Consume BC PR review engine instead of hosting it by gggdttt · Pull Request #9210 · microsoft/BCApps

gggdttt · 2026-07-08T08:58:20Z

DRAFT — depends on microsoft/BC-PRReviewerAgent#4. Do not merge until the engine PR merges and the pinned SHA below is repointed to a reviewed engine main SHA (or release tag). Security-sensitive (repoints the production review pipeline cross-repo) — needs team buy-in.

What

Stops BCApps from hosting the Copilot PR-review engine and makes it a caller of the reusable engine that now lives in microsoft/BC-PRReviewerAgent.

This is PR 2 of 3:

microsoft/BC-PRReviewerAgent#4 — engine scripts + reusable review.yml.
This PR — BCApps consumes the engine.
BC-Bench — drop its vendored snapshot and invoke the same engine.

Changes

Deleted tools/Code Review/ (orchestrator + README) and tools/BCQuality/scripts/ — all moved to the engine repo. (-3384 lines)
Rewrote .github/workflows/CopilotPRReviewRunner.yaml from three inline jobs to a thin uses: microsoft/BC-PRReviewerAgent/.github/workflows/review.yml@<sha> caller with secrets: inherit and the existing vars.* mapped to workflow inputs.
Kept tools/BCQuality/bcquality.config.yaml (BCApps' auditable policy) and CopilotPRReview.yaml (unprivileged pull_request intake), both unchanged.
Rewrote tools/BCQuality/README.md to describe the policy config only.

Security model (unchanged)

The reusable workflow preserves the pull_request → workflow_run pattern: a read-only review job runs the tool-enabled Copilot CLI over the untrusted diff (no write token); a separate publish job holds issues/pull-requests: write and only posts saved artifacts. The trusted-code provider shifts from BCApps main to BC-PRReviewerAgent@<pinned-sha>.

Before merge

Engine PR merged; repoint the @<sha> in uses: and engine_ref: to a reviewed engine main SHA / release tag.
End-to-end dry run on a test PR.

AB#641717

The Copilot PR-review orchestrator and BCQuality clone+filter scripts moved to microsoft/BC-PRReviewerAgent. Replace the inline CopilotPRReviewRunner.yaml (resolve/review/publish jobs) with a thin caller of that engine's reusable review.yml, pinned to a reviewed SHA. BCApps keeps only its policy config (tools/BCQuality/bcquality.config.yaml) and the pull_request intake workflow. Security model unchanged: read-only review job runs the model on the untrusted diff; separate write-scoped publish job posts saved artifacts.

The engine now lives in the new public repo microsoft/BC-PullRequestReviewAgent so BCApps (and partner forks) can consume the reusable workflow cross-repo. Update uses: and engine_ref: to f9f7302.

Pins uses:+engine_ref to the BC-PullRequestReviewAgent v1.0.2 release, which adds private-repo authenticated fetch and reliable findings-file harvest (verified end-to-end). Replaces the pre-release SHA f9f7302.

…-engine # Conflicts: # .github/workflows/CopilotPRReviewRunner.yaml # tools/Code Review/scripts/Invoke-CopilotPRReview.ps1

github-actions · 2026-07-09T07:47:51Z

-      run:
-        shell: pwsh
-    outputs:
-      pr_number: ${{ steps.pr.outputs.number }}


$\textbf{🟡\ Medium\ Severity\ —\ Agent} \quad \color{gray}{\texttt{\small Iteration\ 1}}$

The 'review' job calls the external reusable workflow 'microsoft/BC-PullRequestReviewAgent/.github/workflows/review.yml@v1.0.2' and passes 'secrets: inherit', forwarding every repo/org secret to that external workflow.

v1.0.2 is a mutable tag, not a commit SHA: every other action reference in this same file (actions/checkout, actions/setup-node, actions/upload-artifact, etc., in the pre-change version) is pinned to a full commit SHA with a version comment, and the called workflow's own header comment explicitly documents the expected pattern as 'uses: microsoft/BC-PullRequestReviewAgent/.github/workflows/review.yml@'. If the v1.0.2 tag were ever moved (accidentally or via a compromised release process) the workflow would silently execute different code with full access to inherited secrets. Given the impact this would represent if it occurred, the concern would normally warrant a major/blocker rating, but per policy this unbacked agent finding is capped at minor -- recommend pinning both the 'uses:' ref and the 'engine_ref' input to the resolved commit SHA for v1.0.2 (currently 7fbb20ce36970abfbc1716effe48d6f72bcb1610), consistent with this workflow's own SHA-pinning convention and the engine's documented guidance.

_{👍 useful · ❤️ especially valuable · 👎 wrong - reply with why}

github-actions · 2026-07-09T07:47:55Z

Copilot PR Review

Iteration 3 · Outcome: completed

PR touches only workflow YAML, PowerShell orchestration scripts, and Markdown docs; no AL objects are present so every AL-domain leaf found an empty worklist (performance/security/privacy/style: completed with empty findings; upgrade/ui: not-applicable, no page or upgrade/install objects in diff). Findings below come from the super-skill's cross-cutting self-review pass over the CI/CD delegation change.

Knowledge source: https://github.com/microsoft/BCQuality@822cae1b2771ac25f665f73369f69093bd4fd630

Findings by domain

Findings split into Knowledge-backed (cite a BCQuality article) and Agent (the agent's own judgement, no matching BCQuality rule).

