docs(readme): add /install-code-review setup and expand security review instructions#80
Merged
Merged
Conversation
Contributor
|
Droid finished @factory-nizar's task —— View job Droid review complete. PR #80 currently changes only README.md; all candidate inline comments targeted paths that are no longer in the PR diff, so no inline review comments were posted. |
…ew instructions Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
factory-nizar
force-pushed
the
docs/readme-security-install-code-review
branch
from
ae19391 to
c4be064
Compare
The /install-code-review installer generates workflows pinned to @main, so align the README examples for consistency. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
The section showed users the source-level REVIEW_DEPTH_PRESETS object and told them to edit src/utils/review-depth.ts -- but droid-action consumers can't change Factory-managed defaults from their workflow. The Review Depth table just above already shows the current shallow/deep defaults, and the YAML examples already show how to pin a specific model via review_model. Replace the section with a one-line note that the defaults are managed by Factory and may change, and that review_model is the way to pin a specific model in a workflow. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
…rsioned) The third YAML example used 'claude-sonnet-4-5-20250929' without explaining that review_model takes any model identifier supported by 'droid exec --model'. Add a sentence pointing to the CLI reference's available-models list and noting that both short forms (claude-sonnet-4-6) and versioned forms (claude-sonnet-4-5-20250929) work, with the difference being whether the ID floats with the latest minor or pins to a specific release. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Replace the versioned 'claude-sonnet-4-5-20250929' example with the short 'claude-sonnet-4-6' and drop the explainer about versioned IDs. Short forms are the recommended path -- they float with the latest minor and are easier to remember; versioned IDs are still valid but unnecessary noise here. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Replace the inline three-example list with a small table of common model IDs (Anthropic Opus/Sonnet/Haiku, OpenAI GPT-5.5/5.5-pro/5.3-codex, Kimi K2.6) each with a one-line note on when to pick it. Easier for users to skim than a sentence with parenthetical examples. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Just list the model IDs without descriptions -- the CLI reference is the canonical source for what each model is. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
This was referenced Apr 28, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the README to make security review and the guided installer easier to discover.
Changes
/install-code-reviewsection under Installation, describing the guided CLI flow and pointing at the Automated Code Review guide and GitHub App installation guide.droid-review.ymlsample now includesautomatic_security_review: trueso users get code review + security review concurrently out of the box.@droid securitydescription with STRIDE / OWASP coverage and a clearer note aboutautomatic_security_review.@droid security --fullwith a complete cron-triggered workflow example usingsecurity_scan_scheduleandsecurity_scan_days.No code changes — README only.