Factory-AI/droid-action v11

on GitHub

What's Changed

Security fix: GitHub tokens no longer leak through debug artifacts

• Starting in v3, the action uploaded Droid's ~/.factory folder as the droid-review-debug-<run_id> artifact, and that folder held the GitHub token the action used (#174)
  • The folder includes Droid's MCP configuration, which holds the Factory Droid App token (or the github_token input) and the workflow's GITHUB_TOKEN. On public repositories, any signed-in GitHub user can download workflow artifacts
  • Debug artifacts are now opt-in through the new upload_debug_artifacts input (default false). When it is enabled, only a redacted copy of selected files is uploaded, and the MCP configuration is never included
  • The Factory Droid App token is revoked again as the last step of action.yml, review/action.yml and security/action.yml. A token you pass in github_token is left alone
• Other credential hardening (#174)
  • Droid runs with a reduced environment. OIDC request credentials, Actions runtime tokens, INPUT_* values and unused tokens are removed, and Droid's output and errors are redacted
  • Every bun call ignores repository bunfig.toml and .env files
  • The GitHub and GitLab API clients redact credentials from errors and logs
  • persist-credentials: false in the README samples
• Fork pull requests: the fork's head is no longer checked out into the workspace (#174)
  • Droid is told the PR comes from a fork, reads its changes from the diff and git show, and is told never to run the fork's code

If you ran v3 through v10 on a public repository, delete your droid-review-debug-* artifacts, rotate any token you passed as github_token, and rotate FACTORY_API_KEY as a precaution.

Review guidelines action

• New review-guidelines and review-guidelines/publish actions learn a repository's review guidelines from the review comments authors acted on, then open or update a pull request with them (#165)
  • The learning job mines comments and distills guidelines without holding a token. Publishing runs in a separate job, accepts only the expected files, and refuses output that contains a credential
• The mining step now gets FACTORY_API_KEY, so comment classification no longer fails silently (#167)
• Script writing and distill can write files with ApplyPatch, the mining step's token exchange works, and distill pins openai-latest-balanced (#168)

Fixes

• Comment ownership checks use the Factory Droid bot ID (138933559) (#162)
  • Sticky-comment reuse, security review detection and CI Steward history previously used another bot's ID, so Droid could edit that bot's PR comment

Full Changelog: v10...v11