Factory-AI/droid-action v6

on GitHub

What's Changed

GitLab: review posting moved into CI

• MR review comments are now posted through the GitLab REST API by CI instead of a gitlab_mr MCP server the model had to call itself (#109)
  • Both review passes run with no MR write tool and with GITLAB_TOKEN stripped from their environment, so a prompt-injected diff has neither a tool nor a credential to write to the project
  • review_validated.json is the contract: a new gitlab-post-review step posts every approved finding as an inline MR discussion, and every proposal/approval/API result is replayable from the .droid-debug/ artifacts

GitLab: org-wide review guidelines

• New org_guidelines_source component input applies one set of custom review guidelines across every project in a group (#110)
  • Accepts a local file path, an http(s) URL, a git clone URL, or a GitLab project path (with org_guidelines_ref / org_guidelines_path for git sources)
  • Installed as a user-level skill so it can never shadow a project's own review-guidelines skill; unreachable sources log a warning and the review proceeds

Full Changelog: v5...v6