robin AGENTS.md

An AGENTS.md guide for adding Robin, an automated pull-request workflow, to another GitHub repository.

In plain words
What is it for?
Configure Robin in GitHub Actions, choose a stable workflow release, provide an LLM API key and model settings, and respond to pull-request events and comments.
Why use it?
It records the supported workflow versions, required secrets, permissions, and unsafe configuration choices so the integration is less likely to fail or expose secrets.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/antongulin/robin/agents-md
Clone the repo
git clone --depth 1 https://github.com/antongulin/robin

Made for: Codex, OpenCode.

Per session 782 This file is loaded in full into every session.
When invoked 782 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00782 $0.00782
Opus 5 $0.00391 $0.00391
Sonnet 5 $0.00156 $0.00156
Haiku 4.5 $0.00078 $0.00078

Measured 2d ago against content hash d701ecf4e57e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

robin AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 104 lines

How it starts

The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Instructions for AI coding agents

Use this file when adding Robin to another repository.

Required workflow reference

Default (latest):

uses: antongulin/robin/.github/workflows/review.yml@main

Pinned release (preferred for stability):

uses: antongulin/robin/.github/workflows/review.yml@v2

For a direct action step: antongulin/robin@main or @v2.

Do not use

  • @v0, v0, or any v0 release tag — workflows fail or point at stale code.
  • pull_request_target — not supported; security risk with secrets.
  • synchronize on pull_request unless the user explicitly wants review on every push.

Required secrets (in the consumer repo)

Secret Purpose
LLM_API_KEY Provider API key
LLM_BASE_URL OpenAI-compatible base URL
LLM_MODEL Model id

Free OpenRouter example:

  • LLM_BASE_URL: https://openrouter.ai/api/v1
  • LLM_MODEL: openrouter/free

Minimal consumer workflow

Create .github/workflows/robin.yml:

name: Robin

on:
  pull_request:
    types: [opened, reopened, ready_for_review]
  issue_comment:
    types: [created]

permissions:
  actions: read
  contents: read
  pull-requests: write

jobs:
  review:
    uses: antongulin/robin/.github/workflows/review.yml@main
    secrets:
      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
      LLM_MODEL: ${{ secrets.LLM_MODEL }}

Permissions

The job needs:

permissions:
  actions: read
  contents: read
  pull-requests: write

actions/checkout is optional for review-only workflows.

Maintainers: release-notes upkeep (automatic)

Everything above is for adding Robin to a consumer repo. This section is for agents working in this repository: whenever a release lands (release-please auto-merges chore: release X.Y.Z and publishes the GitHub release), clean up its notes as part of the same task — do it automatically, without asking.

  1. Inspect every release cut during the session: gh release view <tag> --json body.
  2. Enrich each feat/fix entry with a one-line plain-language user impact, and credit external contributors (— thanks [@login](https://github.com/login)!).
  3. Catch orphaned commits: a commit that lands on main between the release PR's snapshot and its merge appears in no changelog. Compare git log <prev-tag>..<tag> --oneline against the notes and add missing entries under the matching section.
  4. Edit only the GitHub release (gh release edit <tag> --notes '…'). Never rewrite CHANGELOG.md retroactively — a changelog commit itself triggers another release.
  5. Keep the generated format (version heading with compare link, ### Features / ### Bug Fixes / ### Documentation sections). Never create tags or releases by hand, and never delete a published release.

Read the full file on GitHub · 104 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 104 lines · 782 tokens per session scan A d701ecf4e57e

Subscribe to this mod's changes

robin AGENTS.md is an instructions file published in the GitHub repository antongulin/robin (22 stars, last pushed 18d ago), licensed MIT. It adds 782 tokens to every session, about $0.0039 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.