Add Pullfrog AI Review + Continue Agent Config - #3
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThis PR adds AI-assisted development tooling: a Continue agent configuration for local code completion and editing using DeepInfra and DeepSeek models, and a Pullfrog GitHub Actions workflow for automated pull request reviews powered by OpenRouter, with supporting documentation. ChangesContinue Agent Configuration
Pullfrog AI Review Automation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.continue/agents/new-config.yaml:
- Around line 25-32: The config still has a top-level tabAutocompleteModel; move
it into the existing models array instead: locate the tabAutocompleteModel block
and either add "autocomplete" to the roles array on the existing model entry for
"DeepSeek V4 Flash" (which already uses apiBase: "https://api.deepseek.com/v1"
and has contextLength) or create a new models entry with the same
provider/name/model/apiBase/contextLength and roles: [autocomplete], then remove
the top-level tabAutocompleteModel entry so all model definitions live under
models.
In @.github/workflows/pullfrog.yml:
- Around line 18-22: The workflow step "Run Pullfrog Agent" currently uses the
mutable ref pullfrog/pullfrog-action@main; change it to a pinned full commit SHA
instead (replace the `@main` ref in the uses field for the
pullfrog/pullfrog-action step with the action repository's specific commit SHA)
so the action cannot change unexpectedly; keep the existing env entries
(GITHUB_TOKEN and OPENROUTER_API_KEY) as-is and ensure you copy the exact full
commit SHA from the pullfrog/pullfrog-action repo when updating the uses line.
- Around line 13-16: The checkout step ("Checkout Code") currently uses
actions/checkout@v4 and leaves credentials persisted; update the step to set
persist-credentials: false to prevent GITHUB_TOKEN from being written to
.git/config (replace or add the input key persist-credentials: false under the
actions/checkout@v4 step) and optionally pin the action to a specific commit SHA
instead of the tag to comply with unpinned-action policy (change uses:
actions/checkout@v4 to uses: actions/checkout@<commit-sha>).
- Line 11: The current if condition uses github.event.issue.pull_request which
is truthy for any PR comment and short-circuits the mention check; replace the
logic so PR comment events are gated by the mention: require
contains(github.event.comment.body, '`@pullfrog`') when
github.event.issue.pull_request is present, while still allowing normal
pull_request events (github.event_name == 'pull_request'). Update the
conditional that references github.event.issue.pull_request, github.event_name,
and github.event.comment.body so it only triggers on PR comments when the
comment body contains '`@pullfrog`' and continues to trigger for direct
pull_request events.
- Around line 9-12: The pullfrog_run job lacks an explicit least-privilege
job-level permissions block required by pullfrog/pullfrog-action; add a
permissions section to the pullfrog_run job with id-token set to write and
contents set to read (only add additional scopes like pull-requests: write or
issues: write if another step actually needs them) so OIDC minting and repo read
access are granted for the job.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2eb1688f-14d5-4721-b49f-cb94623d50ad
📒 Files selected for processing (3)
.continue/agents/new-config.yaml.github/workflows/pullfrog.ymlREADME.md
| tabAutocompleteModel: | ||
| name: "DeepSeek Flash Auto" | ||
| provider: "openai" | ||
| model: "deepseek-v4-flash" | ||
| apiBase: "https://api.deepseek.com/v1" | ||
| apiKey: "${env:DEEPSEEK_API_KEY}" | ||
| roles: | ||
| - autocomplete |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Continue YAML migration tabAutocompleteModel models roles autocomplete
💡 Result:
To migrate your Continue configuration to the new YAML schema, you must move your models, including those previously defined under tabAutocompleteModel, into the models section of your config.yaml file [1][2]. 1. Model Roles: In the YAML format, Continue uses the roles field to define model capabilities [1][3]. Assign the autocomplete role to any model intended for tab autocomplete by adding it to the roles list [1][2][4]. Example configuration: models: - name: My Autocomplete Model provider: ollama model: qwen2.5-coder:1.5b roles: - autocomplete 2. Configuring Autocomplete Options: The YAML schema allows you to configure autocomplete options on a per-model basis using the autocompleteOptions field within the model definition [5][2]. This replaces the older, global tabAutocompleteOptions used in config.json [2]. Example configuration: models: - name: My Autocomplete Model provider: ollama model: qwen2.5-coder:1.5b roles: - autocomplete autocompleteOptions: maxPromptTokens: 1024 debounceDelay: 250 If you are using prompt templating for your autocomplete model, you can define it using the promptTemplates.autocomplete property [3]. Ensure you are using the correct FIM (fill-in-the-middle) template for your specific model [6][3]. For further guidance, consult the official Continue documentation on YAML migration and autocomplete configuration [1][2][3].
