What the developer wrote
Authored by saubyk
github: bump gateway code-review to v0.5.0
Update the gateway-action pin and runtime_ref to the v0.5.0 release
commits, and extend the shim for the new inline-command support: a
pull_request_review_comment trigger plus comment_in_reply_to input so
/gateway dismiss, promote, and explain work as replies on a finding's
inline thread. Same fork-PR safety profile as issue_comment — comment
events receive no secrets on fork PRs.
Runtime highlights in v0.5.0: /gateway promote (file a finding as an
issue and dismiss it), batch dismiss, gateway-approved label with
stale-approval retraction, and one review comment per run with a
verdict-first body.
What changed, and why it matters
This commit updates a GitHub Actions workflow for an optional code-review bot called 'gateway' from version 0.4.4 to 0.5.0. It adds support for replying to inline review comments (not just regular PR comments) and pins the new action and runtime to specific, immutable commit hashes. The change is administrative and does not touch LND's core Lightning node code, wallet logic, or network protocol handling.
No immediate security action required. Treat as routine CI/CD maintenance. Reviewers may optionally verify the published v0.5.0 release notes and the two pinned SHAs (gateway-action 3a31b86a and runtime b7490e68) against the upstream lightninglabs/gateway-action repository to confirm expected contents, and ensure the pull_request_review_comment conditional does not inadvertently expose secrets to fork PRs in the organization's GitHub plan/settings.
Security signals we found
Workflow-only change with no modifications to LND application code
Action and runtime pinned to immutable commit SHAs (supply-chain mitigation)
New pull_request_review_comment trigger added; commit message asserts same fork-PR secret safety as issue_comment
No new secrets, permissions, or token scopes introduced
No vendor disclosure of a security vulnerability or bug in the commit or supplied references
Evidence from the diff
The diff modifies .github/workflows/gateway.yml only. It bumps lightninglabs/gateway-action from SHA abe7cf894c5afd4e488caac4c72a4a268b65933e (v0.4.4) to 3a31b86adf442852801a04ddb9c6bc0f12d363da (v0.5.0), and the private runtime_ref from 20675fc28b157a7b4fcfbeddf7a2ca8e2115c387 to b7490e68db31b391becfe9534e947b8004fc518b. It adds the pull_request_review_comment trigger (created type), updates the job conditional to handle both issue_comment and pull_request_review_comment events, and passes a new comment_in_reply_to input. The workflow retains its existing permission model and the commit message explicitly states the new trigger preserves the same fork-PR safety profile as issue_comment because comment events on fork PRs receive no secrets.
Changed components
.github/workflows/gateway.ymlInspect captured patch +20 / −6
diff --git a/.github/workflows/gateway.yml b/.github/workflows/gateway.yml
index eec70f8..5e22aa1 100644
--- a/.github/workflows/gateway.yml
+++ b/.github/workflows/gateway.yml
@@ -3,7 +3,11 @@ name: gateway
# Opt-in code-review bot. Triggered by a `/gateway <command>` comment on a PR
# (e.g. `/gateway review`); review/approve commands are gated to maintainers.
# Comment-commands only — no pull_request triggers — so fork PRs (which receive
-# no secrets) never spawn failing runs.
+# no secrets) never spawn failing runs. v0.5.0 adds the
+# pull_request_review_comment trigger: /gateway dismiss, promote, and explain
+# now also work as replies on a finding's inline thread (finding id inferred
+# from the thread when omitted). Also a comment event — same fork-PR safety
+# profile as issue_comment.
#
# Thin shim: the public lightninglabs/gateway-action mints an App token and
# checks out the private gateway runtime at execution time. The runtime stays
@@ -12,6 +16,8 @@ name: gateway
on:
issue_comment:
types: [created]
+ pull_request_review_comment:
+ types: [created]
permissions:
# The action mints an App installation token internally; the GITHUB_TOKEN
@@ -24,25 +30,33 @@ jobs:
# comments that look like a /gateway command so unrelated comments don't
# spin up a no-op runner. `contains` (not `startsWith`) because the runtime
# accepts the command at column 0 of any line, including multi-line bodies.
- if: ${{ github.event.issue.pull_request != null && contains(github.event.comment.body, '/gateway') }}
+ if: >-
+ ${{
+ (github.event_name == 'issue_comment'
+ && github.event.issue.pull_request != null
+ && contains(github.event.comment.body, '/gateway')) ||
+ (github.event_name == 'pull_request_review_comment'
+ && contains(github.event.comment.body, '/gateway'))
+ }}
runs-on: ubuntu-latest
timeout-minutes: 15
env:
GATEWAY_REVIEW_MODE: multi
steps:
- - uses: lightninglabs/gateway-action@abe7cf894c5afd4e488caac4c72a4a268b65933e # v0.4.4
+ - uses: lightninglabs/gateway-action@3a31b86adf442852801a04ddb9c6bc0f12d363da # v0.5.0
with:
# Pin the private runtime to an immutable commit (matches the action
# SHA-pin above) so runtime upgrades go through an lnd PR, not a moved
- # tag. Without this, runtime_ref defaults to the v0.4.4 tag.
- runtime_ref: 20675fc28b157a7b4fcfbeddf7a2ca8e2115c387 # gateway v0.4.4
+ # tag. Without this, runtime_ref defaults to the v0.5.0 tag.
+ runtime_ref: b7490e68db31b391becfe9534e947b8004fc518b # gateway v0.5.0
event_name: ${{ github.event_name }}
event_action: ${{ github.event.action }}
repo: ${{ github.repository }}
- pr_number: ${{ github.event.issue.number }}
+ pr_number: ${{ github.event.issue.number || github.event.pull_request.number }}
actor: ${{ github.event.sender.login }}
comment_body: ${{ github.event.comment.body }}
comment_id: ${{ github.event.comment.id }}
+ comment_in_reply_to: ${{ github.event.comment.in_reply_to_id }}
# installation_id intentionally omitted: as of gateway v0.4.4 the
# runtime resolves the App installation covering this repo from
# app_id/private_key, so a hardcoded (and easily wrong-org) id is no
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.