From a9727928745450c2d960e24b8574c086e5224747 Mon Sep 17 00:00:00 2001
From: khoi <6994441+khoi@users.noreply.github.com>
Date: Fri, 7 Aug 2026 23:12:16 +0100
Subject: [PATCH 1/3] ci: enable supareview pull request reviews

---
 .github/workflows/supa-review.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 .github/workflows/supa-review.yml

diff --git a/.github/workflows/supa-review.yml b/.github/workflows/supa-review.yml
new file mode 100644
index 000000000..fa4bafea7
--- /dev/null
+++ b/.github/workflows/supa-review.yml
@@ -0,0 +1,17 @@
+name: SupaReview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+jobs:
+  review:
+    if: github.event.pull_request.draft == false
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    uses: supabitapp/supareview/.github/workflows/supareview-review.yml@main
+    secrets:
+      CODEX_BALANCER_API_KEY: ${{ secrets.CODEX_BALANCER_API_KEY }}

From 8be9f0541eb5460868c8a53079d8bb3ba21d1d1a Mon Sep 17 00:00:00 2001
From: khoi <6994441+khoi@users.noreply.github.com>
Date: Fri, 7 Aug 2026 23:27:29 +0100
Subject: [PATCH 2/3] ci: harden supareview workflow

Pin the reusable review workflow to a reviewed revision and skip pull requests that cannot provide the review secret or write token.
---
 .github/workflows/supa-review.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/supa-review.yml b/.github/workflows/supa-review.yml
index fa4bafea7..1b8d74968 100644
--- a/.github/workflows/supa-review.yml
+++ b/.github/workflows/supa-review.yml
@@ -6,12 +6,15 @@ on:
 
 jobs:
   review:
-    if: github.event.pull_request.draft == false
+    if: >-
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     permissions:
       actions: read
       contents: read
       issues: write
       pull-requests: write
-    uses: supabitapp/supareview/.github/workflows/supareview-review.yml@main
+    uses: supabitapp/supareview/.github/workflows/supareview-review.yml@79badffe75c017e9f66178e720570277c35a2013
     secrets:
       CODEX_BALANCER_API_KEY: ${{ secrets.CODEX_BALANCER_API_KEY }}

From 79d169c246d1a0db7e5e30a4e708d161624832ee Mon Sep 17 00:00:00 2001
From: khoi <6994441+khoi@users.noreply.github.com>
Date: Fri, 7 Aug 2026 23:38:00 +0100
Subject: [PATCH 3/3] security: pin the reviewed supareview workflow

Use the merged SupaReview workflow revision that pins its nested privileged action.
---
 .github/workflows/supa-review.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/supa-review.yml b/.github/workflows/supa-review.yml
index 1b8d74968..ebb8b18ba 100644
--- a/.github/workflows/supa-review.yml
+++ b/.github/workflows/supa-review.yml
@@ -15,6 +15,6 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
-    uses: supabitapp/supareview/.github/workflows/supareview-review.yml@79badffe75c017e9f66178e720570277c35a2013
+    uses: supabitapp/supareview/.github/workflows/supareview-review.yml@f1ed7e0db53c98de048c9fab7439744d0000417d
     secrets:
       CODEX_BALANCER_API_KEY: ${{ secrets.CODEX_BALANCER_API_KEY }}