Citations:
- 1: https://docs.continue.dev/reference/yaml-migration
- 2: https://docs.continue.dev/customize/deep-dives/autocomplete
- 3: https://continue-docs.mintlify.app/customize/model-roles/autocomplete
- 4: Finish instructions for local autocomplete continuedev/continue#9150
- 5: Add ability to configure tabAutocompleteOptions on a per-model basis in config.yaml continuedev/continue#5970
- 6: Individual Prompt Settings for Different tabAutocompleteModels continuedev/continue#4646
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".continue/agents/new-config.yaml"
echo "== File: $FILE =="
if [ -f "$FILE" ]; then
nl -ba "$FILE" | sed -n '1,120p'
else
echo "File not found: $FILE"
exit 1
fiRepository: spivanatalie64/spivanatalie64.github.io
Length of output: 189
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".continue/agents/new-config.yaml"
echo "== Grep checks =="
if [ -f "$FILE" ]; then
echo "-- occurrences --"
rg -n "tabAutocompleteModel:|^models:|autocomplete" "$FILE" || true
echo
echo "== File with line numbers (1-120) =="
awk '{printf "%6d %s\n", NR, $0}' "$FILE" | sed -n '1,120p'
else
echo "File not found: $FILE"
exit 1
fiRepository: spivanatalie64/spivanatalie64.github.io
Length of output: 1317
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".continue/agents/new-config.yaml"
echo "== defaultCompletionOptions occurrences =="
rg -n "defaultCompletionOptions" "$FILE" || true
echo
echo "== contextLength occurrences =="
rg -n "contextLength" "$FILE" || trueRepository: spivanatalie64/spivanatalie64.github.io
Length of output: 218
Move tabAutocompleteModel into models with roles: [autocomplete]
.continue/agents/new-config.yaml still defines a top-level tabAutocompleteModel block, which Continue’s YAML migration expects to be represented inside the models array via the autocomplete role. Since models already includes "DeepSeek V4 Flash" (with apiBase: "https://api.deepseek.com/v1" and contextLength), either add autocomplete to that model’s roles or add a new models entry for the same provider/model—then remove the top-level tabAutocompleteModel.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.continue/agents/new-config.yaml around lines 25 - 32, The config still has
a top-level tabAutocompleteModel; move it into the existing models array
instead: locate the tabAutocompleteModel block and either add "autocomplete" to
the roles array on the existing model entry for "DeepSeek V4 Flash" (which
already uses apiBase: "https://api.deepseek.com/v1" and has contextLength) or
create a new models entry with the same
provider/name/model/apiBase/contextLength and roles: [autocomplete], then remove
the top-level tabAutocompleteModel entry so all model definitions live under
models.