Domain	Findings	Knowledge-backed	Agent	Inline	Fallback
Agent	2	0	2	0	0

Totals: 0 knowledge-backed · 2 agent findings.

Orchestrator pre-filter (13 file(s) excluded)

layer-disabled (knowledge) : 13 file(s)

_{Findings produced by the Copilot CLI agent against BCQuality at 822cae1b2771ac25f665f73369f69093bd4fd630. Reply 👎 on any inline comment to flag false positives.}

WaelAbuSeada · 2026-07-09T13:12:53Z

-          if-no-files-found: warn
+    # Pin BOTH the workflow ref and engine_ref to the same reviewed engine release.
+    uses: microsoft/BC-PullRequestReviewAgent/.github/workflows/review.yml@v1.0.3
+    secrets: inherit


What does this mean?

WaelAbuSeada · 2026-07-09T13:13:04Z

-          path: ${{ github.workspace }}/review-output
-          if-no-files-found: warn
+    # Pin BOTH the workflow ref and engine_ref to the same reviewed engine release.
+    uses: microsoft/BC-PullRequestReviewAgent/.github/workflows/review.yml@v1.0.3


Fix renaming

WaelAbuSeada · 2026-07-09T13:14:02Z

+    secrets: inherit
+    with:
+      target_repo: ${{ github.repository }}
+      engine_ref: v1.0.3


WaelAbuSeada · 2026-07-09T13:15:45Z

+    with:
+      target_repo: ${{ github.repository }}
+      engine_ref: v1.0.3
+      config_path: tools/BCQuality/bcquality.config.yaml


Delete config files and lets use workflow parameters as it is safer

WaelAbuSeada · 2026-07-09T13:16:02Z

+      engine_ref: v1.0.3
+      config_path: tools/BCQuality/bcquality.config.yaml
+      # BCQuality policy overrides (operator escape-hatch; config file is the default)
+      bcquality_repo: ${{ vars.BCQUALITY_REPO }}


Encapsulated in the PRReviewRepo

WaelAbuSeada · 2026-07-09T13:22:49Z

+      knowledge_allow: ${{ vars.BCQUALITY_KNOWLEDGE_ALLOW }}
+      knowledge_deny: ${{ vars.BCQUALITY_KNOWLEDGE_DENY }}
+      # Reviewer behaviour overrides
+      copilot_model: ${{ vars.COPILOT_REVIEW_MODEL }}


Only add parameters that we need to customize in BCApps, otherwise we accept default parameters from PRReview template

github-actions Bot added the Build: Automation Workflows and other setup in .github folder label Jul 8, 2026

github-actions Bot added this to the Version 29.0 milestone Jul 8, 2026

wenjiefan added 2 commits July 8, 2026 16:05

Repoint engine to microsoft/BC-PullRequestReviewAgent (public)

bd217fc

The engine now lives in the new public repo microsoft/BC-PullRequestReviewAgent so BCApps (and partner forks) can consume the reusable workflow cross-repo. Update uses: and engine_ref: to f9f7302.

Repoint PR review engine to v1.0.2

ac4fdef

Pins uses:+engine_ref to the BC-PullRequestReviewAgent v1.0.2 release, which adds private-repo authenticated fetch and reliable findings-file harvest (verified end-to-end). Replaces the pre-release SHA f9f7302.

gggdttt marked this pull request as ready for review July 9, 2026 07:34

gggdttt requested review from a team July 9, 2026 07:34

Merge remote-tracking branch 'origin/main' into feature/pr-review-use…

ef45763

…-engine # Conflicts: # .github/workflows/CopilotPRReviewRunner.yaml # tools/Code Review/scripts/Invoke-CopilotPRReview.ps1

github-actions Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread tools/BCQuality/README.md

wenjiefan added 2 commits July 9, 2026 10:07

Point BCQuality README at public engine repo (BC-PullRequestReviewAgent)

1562223

Bump review engine to v1.0.3 (includes #8828 resume-fence parser fix)

7d6860e

WaelAbuSeada requested changes Jul 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Consume BC PR review engine instead of hosting it#9210

Consume BC PR review engine instead of hosting it#9210
gggdttt wants to merge 6 commits into
mainfrom
feature/pr-review-use-engine

gggdttt commented Jul 8, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot Jul 9, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

WaelAbuSeada Jul 9, 2026

Uh oh!

WaelAbuSeada Jul 9, 2026

Uh oh!

WaelAbuSeada Jul 9, 2026

Uh oh!

WaelAbuSeada Jul 9, 2026

Uh oh!

WaelAbuSeada Jul 9, 2026

Uh oh!

WaelAbuSeada Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

gggdttt commented Jul 8, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Changes

Security model (unchanged)

Before merge

Uh oh!

github-actions Bot Jul 9, 2026

Choose a reason for hiding this comment

The 'review' job calls the external reusable workflow 'microsoft/BC-PullRequestReviewAgent/.github/workflows/review.yml@v1.0.2' and passes 'secrets: inherit', forwarding every repo/org secret to that external workflow.

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Copilot PR Review

Findings by domain

Orchestrator pre-filter (13 file(s) excluded)

Uh oh!

WaelAbuSeada Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

WaelAbuSeada Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

WaelAbuSeada Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

WaelAbuSeada Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

WaelAbuSeada Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

WaelAbuSeada Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gggdttt commented Jul 8, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading