Factory-AI/droid-action v12

on GitHub

What's Changed

Security review is on by default with automatic review

• GitHub: an omitted or empty automatic_security_review now follows automatic_review (#172)
  • Workflows with automatic_review: true that don't set automatic_security_review now get a security review on every PR. Set automatic_security_review: false to opt out
  • Workflows that set neither input are unchanged and stay mention-driven (@droid review, @droid security)
• GitLab: automatic_security_review in the template now defaults to "true" (#173)
  • Projects that include templates/droid-review.yml without setting the input now run the security-reviewer subagent on every MR pipeline. [security] findings are posted alongside code-review comments, and the tracking note shows the security badge
  • Security review only runs when automatic_review is enabled. If automatic_review is "false", the job still skips
  • To keep code-only review, set automatic_security_review: "false"
• The GitLab example, the GitLab setup guide and the install-code-review installer now recommend security review (Factory-AI/factory-mono#27295)

GitHub App tokens carry only the permissions each run needs

• The action now asks the token exchange for a narrowed Factory Droid App token instead of every permission the app holds (#181)
  • Reviews, security reviews and fills on a PR get contents: read and pull_requests: write. @droid on an issue gets contents: read and issues: write. @droid security --full and CI Steward get contents: write only when they need it
  • Nothing asks for workflows, checks, statuses, discussions or actions: write
  • Unchanged: the prepare/ and review-guidelines/ sub-actions still get the full token, and a token you pass in github_token is used as is
  • The backend side (Factory-AI/factory-mono#28048) is rolling out. Until it reaches production, the exchange ignores the request and keeps returning a full token, so runs are not affected either way

New: Azure DevOps pull request review

• Droid code review for Azure DevOps Services and Azure DevOps Server 2020+, with the same two-pass review, inline comments, tracking thread and optional security review as GitLab (#171)
• Credentials are redacted from debug artifacts, threads and errors, reusing the protections from #174 (#177)
• New REVIEW_DRAFTS input (#171) and FORK_PULL_REQUESTS input. Set FORK_PULL_REQUESTS: fail so fork PRs fail the build instead of passing a Required build policy without a review (#179)

New: Bitbucket Cloud and Data Center review

• Droid code review for Bitbucket Cloud and Bitbucket Data Center / Server, with inline comments, a sticky tracking comment, optional security review, review depth and an optional droid-review build status (BUILD_STATUS=true) for merge checks (#170)
• A skipped draft PR no longer posts a successful build status that could satisfy a merge check (#180)

Review depth

• review_depth: shallow now uses oss-latest-premium instead of oss-latest-balanced (#184). deep is unchanged. CLIs that predate tier aliases fall back to kimi-k3

Fixes

• GitLab: the review template installs procps, so deep reviews on large MRs no longer crash with Executable not found in $PATH: "ps" (#178)

Full Changelog: v11...v12