Skip to content

chore(deps): bump Factory-AI/droid-action from 4 to 5#967

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/Factory-AI/droid-action-5
Open

chore(deps): bump Factory-AI/droid-action from 4 to 5#967
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/github_actions/Factory-AI/droid-action-5

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 16, 2026

Bumps Factory-AI/droid-action from 4 to 5.

Release notes

Sourced from Factory-AI/droid-action's releases.

v5

What's Changed

Review Depth Presets

  • New review_depth input with shallow and deep presets (#66)
    • deep (default): uses gpt-5.2 with high reasoning effort for thorough reviews
    • shallow: uses kimi-k2-0711 for fast, cost-effective reviews
    • Explicit review_model/reasoning_effort still override depth presets

Security Review Overhaul

  • Security review as a skill running concurrently with code review (#71)
  • Use CLI builtin security-review skill instead of manual prompt construction, matching the same pattern as code review (#71)
  • STRIDE-based threat modeling — automatically generates a STRIDE threat model when .factory/threat-model.md is missing (#69)

Suggestion Blocks

  • Configurable suggestion blocks via new include_suggestions input parameter (#52)
  • Add suggestion block guidance, allow insert-only suggestions, and keep anchors consistent across phases

Custom Review Guidelines

  • Support custom review guidelines via review-guidelines skill (#49)
  • Add size cap and truncation for review guidelines (#50)

Batched Review Comments

  • Batch all review comments into a single submit_review call instead of posting individually, reducing API noise and improving atomicity (#58)

Consolidated Review Summary

  • Consolidate review summary into a tracking comment instead of a separate PR review body (#55)

Review Skill Overhaul

  • Use CLI builtin review skill instead of fetching methodology from GitHub, making templates thin wrappers that delegate structure to the review skill (#60, #64)
  • Move review guidelines from prompt injection to skill invocation for cleaner separation of concerns
  • Always use two-pass validator — removed single-pass review flow entirely (#59)

New Inputs

  • review_depth — choose between shallow and deep review presets
  • include_suggestions — control whether suggestion blocks are included in review comments

Bug Fixes & Improvements

  • Fix: create prompt file when both automatic_review and automatic_security_review are set (#70)
  • Fix: bump internal CI workflow from @v3 to @dev (#74)
  • Forward review_model and reasoning_effort to validator step (#42)
  • Pin upload-artifact to v4.6.2 SHA (#43)
  • Strict deduplication rules in validator prompt
  • Remove redundant anchor rejection rule from validator

Full Changelog: Factory-AI/droid-action@v4...v5

Commits
  • e3d1f5e chore: remove file-group-reviewer droid, update version refs to v5 (#76)
  • 7bc4e86 fix: bump internal CI workflow from @​v3 to @​dev (#74)
  • b4ee522 feat: move security review to skill + run concurrently with code review (#71)
  • 7f00497 Merge pull request #70 from Factory-AI/fix/prompt-file-missing-dual-review-flags
  • 2f46a47 fix: create prompt file when both automatic review flags are set
  • 158d137 Merge pull request #69 from Factory-AI/ssharma/security-review-plugin-3
  • 8b8549c STRIDE enforcement
  • 5f05d53 Merge pull request #68 from Factory-AI/ssharma/security-review-plugin-2
  • ec416a7 security review plugins
  • 1e23fcf Merge pull request #67 from Factory-AI/ssharma/security-review-plugin
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [Factory-AI/droid-action](https://github.com/factory-ai/droid-action) from 4 to 5.
- [Release notes](https://github.com/factory-ai/droid-action/releases)
- [Commits](Factory-AI/droid-action@v4...v5)

---
updated-dependencies:
- dependency-name: Factory-AI/droid-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 16, 2026
@factory-droid
Copy link
Copy Markdown
Contributor

factory-droid bot commented Apr 16, 2026

Droid encountered an error —— View job


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants