bssm-oss/CodeAgora Review

Multi-agent debate-driven code review for pull requests

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 17, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: bssm-oss/codeagora@87a8febb4d87d378c77a28a91b3cdf23bae0fea9 # v0.1.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
config-path	Path to .ca/config.json relative to repo root. CLI flag wins, then $CONFIG_PATH env, otherwise default used.	no	.ca/config.json
github-token	GitHub token for posting comments and the configured verdict reporter	yes	—
fail-on-reject	Exit with code 1 when verdict is REJECT (blocks merge via required check)	no	true
max-diff-lines	Skip review if diff exceeds this line count (0 = unlimited)	no	5000
post-results	Post review comments and the configured verdict reporter to GitHub	no	true
reporter-mode	GitHub verdict reporter to emit when posting is enabled. One of check-run or commit-status.	no	check-run
check-run-name	Name of the GitHub check run to create or update for the reviewed PR commit	no	CodeAgora Review
upload-sarif	Upload the generated SARIF file to GitHub Code Scanning. The SARIF file is also uploaded as a workflow artifact when Code Scanning upload is disabled or unavailable.	no	false

Outputs

name	description
verdict	Final verdict — ACCEPT, REJECT, NEEDS_HUMAN, DEGRADED, or SKIPPED. DEGRADED is returned if provider/runtime infrastructure prevents a review result. SKIPPED is returned if the skip label is present or the run cannot start because required credentials are missing.
review-url	URL of the posted GitHub review
session-id	CodeAgora session ID for audit trail
sarif-file	Validated path to the generated SARIF file, when SARIF output was written
degraded	Whether the action ran in degraded or skipped mode (true if SKIPPED or degraded). Disabled posting, missing credentials, diff limits, provider runtime failures, stale heads, config failures, and posting failures set this to true.
degraded-reason	Stable reason code for degraded or skipped mode. Values include missing-github-token, untrusted-github-context, missing-provider-secrets, untrusted-fork-pr, fork-missing-provider-secrets, posting-disabled, diff-too-large, config-load-failed, provider-runtime-failed, stale-head-sha, github-post-failed, and sarif-write-failed. Always set if degraded is true.
head-sha	Pull request head SHA reviewed by CodeAgora
base-sha	Pull request base SHA used for diff acquisition