@expo/code-review-cli 0.5.2 → 0.7.0

package/build/reporters/github.js

@@ -1,12 +1,30 @@
 import { writeFile, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { run } from "../core/exec.js";
+import { resolveTrustedTool, run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
 import { buildDiffLineIndex, commentMarker, parseReviewState, renderAggregateMarkdown, renderMarkdown, } from "../core/render.js";
 import { fingerprintFinding, scopedFingerprint } from "../core/schema.js";
 import { appendStepSummary } from "../core/step-summary.js";
 const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+/**
+ * The reviewer's OWN marker comments, oldest-first: carrying the marker AND authored
+ * by `ownLogin`. The body marker alone is not identity — it defaults to a hardcoded,
+ * public literal and is readable in the base-branch config, so anyone who can comment
+ * on the PR (the untrusted PR author included) could post a comment carrying it plus a
+ * forged embedded review state; a newest-marker-wins lookup would then adopt that
+ * state and carry its `dismissed` list forward, silently suppressing real findings.
+ * GitHub sets a comment's author from the authenticated identity and it cannot be
+ * spoofed, so matching on author closes that. When `ownLogin` is null the author
+ * cannot be confirmed, so NOTHING is treated as ours (fail closed). Pure; exported for
+ * tests.
+ */
+export function selectOwnComments(comments, marker, ownLogin) {
+    if (!ownLogin) {
+        return [];
+    }
+    return comments.filter((comment) => comment.body?.includes(marker) && comment.user?.login === ownLogin);
+}
 /**
  * Maintains exactly one PR comment, updating it in place across re-reviews (and
  * cleaning up duplicates) so the review converges instead of churning. Runs the
@@ -15,10 +33,48 @@ const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 export class GitHubReporter {
     options;
     marker;
+    /** Memoized login of the account this reporter posts as (see resolveOwnLogin). */
+    ownLoginResolution;
     constructor(options) {
         this.options = options;
         this.marker = commentMarker(options.commentTag);
     }
+    /**
+     * The login of the account this reporter comments as, so its own comment is
+     * recognized by AUTHOR (see selectOwnComments for why the body marker is not enough).
+     * Resolution: `gh api user` (a user/PAT token), else the scaffolded workflow's default
+     * GITHUB_TOKEN identity, `github-actions[bot]`, when running under Actions — an
+     * installation token can't read `/user`. Null when neither is available, which makes
+     * selectOwnComments treat no comment as ours (fail closed). Memoized: the identity is
+     * stable for the process, and every reporter method consults it.
+     */
+    resolveOwnLogin() {
+        this.ownLoginResolution ??= (async () => {
+            try {
+                const gh = await resolveTrustedTool("gh");
+                const { stdout } = await run(gh, ["api", "user", "--jq", ".login"], {
+                    cwd: this.options.cwd,
+                });
+                const login = stdout.trim();
+                if (login) {
+                    return login;
+                }
+            }
+            catch {
+                // The default GITHUB_TOKEN is an installation token: `/user` returns 403.
+            }
+            return process.env.GITHUB_ACTIONS ? "github-actions[bot]" : null;
+        })();
+        return this.ownLoginResolution;
+    }
+    /** This reporter's own marker comments, author-verified (see selectOwnComments). */
+    async ownComments() {
+        const [comments, ownLogin] = await Promise.all([
+            this.fetchAllComments(),
+            this.resolveOwnLogin(),
+        ]);
+        return selectOwnComments(comments, this.marker, ownLogin);
+    }
     async checkBreakGlass() {
         const comments = await this.fetchAllComments();
         return comments.some((comment) => typeof comment.body === "string" &&
@@ -65,8 +121,9 @@ export class GitHubReporter {
      * reviewdog #1911 lesson).
      */
     async clear() {
-        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
