Skip to content

Add Pullfrog AI Review + Continue Agent Config #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
spivanatalie64 wants to merge 3 commits into from
Closed

Add Pullfrog AI Review + Continue Agent Config #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7aebf50
infra: add pullfrog AI review workflow
spivanatalie64 Jun 2, 2026
ea9468f
docs: add pullfrog AI review overview to README
spivanatalie64 Jun 2, 2026
6101c2f
infra: add Continue.dev agent configuration
spivanatalie64 Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions .continue/agents/new-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
name: Budget-Config
version: 1.0.0
schema: v1

models:
- name: "Qwen3-235B (DeepInfra)"
provider: "openai"
model: "Qwen/Qwen3-235B-A22B-Instruct-2507"
apiBase: "https://api.deepinfra.com/v1/openai"
apiKey: "${env:DEEPINFRA_API_KEY}"
contextLength: 250000
roles:
- chat
- edit

- name: "DeepSeek V4 Flash"
provider: "openai"
model: "deepseek-v4-flash"
apiBase: "https://api.deepseek.com/v1"
apiKey: "${env:DEEPSEEK_API_KEY}"
contextLength: 1000000
roles:
- chat

tabAutocompleteModel:
name: "DeepSeek Flash Auto"
provider: "openai"
model: "deepseek-v4-flash"
apiBase: "https://api.deepseek.com/v1"
apiKey: "${env:DEEPSEEK_API_KEY}"
roles:
- autocomplete
Comment on lines +25 to +32

@coderabbitai coderabbitai Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Continue YAML migration tabAutocompleteModel models roles autocomplete

💡 Result:

To migrate your Continue configuration to the new YAML schema, you must move your models, including those previously defined under tabAutocompleteModel, into the models section of your config.yaml file [1][2]. 1. Model Roles: In the YAML format, Continue uses the roles field to define model capabilities [1][3]. Assign the autocomplete role to any model intended for tab autocomplete by adding it to the roles list [1][2][4]. Example configuration: models: - name: My Autocomplete Model provider: ollama model: qwen2.5-coder:1.5b roles: - autocomplete 2. Configuring Autocomplete Options: The YAML schema allows you to configure autocomplete options on a per-model basis using the autocompleteOptions field within the model definition [5][2]. This replaces the older, global tabAutocompleteOptions used in config.json [2]. Example configuration: models: - name: My Autocomplete Model provider: ollama model: qwen2.5-coder:1.5b roles: - autocomplete autocompleteOptions: maxPromptTokens: 1024 debounceDelay: 250 If you are using prompt templating for your autocomplete model, you can define it using the promptTemplates.autocomplete property [3]. Ensure you are using the correct FIM (fill-in-the-middle) template for your specific model [6][3]. For further guidance, consult the official Continue documentation on YAML migration and autocomplete configuration [1][2][3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".continue/agents/new-config.yaml"
echo "== File: $FILE =="
if [ -f "$FILE" ]; then
  nl -ba "$FILE" | sed -n '1,120p'
else
  echo "File not found: $FILE"
  exit 1
fi

Repository: spivanatalie64/spivanatalie64.github.io

Length of output: 189

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".continue/agents/new-config.yaml"
echo "== Grep checks =="
if [ -f "$FILE" ]; then
  echo "-- occurrences --"
  rg -n "tabAutocompleteModel:|^models:|autocomplete" "$FILE" || true

  echo
  echo "== File with line numbers (1-120) =="
  awk '{printf "%6d %s\n", NR, $0}' "$FILE" | sed -n '1,120p'
else
  echo "File not found: $FILE"
  exit 1
fi

Repository: spivanatalie64/spivanatalie64.github.io

Length of output: 1317

🏁 Script executed:

#!/bin/bash
set -euo pipefail
FILE=".continue/agents/new-config.yaml"
echo "== defaultCompletionOptions occurrences =="
rg -n "defaultCompletionOptions" "$FILE" || true
echo
echo "== contextLength occurrences =="
rg -n "contextLength" "$FILE" || true

Repository: spivanatalie64/spivanatalie64.github.io

Length of output: 218

Move tabAutocompleteModel into models with roles: [autocomplete]

