Depot workflows

Review pull requests on Depot with a Depot-bound OIDC identity and a durable artifact cache.

1. Trust the Depot identity

Copy the Depot organization ID from the Depot URL or OIDC identity. It looks like nnkbz93qn7.
Open the Doomer project's CI / OIDC settings.
Choose Depot CI, enter the repository or organization, and enter the Depot organization ID.
Choose Pull for review workflows.

2. Add the workflow

.depot/workflows/adversary.yml

name: Adversary review

on:
  pull_request:

jobs:
  review:
    name: Doomer review
    runs-on: depot-ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Mount adversary cache
        uses: depot/cache-mount@v1
        with:
          name: adversary-${{ github.event.repository.id }}-v1
          path: /mnt/adversary

      - name: Run adversaries
        uses: doomerlabs/actions/run@v1
        with:
          adversaries: auto
          path: .
          data-dir: /mnt/adversary
          timeout-minutes: 20
          auth-mode: oidc
          registry-namespace: your-project-slug
          model-provider: openai
          model: your-model-id
          model-api-key: ${{ secrets.OPENAI_API_KEY }}
          fail-on-findings: false

The OIDC grant must match both the repository identity and the Depot organization ID.
The cache disk name includes the GitHub repository ID so unrelated repositories do not share private package contents.
Keep the job timeout longer than the action's review timeout so the action can report and clean up normally.

Cold-cache behavior

The first run fills /mnt/adversary. Automatic selection can pull several matching packages, so leave at least 20 minutes for the action on the first run. Later runs resolve current digests and reuse packages already on the disk.

Service-account fallback

If you cannot use Depot OIDC, create a pull-scoped token in Service accounts, add it to Depot secrets, and replace the auth inputs:

.depot/workflows/adversary.yml

- name: Run adversaries
  uses: doomerlabs/actions/run@v1
  with:
    adversaries: auto
    auth-mode: token
    token: ${{ secrets.ADVERSARY_SERVICE_ACCOUNT_TOKEN }}
    registry-namespace: your-project-slug
    data-dir: /mnt/adversary
    timeout-minutes: 20

This can pull and run adversaries, but repository feedback memory remains unavailable because service accounts are not repository-bound.

Reviews without this workflow

Install the GitHub App from Repos to get hosted pull-request reviews with hosted inference. See Hosted reviews.