github: add gateway code-review workflow (#10910)
What the developer wrote
Authored by Suheb
github: add gateway code-review workflow (#10910)
* github: add gateway code-review workflow
Opt-in review bot invoked via /gateway review PR comments (maintainer-gated).
Thin shim onto the public lightninglabs/gateway-action (SHA-pinned to v0.4.3);
the review runtime stays private. Comment-commands only, so fork PRs never
spawn failing runs.
* github: address review on gateway workflow
- Gate the job on a /gateway command in the comment body so unrelated PR
comments don't spin up no-op runners. Use contains() (not startsWith) since
the runtime accepts the command at column 0 of any line, incl. multi-line.
- Pin runtime_ref to the gateway commit SHA so runtime upgrades require an lnd
PR rather than a moved tag, matching the action SHA-pin.
What changed, and why it matters
This commit adds a new optional GitHub Actions workflow that lets maintainers trigger an automated code-review bot by typing '/gateway review' on a pull request. It is purely an infrastructure/configuration change and does not alter any LND node code, cryptography, or network behavior. The workflow is comment-triggered only, uses pinned commit references, and minimizes token permissions, which are defensive design choices rather than fixes for any known vulnerability.
No immediate security action is required. As a routine hardening step, reviewers should verify that the private gateway runtime enforces maintainer authorization before acting on '/gateway review' commands, that secrets are not logged, and that the SHA-pinned action and runtime_ref match the intended v0.4.3 release. Consider documenting the workflow's trust model in the repository security policy.
Security signals we found
New CI/CD workflow that consumes repository secrets
Workflow triggered by untrusted PR comments but gated to PR comments only and maintainer-gated inside the private runtime
Action and private runtime are SHA-pinned rather than tag-pinned, reducing supply-chain tag-moving risk
GITHUB_TOKEN permissions minimized to contents: read
No pull_request trigger, so fork PRs do not automatically execute the workflow
Evidence from the diff
The change introduces .github/workflows/gateway.yml. It runs on issue_comment events, filters to PR comments containing ‘/gateway’, and calls the public lightninglabs/gateway-action at a pinned SHA (fa29e3132c8af9cdabd9cedca3b1b6ece56d0982). It passes PR metadata and repository secrets (GATEWAY_APP_ID, GATEWAY_PRIVATE_KEY, CLAUDE_CODE_OAUTH_TOKEN) into the action, which mints an app token and checks out a private runtime. The runtime itself is pinned to a separate commit SHA (bb11d9744cd6fe7fbeeb9de720fc8a74b5232a8e). No application code is modified.
Changed components
.github/workflows/gateway.ymlInspect captured patch +49 / −0
diff --git a/.github/workflows/gateway.yml b/.github/workflows/gateway.yml
new file mode 100644
index 0000000..e5d7cb9
--- /dev/null
+++ b/.github/workflows/gateway.yml
@@ -0,0 +1,49 @@
+name: gateway
+
+# Opt-in code-review bot. Triggered by a `/gateway <command>` comment on a PR
+# (e.g. `/gateway review`); review/approve commands are gated to maintainers.
+# Comment-commands only — no pull_request triggers — so fork PRs (which receive
+# no secrets) never spawn failing runs.
+#
+# Thin shim: the public lightninglabs/gateway-action mints an App token and
+# checks out the private gateway runtime at execution time. The runtime stays
+# private; only this entry point is public.
+
+on:
+ issue_comment:
+ types: [created]
+
+permissions:
+ # The action mints an App installation token internally; the GITHUB_TOKEN
+ # handed to this shim is unused, so we minimise it.
+ contents: read
+
+jobs:
+ review:
+ # issue_comment fires for all issues and every PR comment. Filter to PR
+ # comments that look like a /gateway command so unrelated comments don't
+ # spin up a no-op runner. `contains` (not `startsWith`) because the runtime
+ # accepts the command at column 0 of any line, including multi-line bodies.
+ if: ${{ github.event.issue.pull_request != null && contains(github.event.comment.body, '/gateway') }}
+ runs-on: ubuntu-latest
+ timeout-minutes: 15
+ env:
+ GATEWAY_REVIEW_MODE: multi
+ steps:
+ - uses: lightninglabs/gateway-action@fa29e3132c8af9cdabd9cedca3b1b6ece56d0982 # v0.4.3
+ with:
+ # Pin the private runtime to an immutable commit (matches the action
+ # SHA-pin above) so runtime upgrades go through an lnd PR, not a moved
+ # tag. Without this, runtime_ref defaults to the v0.4.3 tag.
+ runtime_ref: bb11d9744cd6fe7fbeeb9de720fc8a74b5232a8e # gateway v0.4.3
+ event_name: ${{ github.event_name }}
+ event_action: ${{ github.event.action }}
+ repo: ${{ github.repository }}
+ pr_number: ${{ github.event.issue.number }}
+ actor: ${{ github.event.sender.login }}
+ comment_body: ${{ github.event.comment.body }}
+ comment_id: ${{ github.event.comment.id }}
+ installation_id: 140960039
+ app_id: ${{ secrets.GATEWAY_APP_ID }}
+ private_key: ${{ secrets.GATEWAY_PRIVATE_KEY }}
+ claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.