ci: Add AI security review workflow - #3280
Merged
Merged
Conversation
Add a trusted pull_request_target workflow that runs pinned CodeBuild security reviews for pull requests. Gate external contributors through GitHub environment approval, publish commit-specific report status, and track closed pull requests without changing quic-attack.
boquan-fang
reviewed
Aug 31, 2026
|
|
||
| jobs: | ||
| # Decide whether an open PR can run immediately or needs approval. | ||
| authorize: |
Contributor
There was a problem hiding this comment.
To add this kind of workflow, I think testing this whole PR before merging it will be necessary, and I think that kind of testing is lacking based on the PR description.
Since this PR requires AWS credentials, I don't think testing it on fork is a good idea. Can we test it on upstream s2n-quic repo in a different branch other than the main branch?
Contributor
Author
There was a problem hiding this comment.
Limit automatic reviews to authors with write access and remove the redundant latest-result summary from report history.
Run the security review workflow only for the controlled upstream child branch so the GitHub and CodeBuild integration can be validated before merge.
Remove the controlled child-PR integration path after capturing the pre-merge workflow and CodeBuild failure evidence.
Run the deployed credential fix through the controlled upstream GitHub Actions and CodeBuild integration path.
Remove the controlled child-PR path after the deployed credential fix passed end-to-end validation.
boquan-fang
approved these changes
Sep 2, 2026
boquan-fang
left a comment
boquan-fang
left a comment
Contributor
There was a problem hiding this comment.
This PR looks good with testing. We should continuously monitor the effect of this workflow once it is merged in.
WesleyRosenblum
enabled auto-merge (squash)
September 2, 2026 18:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release Summary:
Resolved issues:
Description of changes:
Adds a dedicated
pull_request_targetworkflow for AI-assisted security review. Reviews run against pinned pull request commits in CodeBuild, require maintainer approval for external contributors, publish a commit-specificsecurity-review / reportstatus, and keep centralized pull request lifecycle metadata current.Call-outs:
Testing:
cargo build --workspacegit diff --check./scripts/typos./scripts/copyright_checkBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.