Refactor Devin PR Code Review workflow

[Freedisch]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
synapseai	Ready	Preview, Comment	May 20, 2026 2:08pm

[devin-ai-integration]

Bug: Duplicate echo — copy-paste error

This line is a duplicate of line 33. The second commit (f800897) replaced echo "Response: $BODY" with another echo "Status: $HTTP_CODE" instead of simply deleting it. The status code is printed twice for no reason.

Suggested change

	echo "Status: $HTTP_CODE"
	echo "Status: $HTTP_CODE"

[devin-ai-integration]

Security: Session ID leaked to CI logs

The original echo "Response: $BODY" was correctly removed to avoid exposing sensitive data in CI logs, but this line re-introduces essentially the same problem. The session ID is a credential-equivalent that can be used to interact with or access the Devin session. GitHub Actions logs are visible to anyone with read access to the repo.

If you need the session ID for a downstream step, use echo "::add-mask::$SESSION_ID" before logging it, or pass it via $GITHUB_OUTPUT without echoing. Better yet, if no downstream step needs it, remove this line entirely.

Suggested change

	echo "Session ID: $SESSION_ID"
	SESSION_ID=$(echo "$BODY" | jq -r '.session_id // .id // empty')

[devin-ai-integration]

Bug: No validation that SESSION_ID is non-empty

If the API returns a JSON structure without session_id or id (e.g., a changed response schema, or a partial error response that still returns 200/201), jq will output an empty string and the workflow will silently succeed with a blank session ID. You should guard against this:

Suggested change

	SESSION_ID=$(echo "$BODY" | jq -r '.session_id // .id // empty')
	SESSION_ID=$(echo "$BODY" | jq -r '.session_id // .id // empty')
	if [ -z "$SESSION_ID" ]; then
	echo "::error::Could not extract session ID from API response"
	exit 1
	fi

[devin-ai-integration]

Edge case: "idempotent": true without an idempotency key is effectively a no-op

This workflow triggers on synchronize (every push to the PR branch). Each push fires a new API call with the same "idempotent": true but no idempotency key, so the Devin API has no way to deduplicate — it will create a new review session on every push.

If the intent is to prevent duplicate reviews, you need to provide a deterministic idempotency key, e.g.:

Suggested change

	"idempotent": true
	"prompt": "Review PR #${{ github.event.pull_request.number }} in ${{ github.repository }}. Look at the diffs, identify logical bugs, code convention violations, and potential edge-case failures. Post your feedback as inline review comments on the PR.",
	"idempotent": true,
	"idempotency_key": "pr-review-${{ github.repository }}-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}"

[devin-ai-integration]

Waste: checkout step is unnecessary

The only action in this workflow is a curl call to the Devin API. The checked-out code is never read, built, or tested. Moreover, fetch-depth: 0 fetches the entire git history, which is the most expensive checkout option. This adds unnecessary latency to every PR event.

Remove this step entirely, or if you anticipate needing the repo content in a future step, at minimum change fetch-depth: 0 to fetch-depth: 1.

[devin-ai-integration]

Edge case: No curl timeout — workflow can hang indefinitely

If the Devin API is slow or unresponsive, this curl will block until GitHub's own job-level timeout (default 6 hours) kills it. Add --connect-timeout and --max-time to fail fast:

Suggested change

	RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "https://api.devin.ai/v1/sessions" \
	RESPONSE=$(curl -s -w "\n%{http_code}" --connect-timeout 10 --max-time 30 -X POST "https://api.devin.ai/v1/sessions" \

[devin-ai-integration]

Review Summary

I reviewed the diff for this PR (refactoring the Devin PR Code Review workflow). Found 6 issues across 3 categories:

🔴 Bugs (2)

Issue	Line	Description
Duplicate echo	L34	echo "Status: $HTTP_CODE" printed twice — copy-paste error from the fix commit
No SESSION_ID validation	L42	If the API response lacks session_id/id, the workflow silently succeeds with a blank value

🟡 Security (1)

Issue	Line	Description
Session ID in CI logs	L43	echo "Session ID: $SESSION_ID" exposes a credential-equivalent in publicly-visible logs — the same class of issue the second commit tried to fix

🟠 Edge Cases / Improvements (3)

Issue	Line	Description
idempotent: true without key	L27	No idempotency key means duplicate review sessions on every push to the PR branch
Unnecessary checkout	L13-16	Full repo clone (fetch-depth: 0) but code is never used — pure overhead
No curl timeout	L22	Missing --connect-timeout/--max-time — workflow hangs if API is unresponsive

All issues have inline comments with suggested fixes.