Generated pull_request workflows currently run the review agent in a job that also has provider credentials and a write-capable GH_TOKEN used to publish results. Read-only agent modes protect the checkout from writes, but they do not isolate all readable files or keep publishing credentials out of the agent process. Pull request content is untrusted and can influence model tool use. This applies to all command-backed review agents, not only one integration.
Preserve read-only repository inspection while hardening the boundary:
- Run review agents in disposable isolation that exposes only the checkout and prepared snapshots.
- Keep the pull request publishing credential outside the agent subprocess and pass only the completed result to the publishing step.
- Prevent model-controlled tools from reading provider or publishing credentials, potentially through a scoped broker or proxy.
- Add generated-workflow tests that cover secret separation across supported agents.
This should be a coordinated cross-agent change so review capability remains consistent.
Generated pull_request workflows currently run the review agent in a job that also has provider credentials and a write-capable GH_TOKEN used to publish results. Read-only agent modes protect the checkout from writes, but they do not isolate all readable files or keep publishing credentials out of the agent process. Pull request content is untrusted and can influence model tool use. This applies to all command-backed review agents, not only one integration.
Preserve read-only repository inspection while hardening the boundary:
This should be a coordinated cross-agent change so review capability remains consistent.