From ab8d6abf1c777d7595720de8c6e260d67e17cc38 Mon Sep 17 00:00:00 2001
From: Derek Schuff <dschuff@chromium.org>
Date: Mon, 19 Oct 2026 22:09:55 -0700
Subject: [PATCH 1/3] Add GitHub Actions workflow for Antigravity AI code
 review

---
 .github/workflows/ai-review.yml | 48 +++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/ai-review.yml

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
new file mode 100644
index 00000000000..3ced87bc821
--- /dev/null
+++ b/.github/workflows/ai-review.yml
@@ -0,0 +1,48 @@
+name: 'Google Antigravity Code Review'
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: 'Antigravity AI Code Review'
+    # Run only on pull request updates, or on comments containing '/review'
+    if: |
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'issue_comment' &&
+       github.event.issue.pull_request &&
+       contains(github.event.comment.body, '/review'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run Antigravity Review Agent
+        uses: anguillanneuf/run-antigravity-cli@master
+        with:
+          api-key: ${{ secrets.GEMINI_API_KEY }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          model: 'gemini-flash-latest'
+          fail-on-error: true
+          min-severity: 'MEDIUM'
+          min-confidence: '3'
+          custom-prompt: |
+            You are reviewing a Pull Request for Binaryen, a WebAssembly compiler and toolchain infrastructure library written in C++.
+            Focus on:
+            1. WebAssembly specification compliance, validation rules, and proper typing.
+            2. Soundness of compiler optimization passes, AST/IR transformations, and Module invariants.
+            3. Memory safety, bounds checks, null pointer dereferences, integer overflow, and clean error handling.
+            4. Performance traps and edge cases in parser, binary reader/writer, and interpreter.
+            5. Adherence to Binaryen C++ conventions while avoiding superficial style nitpicks.

From 98a955a412c171cbe2b21397d080504b2e4c5d1d Mon Sep 17 00:00:00 2001
From: Derek Schuff <dschuff@chromium.org>
Date: Tue, 20 Oct 2026 11:27:48 -0700
Subject: [PATCH 2/3] Address review feedback: restrict /review to maintainers,
 fix checkout ref, and gate fork secrets

---
 .github/workflows/ai-review.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 3ced87bc821..5554cdf3e91 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -18,16 +18,20 @@ concurrency:
 jobs:
   review:
     name: 'Antigravity AI Code Review'
-    # Run only on pull request updates, or on comments containing '/review'
+    # 1. Run automatically for internal PRs where secrets exist
+    # 2. For external fork PRs, run when an authorized member comments '/review'
     if: |
-      github.event_name == 'pull_request' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
       (github.event_name == 'issue_comment' &&
        github.event.issue.pull_request &&
+       contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) &&
        contains(github.event.comment.body, '/review'))
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/merge', github.event.issue.number) || github.ref }}
 
       - name: Run Antigravity Review Agent
         uses: anguillanneuf/run-antigravity-cli@master

From 32f5ef6d72324e25bf54f4cceebf13698a658268 Mon Sep 17 00:00:00 2001
From: Derek Schuff <dschuff@chromium.org>
Date: Tue, 20 Oct 2026 13:49:20 -0700
Subject: [PATCH 3/3] Pin action SHA, switch to PR head ref, and restrict
 permissions

---
 .github/workflows/ai-review.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 5554cdf3e91..766556d4ed5 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -9,7 +9,6 @@ on:
 permissions:
   contents: read
   pull-requests: write
-  issues: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
@@ -31,10 +30,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/merge', github.event.issue.number) || github.ref }}
+          ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/head', github.event.issue.number) || github.event.pull_request.head.sha }}
 
       - name: Run Antigravity Review Agent
-        uses: anguillanneuf/run-antigravity-cli@master
+        uses: anguillanneuf/run-antigravity-cli@126f1bc7865cbcf3784cf764c96d3eb7f4d0b5d9 # master
         with:
           api-key: ${{ secrets.GEMINI_API_KEY }}
           github-token: ${{ secrets.GITHUB_TOKEN }}