-        for (const comment of marked) {
+        // Only ever delete comments WE authored — never touch a look-alike posted by
+        // someone else (see selectOwnComments).
+        for (const comment of await this.ownComments()) {
             await this.deleteComment(comment.id);
         }
     }
@@ -88,7 +145,8 @@ export class GitHubReporter {
         await Promise.all([
             (async () => {
                 try {
-                    const { stdout } = await run("gh", ["pr", "diff", ...prArgs], { cwd });
+                    const gh = await resolveTrustedTool("gh");
+                    const { stdout } = await run(gh, ["pr", "diff", ...prArgs], { cwd });
                     link.diffLines = buildDiffLineIndex(parseUnifiedDiff(stdout));
                 }
                 catch {
@@ -97,7 +155,8 @@ export class GitHubReporter {
             })(),
             (async () => {
                 try {
-                    const { stdout } = await run("gh", ["pr", "view", ...prArgs, "--json", "baseRefOid"], {
+                    const gh = await resolveTrustedTool("gh");
+                    const { stdout } = await run(gh, ["pr", "view", ...prArgs, "--json", "baseRefOid"], {
                         cwd,
                     });
                     const oid = JSON.parse(stdout).baseRefOid;
@@ -146,10 +205,10 @@ export class GitHubReporter {
         await this.patchComment(existing.id, body);
         return { dismissedCount: dismissed.length, matched, unmatched };
     }
-    /** Newest reviewer-tagged comment (id + body), or null if none posted yet. */
+    /** Newest comment WE authored carrying our marker (id + body), or null if none. */
     async findExistingComment() {
-        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
-        const keep = marked[marked.length - 1];
+        const own = await this.ownComments();
+        const keep = own[own.length - 1];
         return keep ? { id: keep.id, body: keep.body ?? "" } : null;
     }
     // Safety cap on pagination (100/page): 30 pages = 3000 comments. Bounds a
@@ -165,8 +224,9 @@ export class GitHubReporter {
      */
     async fetchAllComments() {
         const all = [];
+        const gh = await resolveTrustedTool("gh");
         for (let page = 1; page <= GitHubReporter.MAX_COMMENT_PAGES; page++) {
-            const { stdout } = await run("gh", [
+            const { stdout } = await run(gh, [
                 "api",
                 "-X",
                 "GET",
@@ -199,7 +259,10 @@ export class GitHubReporter {
      * is the newest and is the keeper.
      */
     async upsertComment(body) {
-        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
+        // Update/clean up only comments WE authored, never a look-alike posted by
+        // someone else (see selectOwnComments) — otherwise the newest forged marker
+        // comment would be adopted as "ours" and edited/patched in its place.
+        const marked = await this.ownComments();
         if (marked.length === 0) {
             await this.createComment(body);
         }
@@ -227,7 +290,8 @@ export class GitHubReporter {
         }
     }
     async createComment(body) {
-        await this.withBodyFile(body, (jsonPath) => run("gh", [
+        const gh = await resolveTrustedTool("gh");
+        await this.withBodyFile(body, (jsonPath) => run(gh, [
             "api",
             "-X",
             "POST",
@@ -237,7 +301,8 @@ export class GitHubReporter {
         ], { cwd: this.options.cwd }));
     }
     async patchComment(commentId, body) {
-        await this.withBodyFile(body, (jsonPath) => run("gh", [
+        const gh = await resolveTrustedTool("gh");
+        await this.withBodyFile(body, (jsonPath) => run(gh, [
             "api",
             "-X",
             "PATCH",
@@ -247,6 +312,7 @@ export class GitHubReporter {
         ], { cwd: this.options.cwd }));
     }
     async deleteComment(commentId) {
-        await run("gh", ["api", "-X", "DELETE", `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
+        const gh = await resolveTrustedTool("gh");
+        await run(gh, ["api", "-X", "DELETE", `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
     }
 }

package/build/sources/github-pr.js

@@ -1,8 +1,21 @@
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { run } from "../core/exec.js";
+import { resolveTrustedTool, run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
+import { removeEscapingSymlinks, scrubAmbientRuntimeConfig } from "../core/scrub.js";
+/** A full 40-hex-char commit OID — the only ref form passed to security-sensitive git calls. */
+export function isCommitOid(value) {
+    return typeof value === "string" && /^[0-9a-f]{40}$/i.test(value);
+}
+/**
+ * Append gh as a git credential helper for a single command. The token comes from
+ * GH_TOKEN via the credential-helper protocol — never argv, never `.git/config` —
+ * so a base-SHA checkout with `persist-credentials: false` (no extraheader) can
+ * still fetch a private repo. Appending (not replacing) keeps a local user's own
+ * helpers first, so developer machines behave exactly as before.
+ */
+const GH_CREDENTIAL_HELPER_ARGS = ["-c", "credential.helper=!gh auth git-credential"];
 /**
  * Pulls PR diff + metadata through the `gh` CLI, which is preinstalled and
  * authenticated on GitHub Actions runners via GH_TOKEN.
@@ -12,17 +25,30 @@ export class GitHubPRSource {
     constructor(options) {
         this.options = options;
     }
+    metadataPromise;
     repoArgs() {
         return this.options.repo ? ["--repo", this.options.repo] : [];
     }
-    async getMetadata() {
-        const { stdout } = await run("gh", [
+    /**
+     * Memoized internally (not just by memoizeSource) because the materialization
+     * paths below need the immutable OIDs and must not depend on the caller having
+     * called getMetadata() first.
+     */
+    getMetadata() {
+        return (this.metadataPromise ??= this.fetchMetadata());
+    }
+    async fetchMetadata() {
+        const gh = await resolveTrustedTool("gh");
+        const { stdout } = await run(gh, [
             "pr",
             "view",
             String(this.options.prNumber),
             ...this.repoArgs(),
             "--json",
-            "title,body,baseRefName,headRefName",
+            // baseRefOid/headRefOid are the immutable commit OIDs backing this PR at
+            // this moment; every materialization below pins to them so a rename,
+            // force-push, or deleted head between API calls can't swap a tree.
+            "title,body,baseRefName,headRefName,baseRefOid,headRefOid",
         ], { cwd: this.options.cwd });
         const parsed = JSON.parse(stdout);
         return {
@@ -30,40 +56,45 @@ export class GitHubPRSource {
             body: parsed.body ?? "",
             baseRef: parsed.baseRefName ?? "",
             headRef: parsed.headRefName ?? "",
+            baseOid: isCommitOid(parsed.baseRefOid) ? parsed.baseRefOid.toLowerCase() : undefined,
+            headOid: isCommitOid(parsed.headRefOid) ? parsed.headRefOid.toLowerCase() : undefined,
         };
     }
     async getChangedFiles() {
-        const { stdout } = await run("gh", ["pr", "diff", String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
+        const gh = await resolveTrustedTool("gh");
+        const { stdout } = await run(gh, ["pr", "diff", String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
         return parseUnifiedDiff(stdout);
     }
     /**
-     * Check the PR HEAD out into a throwaway git worktree so the agents and verifier
-     * read the PR's versions of files (not whatever branch happens to be checked out).
-     * Fetches the head from the repo's own URL — `refs/pull/<n>/head`, which the base
-     * repo hosts even for fork PRs — so it's always the correct PR, independent of the
-     * local `origin`. Fails SOFT: any problem (not a git repo, fetch/worktree error)
-     * returns null, and the review falls back to reading the current checkout.
+     * Fetch `ref` from the repo's own HTTPS URL and materialize `oid` as a detached
+     * throwaway worktree under a fresh temp dir. Never falls back to a branch name:
+     * `oid` is validated as a full commit hash before reaching git.
      */
-    async prepareReadRootAsync() {
-        const cwd = this.options.cwd;
+    async materializeWorktreeAsync(ref, oid) {
         if (!this.options.repo) {
-            // Without an explicit owner/repo we can't build the fetch URL safely.
-            return null;
+            throw new Error("cannot materialize a PR tree without an explicit owner/repo");
+        }
+        if (!isCommitOid(oid)) {
+            throw new Error(`refusing to materialize a non-OID ref: "${oid}"`);
         }
+        const cwd = this.options.cwd;
         const url = `https://github.com/${this.options.repo}.git`;
-        const ref = `refs/pull/${this.options.prNumber}/head`;
+        const gitPath = await resolveTrustedTool("git");
         let parent;
         try {
-            await run("git", ["fetch", "--no-tags", "--depth=1", url, ref], { cwd });
-            parent = await mkdtemp(path.join(tmpdir(), "ecr-prhead-"));
-            const dir = path.join(parent, "head"); // must not pre-exist for `worktree add`
-            await run("git", ["worktree", "add", "--detach", dir, "FETCH_HEAD"], { cwd });
+            await run(gitPath, [...GH_CREDENTIAL_HELPER_ARGS, "fetch", "--no-tags", "--depth=1", url, ref], { cwd });
+            parent = await mkdtemp(path.join(tmpdir(), "ecr-tree-"));
+            const dir = path.join(parent, "tree"); // must not pre-exist for `worktree add`
+            // Check out the OID (not FETCH_HEAD): if the ref moved between the API call
+            // and this fetch, the OID is absent and this fails instead of silently
+            // materializing a different tree than the one the diff was fetched for.
+            await run(gitPath, ["worktree", "add", "--detach", dir, oid], { cwd });
             const removeParent = parent;
             return {
                 dir,
                 cleanup: async () => {
                     try {
-                        await run("git", ["worktree", "remove", "--force", dir], { cwd });
+                        await run(gitPath, ["worktree", "remove", "--force", dir], { cwd });
                     }
                     catch {
                         // best effort — fall through to removing the temp dir
@@ -72,11 +103,68 @@ export class GitHubPRSource {
                 },
             };
         }
-        catch {
+        catch (error) {
             if (parent) {
                 await rm(parent, { recursive: true, force: true }).catch(() => { });
             }
+            throw error;
+        }
+    }
+    /**
+     * Check the PR HEAD out into a throwaway worktree so the agents and verifier
+     * read the PR's versions of files (not whatever branch happens to be checked
+     * out), pinned to the immutable head OID. The fetch uses `refs/pull/<n>/head`,
+     * which the base repo hosts even for fork PRs.
+     *
+     * The worktree is SCRUBBED of ambient runtime config (opencode.json, .opencode
+     * plugins, AGENTS.md/CLAUDE.md, .mcp.json, .env*, …) before it's returned: the
+     * OpenCode server is started with this directory as its project root, and
+     * anything it discovers there is attacker-controlled PR content executing or
+     * injecting inside a process that holds the model credential and GH_TOKEN.
+     * Out-of-tree symlinks are stripped in the same pass: read tools are scoped by
+     * the literal path argument but follow symlinks underneath, so a PR-committed
+     * link escaping the tree would otherwise read arbitrary host files.
+     *
+     * Returns null only when no owner/repo is configured (a local `--pr` run
+     * without --repo, where the current checkout is an acceptable read root).
+     * Materialization FAILURES throw — the caller decides per mode whether that is
+     * fatal (CI: fail closed) or a soft fallback (local: the user's own checkout).
+     */
+    async prepareReadRootAsync() {
+        if (!this.options.repo) {
+            // Without an explicit owner/repo we can't build the fetch URL safely.
             return null;
         }
+        const metadata = await this.getMetadata();
+        if (!isCommitOid(metadata.headOid)) {
+            throw new Error("GitHub did not report an immutable head OID for this PR");
+        }
+        const root = await this.materializeWorktreeAsync(`refs/pull/${this.options.prNumber}/head`, metadata.headOid);
+        try {
+            await scrubAmbientRuntimeConfig(root.dir);
+            await removeEscapingSymlinks(root.dir);
+        }
+        catch (error) {
+            // A half-scrubbed tree must never become the runtime's project root.
+            await root.cleanup().catch(() => { });
+            throw error;
+        }
+        return root;
+    }
+    /**
+     * Materialize the PR's BASE commit as the trusted configuration root: review
+     * policy, prompts, routing, and auth mapping load from here, so a PR cannot
+     * change the reviewer that evaluates it (config changes activate on merge).
+     * Failures throw — `ecr ci` must fail closed, never fall back to the checkout.
+     */
+    async prepareTrustedConfigRootAsync() {
+        const metadata = await this.getMetadata();
+        if (!isCommitOid(metadata.baseOid)) {
+            throw new Error("GitHub did not report an immutable base OID for this PR");
+        }
+        // The base OID is fetchable by SHA (it's the tip of the base branch as of the
+        // API call; GitHub serves reachable SHAs — the same mechanism actions/checkout
+        // uses for `ref:` pins).
+        return this.materializeWorktreeAsync(metadata.baseOid, metadata.baseOid);
     }
 }

package/build/sources/local-git.js

@@ -1,4 +1,4 @@
-import { git, run } from "../core/exec.js";
+import { git, resolveTrustedTool, run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
 /**
  * Reads local git state. No network calls. Default compares the working tree
@@ -94,7 +94,8 @@ export class LocalGitSource {
         const chunks = [];
         for (const file of files) {
             // `--` so a filename beginning with `-` can't be read as a git option.
-            const { stdout } = await run("git", ["diff", "--no-index", "--", "/dev/null", file], {
+            const gitPath = await resolveTrustedTool("git");
+            const { stdout } = await run(gitPath, ["diff", "--no-index", "--", "/dev/null", file], {
                 cwd: this.cwd,
                 check: false,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.5.2",
+  "version": "0.7.0",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {
@@ -28,8 +28,8 @@
     "clean": "rimraf build",
     "typecheck": "tsc --noEmit",
     "lint": "oxlint src",
-    "fmt": "oxfmt src",
-    "fmt:check": "oxfmt --check src",
+    "fmt": "oxfmt --threads=1 src",
+    "fmt:check": "oxfmt --threads=1 --check src",
     "dev": "bun run src/cli.ts",
     "test:unit": "bun test",
     "release": "bash scripts/release.sh",

package/templates/command.yml

@@ -85,12 +85,18 @@ jobs:
       # config, and never `gh pr checkout` the PR head. The reviewer engine itself
       # is the PUBLISHED @expo/code-review-cli (fetched by npx), not built from any
       # checkout, so attacker-controlled PR code never runs here. The diff + PR
-      # metadata come from the API (`gh pr diff`/`gh pr view`).
+      # metadata come from the API (`gh pr diff`/`gh pr view`); `ecr ci` loads
+      # configuration from the PR's immutable base commit and reads source from a
+      # head worktree scrubbed of ambient runtime config (opencode.json, plugins,
+      # AGENTS.md, .env, …) — the same trust model as the pull_request workflow.
       - name: Checkout (base ref only — never the PR head)
         if: steps.cmd.outputs.run == 'true'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          # The CLI's own git fetches authenticate through `gh` from GH_TOKEN, so
+          # the token never lands in .git/config.
+          persist-credentials: false
 
       - name: Set up Node
         if: steps.cmd.outputs.run == 'true'

package/templates/config.jsonc

@@ -49,9 +49,9 @@
   //              store the key as a repo secret and pass it under that env var
   //              (the scaffolded workflow does). If you omit `auth` entirely,
   //              OpenCode's own login / ambient provider env vars are used.
-  // For Anthropic/Claude, set provider "anthropic", tokenEnv "ANTHROPIC_API_KEY",
-  // and an anthropic/... model above. For another provider, omit `auth` and set
-  // REVIEWER_MODEL after an `opencode auth login` for that provider.
+  // For Anthropic/Claude, see the dedicated block below (it now runs through the
+  // Claude Code CLI). For another provider, omit `auth` and set REVIEWER_MODEL
+  // after an `opencode auth login` for that provider.
   //
   // MIXED setup (a ChatGPT/Codex subscription for the default models, plus a
   // metered API key for pro-tier models the subscription doesn't offer): use the
@@ -65,6 +65,24 @@
   // (openai oauth: tokenEnv holds the ACCESS token from an `opencode auth login`
   // ChatGPT sign-in — `ecr setup-auth` extracts it. NEVER share the refresh
   // token: it is single-use and dies on first rotation.)
+  //
+  // Anthropic runs through the Claude Code CLI, inferred from the model — set your
+  // models to "anthropic/…" (e.g. anthropic/claude-opus-5, anthropic/claude-sonnet-5)
+  // and run `claude setup-token`, exporting the token as CLAUDE_CODE_OAUTH_TOKEN (CI)
+  // or rely on your local `claude` login. An auth entry is OPTIONAL (tokenEnv just
+  // names the credential env); `ecr setup-auth` walks you through it.
+  //   "auth": { "providers": {
+  //     "anthropic": { "tokenEnv": "CLAUDE_CODE_OAUTH_TOKEN" }
+  //   } }
+  //
+  // MIXING engines is supported: the engine is inferred per agent from its model, so
+  // an anthropic entry may coexist with an openai (or any other) OpenCode provider.
+  // Each agent's `model` selects its engine — an `anthropic/…` agent runs through the
+  // Claude Code CLI while an `openai/…` agent runs through OpenCode, in the SAME run.
+  //   "auth": { "providers": {
+  //     "anthropic": { "tokenEnv": "CLAUDE_CODE_OAUTH_TOKEN" },
+  //     "openai":    { "mode": "oauth", "tokenEnv": "CODEX_OAUTH_ACCESS_TOKEN" }
+  //   } }
   "auth": {
     "mode": "api-key",
     "provider": "openai",

package/templates/dismiss.yml

@@ -83,6 +83,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          # Dismiss never fetches; gh authenticates from GH_TOKEN. Keep the token
+          # out of .git/config.
+          persist-credentials: false
 
       - name: Set up Node
         if: steps.cmd.outputs.run == 'true'

package/templates/shared.md

@@ -63,6 +63,34 @@ firehose. When in doubt, stay silent.
 **For now, report only `critical` and `warning` findings. Do not emit
 `suggestion`-level items at all.**
 
+## Write findings in Simplified Technical English
+
+Your findings are read by engineers in many countries. Many of them do not speak
+English as a first language. Write every piece of prose you emit — `title`,
+`rationale`, `suggestion` — under the ASD-STE100 Simplified Technical English
+rules:
+
+- **One word, one meaning.** Choose one term for a thing and reuse it. Do not
+  alternate between synonyms for the same object ("the handler" / "the callback"
+  / "the hook").
+- **Short sentences.** Use 20 words or fewer. Split a long sentence into two.
+- **Active voice.** Write "the parser drops the flag", not "the flag is dropped
+  by the parser". Name the actor.
+- **Plain words.** Write "use", not "utilize"; "before", not "prior to";
+  "because", not "due to the fact that". Remove hedges ("arguably", "it seems
+  that") and intensifiers ("very", "extremely").
+- **One topic per paragraph.** Keep paragraphs short.
+- **No idiom, metaphor, or sarcasm.** State what happens.
+
+This rule is about prose only. `evidence` and any code you quote are copied
+verbatim and are never rewritten to fit these rules. Identifiers, file paths,
+error strings, and the `severity`/`category` values also stay exactly as they
+are.
+
+Simple language must not cost precision. Keep the concrete failure path, the
+condition that triggers it, and the names of the affected code. Short sentences
+are a way to say the same thing, not a way to say less.
+
 ## Output contract
 
 Return **only** a single fenced ```json code block, an object of this shape:

package/templates/workflow.yml

@@ -39,10 +39,21 @@ jobs:
     # A reviewer failure must never fail the PR's checks.
     continue-on-error: true
     steps:
+      # SECURITY: check out the PR's immutable BASE commit, never the PR head or
+      # merge ref. Everything security-sensitive on this runner (`ecr verify-config`'s
+      # sweep, and any ambient files) therefore comes from a commit that already
+      # merged. `ecr ci` additionally enforces this itself: it materializes the base
+      # commit via the GitHub API for configuration and the head commit (scrubbed of
+      # runtime config) for source reads, so this checkout is defense in depth, not
+      # the only line. persist-credentials off — the CLI's own git fetches
+      # authenticate through `gh` from GH_TOKEN, so the token never lands in
+      # .git/config.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event.pull_request.base.sha }}
           # Shallow is enough — the reviewer gets the diff from the API (`gh`).
           fetch-depth: 1
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -52,16 +63,17 @@ jobs:
           # to save an empty cache and error).
           package-manager-cache: false
 
-      # SECURITY: this workflow checks out the PR's code, including every
+      # SECURITY: the TRUSTED BASE checkout above includes every
       # .expo-code-review/config.jsonc + routing.jsonc, whose auth.tokenEnv names the
       # env var the CLI forwards as the model credential. The canonical guard ships
       # with the CLI: `ecr verify-config` sweeps every config (root + routing + all
       # scopes, referenced or not) with the engine's real JSONC parser and refuses
       # unless tokenEnv appears exactly once, in a ROOT-owned file, equal to the
-      # expected value (repo var ECR_EXPECTED_TOKEN_ENV) — so a PR can't repoint it at
-      # another runner secret, sneak in a JSON-escaped key, or stage an unreferenced
-      # scope config with its own auth. This is layer 2; layer 1 is the runtime
-      # ECR_EXPECTED_TOKEN_ENV lock in `ecr ci` itself, so guard/loader drift fails safe.
+      # expected value (repo var ECR_EXPECTED_TOKEN_ENV) — so a config change can't
+      # repoint it at another runner secret, sneak in a JSON-escaped key, or stage an
+      # unreferenced scope config with its own auth. This is layer 2; layer 1 is the
+      # runtime ECR_EXPECTED_TOKEN_ENV lock in `ecr ci` itself, so guard/loader drift
+      # fails safe.
       #
       # This step MUST run BEFORE `ecr ci` (before any PR code is built or loaded).
       # Only setup-node (runtime install) precedes it; running the PUBLISHED package