diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml new file mode 100644 index 000000000..b2802e359 --- /dev/null +++ b/.github/workflows/code-review.yml @@ -0,0 +1,36 @@ +name: AI Code Review + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + pull-requests: write + +concurrency: + group: ocr-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + review: + # Fork PRs cannot read secrets; skip them cleanly. + if: github.event.pull_request.head.repo.fork == false + runs-on: ubuntu-latest + timeout-minutes: 40 + steps: + - uses: alibaba/open-code-review@494bf1c8d7a19196ab166960a06fef38d69a1d16 # v1.12.0 + with: + llm_url: https://api.z.ai/api/coding/paas/v4 + llm_auth_token: ${{ secrets.OCR_LLM_TOKEN }} + llm_model: glm-5.3-flash + llm_use_anthropic: false + # GLM-5.3 family rejects thinking.type=disabled, which is the + # action's default extra_body — this override is required. + llm_extra_body: '{"thinking": {"type": "enabled"}}' + llm_reasoning_effort: low + incremental: 'true' + route_severity_below: 'low' + max_tokens_budget: '500000' + review_task_timeout: '15' + stream_progress: 'true' diff --git a/Cargo.lock b/Cargo.lock index c0073927b..f4572dd68 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1331,9 +1331,9 @@ dependencies = [ [[package]] name = "chacha20" -version = "0.10.0" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" +checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", "cpufeatures 0.3.0", @@ -7011,7 +7011,7 @@ version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207" dependencies = [ - "chacha20 0.10.0", + "chacha20 0.10.2", "getrandom 0.4.1", "rand_core 0.10.1", ] @@ -7655,9 +7655,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.36" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "log", "once_cell", @@ -7718,9 +7718,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types", diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index 85ecee703..3cf4fb9c5 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -2075,13 +2075,13 @@ end = "2026-10-15" [[trusted.zerocopy]] criteria = "safe-to-deploy" -user-id = 7178 # Joshua Liebow-Feeser (joshlf) +user-id = 7178 # Josh Liebow-Feeser (joshlf) start = "2019-02-28" end = "2026-10-15" [[trusted.zerocopy-derive]] criteria = "safe-to-deploy" -user-id = 7178 # Joshua Liebow-Feeser (joshlf) +user-id = 7178 # Josh Liebow-Feeser (joshlf) start = "2019-02-28" end = "2026-10-15" diff --git a/supply-chain/config.toml b/supply-chain/config.toml index e58e59915..51847ac30 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -208,6 +208,10 @@ criteria = "safe-to-deploy" version = "1.1.0" criteria = "safe-to-deploy" +[[exemptions.chacha20]] +version = "0.10.2" +criteria = "safe-to-deploy" + [[exemptions.clipboard-win]] version = "5.4.1" criteria = "safe-to-deploy" diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index c39d030f8..a0429baa2 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -397,7 +397,7 @@ version = "0.1.1" when = "2020-09-15" user-id = 2396 user-login = "jdm" -user-name = "Josh Matthews" +user-name = "Josh Bowman-Matthews" [[publisher.cpufeatures]] version = "0.2.17" @@ -1401,8 +1401,8 @@ user-login = "sunfishcode" user-name = "Dan Gohman" [[publisher.rustls]] -version = "0.23.36" -when = "2026-01-05" +version = "0.23.45" +when = "2026-09-14" user-id = 2751 user-login = "ctz" user-name = "Joe Birr-Pixton" @@ -1436,11 +1436,11 @@ user-login = "cpu" user-name = "Daniel McCarney" [[publisher.rustls-webpki]] -version = "0.103.13" -when = "2026-04-21" -user-id = 2751 -user-login = "ctz" -user-name = "Joe Birr-Pixton" +version = "0.103.15" +when = "2026-08-21" +user-id = 209038 +user-login = "cpu" +user-name = "Daniel McCarney" [[publisher.rustversion]] version = "1.0.22" @@ -2515,14 +2515,14 @@ version = "0.8.39" when = "2026-02-05" user-id = 7178 user-login = "joshlf" -user-name = "Joshua Liebow-Feeser" +user-name = "Josh Liebow-Feeser" [[publisher.zerocopy-derive]] version = "0.8.39" when = "2026-02-05" user-id = 7178 user-login = "joshlf" -user-name = "Joshua Liebow-Feeser" +user-name = "Josh Liebow-Feeser" [[publisher.zeroize]] version = "1.8.2" @@ -4446,7 +4446,7 @@ aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-ch [[audits.mozilla.wildcard-audits.core-graphics-types]] who = "Bobby Holley " criteria = "safe-to-deploy" -user-id = 2396 # Josh Matthews (jdm) +user-id = 2396 # Josh Bowman-Matthews (jdm) start = "2020-07-20" end = "2023-05-04" renew = false @@ -4458,8 +4458,8 @@ who = "Henri Sivonen " criteria = "safe-to-deploy" user-id = 4484 # Henri Sivonen (hsivonen) start = "2019-02-26" -end = "2025-10-23" -notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ." +end = "2027-09-07" +notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" [[audits.mozilla.wildcard-audits.etagere]]