| pullfrog_run: | ||
| runs-on: ubuntu-latest | ||
| if: github.event.issue.pull_request || github.event_name == 'pull_request' || contains(github.event.comment.body, '@pullfrog') | ||
| steps: |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
pullfrog/pullfrog-action GitHub Action required permissions GITHUB_TOKEN
💡 Result:
The Pullfrog GitHub Action does not actually use the workflow's GITHUB_TOKEN to perform its core operations like pushing branches, posting pull request comments, creating reviews, or updating issues [1]. Instead, it mints its own short-lived installation tokens via OIDC (OpenID Connect) for these API calls [1]. Because of this design, the only permissions you must explicitly grant in your workflow for the Pullfrog action to function correctly are [1]: - id-token: write (Required to mint the OIDC-based installation tokens) [1] - contents: read (Required for the actions/checkout step to clone the repository) [1] While some example configurations for Pullfrog may show broader permissions (such as contents: write or pull-requests: write), these are generally not required by the Pullfrog action itself [1]. If you include broader permissions in your workflow configuration, they are applied to the GITHUB_TOKEN, which other steps in the same job might use, but the Pullfrog action remains independent of them [1]. It is recommended to scope these permissions at the job level rather than the workflow level to follow the principle of least privilege [1].
Citations:
Add an explicit least-privilege permissions block for the pullfrog_run job.
File: .github/workflows/pullfrog.yml (lines 9-12)
pullfrog/pullfrog-action requires job-level permissions for OIDC minting and repo read access: id-token: write and contents: read. The suggested pull-requests: write / issues: write scopes aren’t needed by Pullfrog itself (only add them if another step uses GITHUB_TOKEN for those operations).
🔒 Proposed permissions scope
permissions:
id-token: write
contents: read🧰 Tools
🪛 zizmor (1.25.2)
[warning] 9-23: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pullfrog.yml around lines 9 - 12, The pullfrog_run job
lacks an explicit least-privilege job-level permissions block required by
pullfrog/pullfrog-action; add a permissions section to the pullfrog_run job with
id-token set to write and contents set to read (only add additional scopes like
pull-requests: write or issues: write if another step actually needs them) so
OIDC minting and repo read access are granted for the job.
| jobs: | ||
| pullfrog_run: | ||
| runs-on: ubuntu-latest | ||
| if: github.event.issue.pull_request || github.event_name == 'pull_request' || contains(github.event.comment.body, '@pullfrog') |
There was a problem hiding this comment.
Trigger condition runs the agent on every PR comment, not just @pullfrog.
github.event.issue.pull_request is truthy for any comment on a pull request, so this short-circuits before the @pullfrog check. Combined with the ||, the job runs on every PR comment regardless of body, which contradicts the README ("Trigger manually by commenting @pullfrog") and wastes review/API spend.
🛠️ Proposed fix to gate comment triggers on the mention
- if: github.event.issue.pull_request || github.event_name == 'pull_request' || contains(github.event.comment.body, '`@pullfrog`')
+ if: >-
+ github.event_name == 'pull_request' ||
+ (github.event.issue.pull_request && contains(github.event.comment.body, '`@pullfrog`'))🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pullfrog.yml at line 11, The current if condition uses
github.event.issue.pull_request which is truthy for any PR comment and
short-circuits the mention check; replace the logic so PR comment events are
gated by the mention: require contains(github.event.comment.body, '`@pullfrog`')
when github.event.issue.pull_request is present, while still allowing normal
pull_request events (github.event_name == 'pull_request'). Update the
conditional that references github.event.issue.pull_request, github.event_name,
and github.event.comment.body so it only triggers on PR comments when the
comment body contains '`@pullfrog`' and continues to trigger for direct
pull_request events.
| - name: Checkout Code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
Disable credential persistence on checkout.
actions/checkout persists the GITHUB_TOKEN in .git/config by default; since a third-party action runs afterward in the same workspace, set persist-credentials: false to avoid leaking the token. Also consider pinning actions/checkout to a commit SHA per the unpinned-action policy.
