Feature/pr review workflow

[himanshu231204]

Description

A clear and concise description of what this PR does.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Test update
• CI/CD update

Related Issues

Closes #(issue_number)

How Has This Been Tested?

Describe the tests that you ran to verify your changes.

• Unit tests pass (uv run pytest)
• Linter passes (uv run ruff check .)
• Type checker passes (uv run mypy openagent_eval/)
• Manual testing performed

Checklist

• My code follows the project's coding standards
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Screenshots (if applicable)

Add screenshots to demonstrate visual changes.

Additional Notes

Add any other notes about the PR here.

[github-actions]

Summary

This PR makes two minor changes to .github/workflows/pr-review.yml:

1. Adds a comment line documenting the model used (# Model: opencode/deepseek-v4-flash-free (@latest))
2. Changes the action reference from anomalyco/opencode/github@v1 to anomalyco/opencode/github@latest

---

Issues Found

[BUG] Using @latest instead of a pinned version — .github/workflows/pr-review.yml:42

• Severity: HIGH
• Description: uses: anomalyco/opencode/github@latest is a floating tag. If the action publishes a breaking change (e.g., a new major version with different inputs or behavior), this workflow will break without warning. This is especially risky for CI/CD workflows that gate PRs. The previous @v1 was correctly pinned to a major version.
• Suggested fix: Revert to uses: anomalyco/opencode/github@v1 (or pin to a specific commit SHA). If the intent is to always use the latest, at minimum pin to a major version tag like @v1 which only receives backward-compatible updates.

---

Positive Notes

• The concurrency group with cancel-in-progress: true is a good pattern — prevents wasted runs on stale commits.
• The if: github.event.pull_request.draft == false guard correctly skips draft PRs.
• The permissions block is scoped to the minimum needed (contents: read, pull-requests: write, issues: write).
• The prompt is well-structured with clear categories and severity levels.

Verdict

REQUEST CHANGES — Using @latest instead of a pinned version tag is a reliability risk for CI/CD workflows. Pin to @v1 (or a specific commit SHA) to prevent unexpected breakage from upstream changes.

opencode session  |  github run