.continue/agents/new-config.yaml still defines a top-level tabAutocompleteModel block, which Continue’s YAML migration expects to be represented inside the models array via the autocomplete role. Since models already includes "DeepSeek V4 Flash" (with apiBase: "https://api.deepseek.com/v1" and contextLength), either add autocomplete to that model’s roles or add a new models entry for the same provider/model—then remove the top-level tabAutocompleteModel.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.continue/agents/new-config.yaml around lines 25 - 32, The config still has
a top-level tabAutocompleteModel; move it into the existing models array
instead: locate the tabAutocompleteModel block and either add "autocomplete" to
the roles array on the existing model entry for "DeepSeek V4 Flash" (which
already uses apiBase: "https://api.deepseek.com/v1" and has contextLength) or
create a new models entry with the same
provider/name/model/apiBase/contextLength and roles: [autocomplete], then remove
the top-level tabAutocompleteModel entry so all model definitions live under
models.


context:
- provider: "file"
- provider: "code"
- provider: "terminal"
- provider: "diff"
22 changes: 22 additions & 0 deletions .github/workflows/pullfrog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: Pullfrog AI Agent
on:
pull_request:
types: [opened, synchronize]
issue_comment:
types: [created]

jobs:
pullfrog_run:
runs-on: ubuntu-latest
if: github.event.issue.pull_request || github.event_name == 'pull_request' || contains(github.event.comment.body, '@pullfrog')

@coderabbitai coderabbitai Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Trigger condition runs the agent on every PR comment, not just @pullfrog.

github.event.issue.pull_request is truthy for any comment on a pull request, so this short-circuits before the @pullfrog check. Combined with the ||, the job runs on every PR comment regardless of body, which contradicts the README ("Trigger manually by commenting @pullfrog") and wastes review/API spend.

🛠️ Proposed fix to gate comment triggers on the mention 
-    if: github.event.issue.pull_request || github.event_name == 'pull_request' || contains(github.event.comment.body, '`@pullfrog`')
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event.issue.pull_request && contains(github.event.comment.body, '`@pullfrog`'))
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pullfrog.yml at line 11, The current if condition uses
github.event.issue.pull_request which is truthy for any PR comment and
short-circuits the mention check; replace the logic so PR comment events are
gated by the mention: require contains(github.event.comment.body, '`@pullfrog`')
when github.event.issue.pull_request is present, while still allowing normal
pull_request events (github.event_name == 'pull_request'). Update the
conditional that references github.event.issue.pull_request, github.event_name,
and github.event.comment.body so it only triggers on PR comments when the
comment body contains '`@pullfrog`' and continues to trigger for direct
pull_request events.

steps:
Comment on lines +9 to +12

@coderabbitai coderabbitai Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

pullfrog/pullfrog-action GitHub Action required permissions GITHUB_TOKEN

💡 Result:

The Pullfrog GitHub Action does not actually use the workflow's GITHUB_TOKEN to perform its core operations like pushing branches, posting pull request comments, creating reviews, or updating issues [1]. Instead, it mints its own short-lived installation tokens via OIDC (OpenID Connect) for these API calls [1]. Because of this design, the only permissions you must explicitly grant in your workflow for the Pullfrog action to function correctly are [1]: - id-token: write (Required to mint the OIDC-based installation tokens) [1] - contents: read (Required for the actions/checkout step to clone the repository) [1] While some example configurations for Pullfrog may show broader permissions (such as contents: write or pull-requests: write), these are generally not required by the Pullfrog action itself [1]. If you include broader permissions in your workflow configuration, they are applied to the GITHUB_TOKEN, which other steps in the same job might use, but the Pullfrog action remains independent of them [1]. It is recommended to scope these permissions at the job level rather than the workflow level to follow the principle of least privilege [1].

Citations:

Add an explicit least-privilege permissions block for the pullfrog_run job.

File: .github/workflows/pullfrog.yml (lines 9-12)
pullfrog/pullfrog-action requires job-level permissions for OIDC minting and repo read access: id-token: write and contents: read. The suggested pull-requests: write / issues: write scopes aren’t needed by Pullfrog itself (only add them if another step uses GITHUB_TOKEN for those operations).

🔒 Proposed permissions scope 
permissions:
  id-token: write
  contents: read
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 9-23: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pullfrog.yml around lines 9 - 12, The pullfrog_run job
lacks an explicit least-privilege job-level permissions block required by
pullfrog/pullfrog-action; add a permissions section to the pullfrog_run job with
id-token set to write and contents set to read (only add additional scopes like
pull-requests: write or issues: write if another step actually needs them) so
OIDC minting and repo read access are granted for the job.