🛡️ Proposed fix
- name: Checkout Code
uses: actions/checkout@v4
with:
fetch-depth: 0
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 13-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pullfrog.yml around lines 13 - 16, The checkout step
("Checkout Code") currently uses actions/checkout@v4 and leaves credentials
persisted; update the step to set persist-credentials: false to prevent
GITHUB_TOKEN from being written to .git/config (replace or add the input key
persist-credentials: false under the actions/checkout@v4 step) and optionally
pin the action to a specific commit SHA instead of the tag to comply with
unpinned-action policy (change uses: actions/checkout@v4 to uses:
actions/checkout@<commit-sha>).
| - name: Run Pullfrog Agent | ||
| uses: pullfrog/pullfrog-action@main | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| OPENROUTER_API_KEY: ${{ secrets.ORGANIZATION_OPENROUTER_KEY }} |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
pullfrog/pullfrog-action inputs OPENROUTER_API_KEY env or with usage
💡 Result:
To use an OpenRouter API key with the pullfrog/pullfrog GitHub Action, you must map the OPENROUTER_API_KEY secret into the env block of the action step within your pullfrog.yml workflow file [1][2][3]. ### Implementation Add the OPENROUTER_API_KEY to your repository or organization secrets in GitHub [4]. Then, configure your .github/workflows/pullfrog.yml file to include the environment variable mapping [1][4]: yaml jobs: pullfrog: runs-on: ubuntu-latest steps: - name: Run agent uses: pullfrog/pullfrog@v0 with: prompt: ${{ inputs.prompt }} # Optional: Specify a model via OpenRouter model: openrouter/anthropic/claude-sonnet-4.6 env: OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} ### Key Considerations * Environment Mapping: The Pullfrog action only has access to secrets explicitly mapped in the env: block of the workflow step [4]. * Precedence: If you have configured keys via the Pullfrog console's Bring-Your-Own-Key (BYOK) settings, a key set directly in the workflow env: block will take precedence, allowing for per-workflow overrides [4]. * Model Selection: When using OpenRouter, you can let Pullfrog auto-select models or pin a specific model version using the model input as shown above [2]. Ensure the secret name used in your workflow matches OPENROUTER_API_KEY exactly [4].
Citations:
- 1: https://github.com/pullfrog/action
- 2: https://docs.pullfrog.com/models
- 3: https://github.com/pullfrog/pullfrog
- 4: https://docs.pullfrog.com/keys
Pin pullfrog/pullfrog-action to a commit SHA (supply-chain risk).
In .github/workflows/pullfrog.yml the step uses a mutable tag:
- name: Run Pullfrog Agent
uses: pullfrog/pullfrog-action@main
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
OPENROUTER_API_KEY: ${{ secrets.ORGANIZATION_OPENROUTER_KEY }}Pin pullfrog/pullfrog-action to a full commit SHA to prevent unexpected action changes from main.
The OpenRouter key is correctly provided via env (OPENROUTER_API_KEY), and the secret’s name can differ—as long as secrets.ORGANIZATION_OPENROUTER_KEY exists and contains the OpenRouter API key.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pullfrog.yml around lines 18 - 22, The workflow step "Run
Pullfrog Agent" currently uses the mutable ref pullfrog/pullfrog-action@main;
change it to a pinned full commit SHA instead (replace the `@main` ref in the uses
field for the pullfrog/pullfrog-action step with the action repository's
specific commit SHA) so the action cannot change unexpectedly; keep the existing
env entries (GITHUB_TOKEN and OPENROUTER_API_KEY) as-is and ensure you copy the
exact full commit SHA from the pullfrog/pullfrog-action repo when updating the
uses line.
|
Closing this unmerged PR as part of project cleanup (July 2026 audit). The config will be applied directly instead. |
1 participant
This PR adds:\n- Pullfrog AI automated code review workflow\n- Continue.dev agent configuration (.continue/agents/new-config.yaml)\n- README documentation\n\nSet
DEEPINFRA_API_KEYandDEEPSEEK_API_KEYas local environment variables for Continue.dev to function.Summary by CodeRabbit
New Features
Documentation