Run details

aiWorkspace

CI Pipeline Executions
- Current executionSucceeded
  1325-make-review-a-sweep
- Runs and Agents
- TimelineBeta
- Configuration
- Self-Healing CI
- Project Graph
- Circular DependenciesEnterprise
- Resource Usage
- Analysis
- ConformanceEnterprise
Runs

Insights

Compare tasks
Analytics

fix(ai-review): keep the review PAT away from the agent The sweep ran the Grok agent over untrusted fork code in the same job that held AI_REVIEW_TOKEN, a repo-scope PAT. The agent runs with tool approval disabled (`--always-approve`, no `--sandbox read-only`) through the local-process sandbox, whose own header says it has NO isolation and runs `exec` through a shell, and that process inherits the whole job env. Prompt injection in a PR diff or a fork-planted AGENTS.md could therefore read the PAT and exfiltrate it. On `pull_request` this was unreachable for forks, as those events get no secrets; moving auto review to cron made it reachable. Split the workflow in two. `review` runs the agent with XAI_API_KEY and the read-only GITHUB_TOKEN, performs no GitHub writes, and emits an artifact. `publish` holds the PAT, does every write, and never runs the agent. Separate jobs mean separate runners, so the credential is never on the machine that reads untrusted code. Treat that artifact as hostile: it is written next to a possibly compromised agent. It carries only the PR number, verdict, and a patch. `publish` re-derives eligibility and re-runs the malware scan from the API, and resolves head SHA, ref, and repo itself, so a compromised review job cannot fake a clean scan, introduce a PR the sweep never selected, or choose where a push lands. Also: - Pin the scan to the reviewed commit. The worktree is fetched before the PR is read over REST, so a force-push in between left us scanning one commit and reviewing another. Mismatch now stops the run with `head-moved`. - Gate the agent on the scan instead of only the `secure` label. A PR that trips it is never read or edited. - Release waiting workflows on a clean scan rather than on an `ai-ready` verdict, so CI no longer waits on the AI's opinion. - Pass the polish push a lease pinned to the resolved SHA. A plain `--force-with-lease` leases against a tracking ref the worktree just fetched, which always agrees and so never protected anything. Claude-Session: https://claude.ai/code/session_019iwZLMpwXbUa4JWikfqQgn

nx affected --targets=test:sherif,test:knip,test:docs,test:kiira,test:maintainer,test:ai-review,test:oxlint,test:lib,test:types,test:build,build

Succeeded

4 CPU cores

read-write access token used

c749c06e1327

1%

Cache hits

2 of 379 tasks used cache.

Get faster results

Learn how to enable distribution.

Atomizer enabled

91 groups of tasks optimized.

© 2026 - Nx Cloud

Terms of Service Privacy Policy Changelog Status Docs Contact Nx Cloud Pricing Company @NxDevTools

aiWorkspace