fec8104 # v0.1.0
uses: augmentcode/augment-agent@v0
with:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security and reproducibility nit: consider pinning the action to a commit SHA instead of a floating tag. Using @v0 can pick up changes unexpectedly, which makes builds harder to reproduce and increases supply-chain risk.

For example, pin to a known-good commit (the repo previously used a pinned SHA):

uses: augmentcode/augment-agent@6f08f56902d6728a0ffbbb2004c136c06fec8104

If you still prefer auto-updates, consider at least a specific minor version tag (e.g., v0.1.x) and monitor with Dependabot/Actions review, acknowledging the trade-offs.

augment_session_auth: ${{ inputs.augment_session_auth }}
github_token: ${{ inputs.github_token }}
template_directory: "${{ github.action_path }}/templates"
pull_number: ${{ inputs.pull_number }}
repo_name: ${{ inputs.repo_name }}
custom_context: ${{ steps.custom_context.outputs.context }}
model: ${{ inputs.model }}