chore(ci): pin pr-agent to skynergroup/.github@main

[yashiels]

User description

Repoint pr-agent caller from pinned SHA (e5d65d0, broken secret syntax) to skynergroup/.github@main. Fixes the broken pr-agent AND bakes in ai_timeout=600 + max_model_tokens=200000 via the shared workflow. Key stays repo-level.

---

PR Type

Other

---

Description

• Repin pr-agent caller to skynergroup/.github@main

• Replace broken pinned SHA workflow reference

• Keep repo-level KIMI_API_KEY secret override

---

Diagram Walkthrough

flowchart LR
  A[".github/workflows/pr-agent.yml"] -- "uses @e5d65d0" --> B["Broken SHA reference"]
  A -- "uses @main" --> C["Shared workflow on main"]

Loading

File Walkthrough

	Relevant files
Configuration changes	pr-agent.yml Pin pr-agent workflow to shared repo main branch                  .github/workflows/pr-agent.yml Switch uses reference from pinned SHA to @main Retain KIMI_API_KEY secret injection unchanged Fix reusable workflow reference syntax +1/-1

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 70

🧪 No relevant tests

🔒 Security concerns Supply-chain risk: Using @main for a reusable workflow means the calling workflow inherits whatever the shared workflow becomes, including any malicious changes, and passes the KIMI_API_KEY secret to it. Pin to a trusted SHA to keep immutable supply-chain guarantees.

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review Supply-chain risk The reusable workflow is now referenced at @main, which is mutable. Any future change to skynergroup/.github@main will execute with the repo-level KIMI_API_KEY secret, enabling secret exfiltration or unintended code execution if that shared workflow is compromised. Pin to a verified SHA and verify the secret syntax fix in that commit instead. uses: skynergroup/.github/.github/workflows/pr-agent.yml@main

[github-actions]

Suggestion: Pin the reusable workflow to an immutable commit SHA rather than a mutable branch reference. Referencing main means any upstream change or compromise in skynergroup/.github will execute immediately in your CI, creating a supply-chain attack vector. Revert to the previously pinned SHA and update it intentionally after reviewing upstream changes. [security, importance: 9]

Suggested change

	jobs:
	review:
	uses: skynergroup/.github/.github/workflows/pr-agent.yml@e5d65d05cdd00cdec39dff9fd3a7c32d5a41931b
	uses: skynergroup/.github/.github/workflows/pr-agent.yml@main
	jobs:
	review:
	uses: skynergroup/.github/.github/workflows/pr-agent.yml@e5d65d05cdd00cdec39dff9fd3a7c32d5a41931b