- name: Checkout Code
uses: actions/checkout@v4
with:
fetch-depth: 0
Comment on lines +13 to +16

@coderabbitai coderabbitai Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Disable credential persistence on checkout.

actions/checkout persists the GITHUB_TOKEN in .git/config by default; since a third-party action runs afterward in the same workspace, set persist-credentials: false to avoid leaking the token. Also consider pinning actions/checkout to a commit SHA per the unpinned-action policy.

🛡️ Proposed fix 
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 13-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pullfrog.yml around lines 13 - 16, The checkout step
("Checkout Code") currently uses actions/checkout@v4 and leaves credentials
persisted; update the step to set persist-credentials: false to prevent
GITHUB_TOKEN from being written to .git/config (replace or add the input key
persist-credentials: false under the actions/checkout@v4 step) and optionally
pin the action to a specific commit SHA instead of the tag to comply with
unpinned-action policy (change uses: actions/checkout@v4 to uses:
actions/checkout@<commit-sha>).


- name: Run Pullfrog Agent
uses: pullfrog/pullfrog-action@main
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
OPENROUTER_API_KEY: ${{ secrets.ORGANIZATION_OPENROUTER_KEY }}
Comment on lines +18 to +22

@coderabbitai coderabbitai Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

pullfrog/pullfrog-action inputs OPENROUTER_API_KEY env or with usage

💡 Result:

To use an OpenRouter API key with the pullfrog/pullfrog GitHub Action, you must map the OPENROUTER_API_KEY secret into the env block of the action step within your pullfrog.yml workflow file [1][2][3]. ### Implementation Add the OPENROUTER_API_KEY to your repository or organization secrets in GitHub [4]. Then, configure your .github/workflows/pullfrog.yml file to include the environment variable mapping [1][4]: yaml jobs: pullfrog: runs-on: ubuntu-latest steps: - name: Run agent uses: pullfrog/pullfrog@v0 with: prompt: ${{ inputs.prompt }} # Optional: Specify a model via OpenRouter model: openrouter/anthropic/claude-sonnet-4.6 env: OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} ### Key Considerations * Environment Mapping: The Pullfrog action only has access to secrets explicitly mapped in the env: block of the workflow step [4]. * Precedence: If you have configured keys via the Pullfrog console's Bring-Your-Own-Key (BYOK) settings, a key set directly in the workflow env: block will take precedence, allowing for per-workflow overrides [4]. * Model Selection: When using OpenRouter, you can let Pullfrog auto-select models or pin a specific model version using the model input as shown above [2]. Ensure the secret name used in your workflow matches OPENROUTER_API_KEY exactly [4].

Citations:

Pin pullfrog/pullfrog-action to a commit SHA (supply-chain risk).

In .github/workflows/pullfrog.yml the step uses a mutable tag:

- name: Run Pullfrog Agent
  uses: pullfrog/pullfrog-action@main
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    OPENROUTER_API_KEY: ${{ secrets.ORGANIZATION_OPENROUTER_KEY }}

Pin pullfrog/pullfrog-action to a full commit SHA to prevent unexpected action changes from main.

The OpenRouter key is correctly provided via env (OPENROUTER_API_KEY), and the secret’s name can differ—as long as secrets.ORGANIZATION_OPENROUTER_KEY exists and contains the OpenRouter API key.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pullfrog.yml around lines 18 - 22, The workflow step "Run
Pullfrog Agent" currently uses the mutable ref pullfrog/pullfrog-action@main;
change it to a pinned full commit SHA instead (replace the `@main` ref in the uses
field for the pullfrog/pullfrog-action step with the action repository's
specific commit SHA) so the action cannot change unexpectedly; keep the existing
env entries (GITHUB_TOKEN and OPENROUTER_API_KEY) as-is and ensure you copy the
exact full commit SHA from the pullfrog/pullfrog-action repo when updating the
uses line.

11 changes: 11 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,3 +46,14 @@ Full documentation is available under [`docs/yacfs/`](docs/yacfs/):
---

*"99.9% uptime — not just in the systems I build, but in my own survival and evolution."* — Natalie Spiva
---

## 🤖 Pullfrog AI Review

This repository uses **Pullfrog AI** to automatically review pull requests.

Pullfrog is an AI-powered code review agent that analyzes every PR for code quality,
security issues, performance problems, and best practice violations. Reviews appear
as inline PR comments and checks. Trigger manually by commenting `@pullfrog` on any PR.

Powered by OpenRouter.
Loading