Add workflow to assign a random reviewer on new PRs
What the developer wrote
Authored by Matt Corallo
Add workflow to assign a random reviewer on new PRs
Forgejo has no built-in random/round-robin reviewer assignment, so add a
small Forgejo Actions workflow that, on pull request open, picks a random
developer from the maintainer pool (excluding the author) and requests
their review via the API.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
What changed, and why it matters
This commit adds a harmless automation script that randomly picks a code reviewer when a new pull request is opened. It does not change any payment, cryptography, or network code, and it does not introduce any obvious security flaw.
No security action required. As a routine hardening step, verify that the FORGEJO_TOKEN secret has only the minimum required permissions (e.g., pull_request:write or repo scope for reviewer assignment) and is not over-scoped.
Security signals we found
Uses pull_request_target, but only for API write access and does not check out PR code
No execution of untrusted code from the pull request
No changes to cryptographic, networking, or payment-handling logic
Evidence from the diff
The new Forgejo Actions workflow runs on pull_request_target (base repository context) and only calls the Forgejo API to assign a reviewer. It never checks out or executes the PR’s code. The workflow uses a stored token (FORGEJO_TOKEN) and a hard-coded reviewer pool. There is no evidence in the commit of secret leakage, code execution, or malicious behavior.
Changed components
.forgejo/workflows/assign-reviewer.ymlInspect captured patch +46 / −0
diff --git a/.forgejo/workflows/assign-reviewer.yml b/.forgejo/workflows/assign-reviewer.yml
new file mode 100644
index 0000000..f4e4f86
--- /dev/null
+++ b/.forgejo/workflows/assign-reviewer.yml
@@ -0,0 +1,46 @@
+name: Assign a random reviewer
+
+# Forgejo has no built-in random/round-robin reviewer assignment (only
+# path-based CODEOWNERS), so pick a random developer for each newly opened
+# pull request and request their review via the API.
+
+on:
+ pull_request_target:
+ types: [opened]
+
+jobs:
+ assign:
+ runs-on: debian-trixie
+ steps:
+ - name: Request review from a random developer
+ # This never checks out or runs any PR code -- it only makes an API
+ # call -- so running in the base-repo context (pull_request_target,
+ # which is what grants the token write access even for fork PRs) is safe.
+ env:
+ API: ${{ github.server_url }}/api/v1
+ REPO: ${{ github.repository }}
+ PR: ${{ github.event.pull_request.number }}
+ AUTHOR: ${{ github.event.pull_request.user.login }}
+ FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+ # Space-separated pool of candidate reviewers.
+ REVIEWERS: "matt val wpaulino joost_spiral jkczyz benthecarman tankyleo tnull"
+ run: |
+ set -eu
+ AUTH="Authorization: token ${FORGEJO_TOKEN}"
+
+ # Build the candidate pool, excluding the PR author.
+ POOL=""
+ for d in $REVIEWERS; do
+ [ "$d" = "$AUTHOR" ] || POOL="$POOL $d"
+ done
+
+ REVIEWER="$(printf '%s\n' $POOL | shuf -n1)"
+ if [ -z "$REVIEWER" ]; then
+ echo "No eligible reviewer (author is the only candidate); skipping."
+ exit 0
+ fi
+
+ echo "Requesting review from $REVIEWER on PR #$PR"
+ curl -fsS -H "$AUTH" -H 'Content-Type: application/json' \
+ -X POST "$API/repos/$REPO/pulls/$PR/requested_reviewers" \
+ -d "$(jq -n --arg r "$REVIEWER" '{reviewers: [$r]}')" >/dev/null
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.