feat(pr-review): flag unpinned third-party actions and harden the review prompt against injection#252

Open

Fieldnote-Echo wants to merge 6 commits into

OpenHands:mainfrom

Fieldnote-Echo:security/pr-review-sha-pin-prompt

Commits on May 20, 2026

feat(pr-review): flag unpinned third-party actions in workflow PRs
Fieldnote-Echo
committed
fix(pr-review): harden the review prompt against PR-content injection
Fieldnote-Echo
committed
fix(pr-review): extend injection hardening to review_context, widen nonce
Fieldnote-Echo
committed
test(pr-review): adversarial injection tests for the hardened prompt
Fieldnote-Echo
committed
fix(pr-review): correct the injection-eval judge and add a local backend
Fieldnote-Echo
committed
chore(pr-review): drop now-unused re import from injection eval
Fieldnote-Echo
committed