Add OpenHands as PR Reviewer to trigger the pr-review-by-openhands workflow

[simonrosenberg]

Currently, adding label "review-this" to a PR triggers the PR review workflow located at .github/workflows/pr-review-by-openhands.yml.
It would be great to have a more intuitive trigger for this workflow: adding OpenHands or OpenHands-agent as a reviewer to the PR.
The goal is to determine if this is feasible and safe: an average open-source contributor should not be able to trigger an AI PR review.

[openhands-ai]

I'm on it! simonrosenberg can track my progress at all-hands.dev

[openhands-ai]

Summary

I've successfully implemented the feature requested in issue #1036 to add reviewer-based triggering for the PR review workflow.

✅ Changes Made

1. Updated Production Workflow (.github/workflows/pr-review-by-openhands.yml)

• Added review_requested to event types alongside labeled
• Modified job condition to check for reviewer username (OpenHands or OpenHands-agent) in addition to the review-this label
• Enhanced security documentation explaining both trigger methods

2. Updated Example Workflow (examples/03_github_workflows/02_pr_review/workflow.yml)

• Applied the same changes to the example template for consistency

3. Updated Documentation (examples/03_github_workflows/02_pr_review/README.md)

• Added instructions for both trigger methods (label and reviewer)
• Marked reviewer method as "Recommended"
• Explained security considerations for both approaches

🔒 Security Verification

Both trigger methods are equally secure:

• ✅ Adding labels requires write access to the repository
• ✅ Requesting reviewers also requires write access to the repository
• ✅ Uses pull_request_target to run in base repository context (not fork)
• ✅ Only authorized users (maintainers/collaborators) can trigger the workflow

📝 Pull Request Created

PR #1037: #1037

• Created as a draft PR for review
• Includes comprehensive description with security analysis
• All pre-commit hooks passed
• YAML syntax validated
• Closes Add OpenHands as PR Reviewer to trigger the pr-review-by-openhands workflow #1036

🎯 How to Use

Users can now trigger the PR review workflow in two ways:

1. Label-based (existing): Add the review-this label to a PR
2. Reviewer-based (new): Request OpenHands or OpenHands-agent as a reviewer ⭐ Recommended

The implementation maintains full backward compatibility while providing a more intuitive trigger method as requested.

_{View full conversation}