clouatre-labs/Aptu
GitHub automation: AI issue triage, AI PR review, PR labeling, security scanning, and PR queue ranking
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 6, 2026
- License
- Apache 2.0
Pinned Snippet
uses: clouatre-labs/aptu@b4dccd510d229fbbcddb149dc9b643cda4b6d70f # v0.10.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token for API access | yes | — |
| anthropic-api-key | Anthropic API key (from https://console.anthropic.com/settings/keys) | no | — |
| cerebras-api-key | Cerebras API key (from https://console.cerebras.ai/keys) | no | — |
| gemini-api-key | Google Gemini API key (from https://aistudio.google.com/apikey) | no | — |
| groq-api-key | Groq API key (from https://console.groq.com/keys) | no | — |
| openrouter-api-key | OpenRouter API key (from https://openrouter.ai/keys) | no | — |
| zai-api-key | Z.AI API key (from https://z.ai) | no | — |
| zenmux-api-key | ZenMux API key (from https://zenmux.ai) | no | — |
| provider | AI provider to use (anthropic, cerebras, gemini, groq, openrouter, zai, zenmux). Defaults to openrouter when not set. | no | "" |
| model | Model identifier for the selected provider. Defaults to mistralai/mistral-small-2603 when provider is openrouter, or gemini-3.1-flash-lite when provider is gemini. See docs/CONFIGURATION.md for per-provider model lists. | no | "" |
| fallback-provider | AI provider to try when the primary provider fails (resilience chain). Independent of the primary provider default; set to empty string to disable fallback. | no | openrouter |
| fallback-model | Model for the fallback provider. | no | inception/mercury-2 |
| apply-labels | Apply AI-suggested labels and milestone (issue triage and PR review) | no | true |
| dry-run | Run without making changes | no | false |
| no-comment | Skip posting comment to GitHub (issue triage and PR review) | no | false |
| skip-labeled | Skip triage if the issue already has both a label with the `type:` prefix and a label matching `p[0-9]` (e.g. `p0`, `p1`, `p2`, `p3`). Only meaningful for issue events; set to `false` for PR events. | no | true |
| repo | Target repository (owner/repo) for repository_dispatch invocations. When set alongside pull-number or issue-number, the PR label, PR review, and issue triage steps fire on repository_dispatch events. | no | "" |
| pull-number | PR number for repository_dispatch invocations. Must be set alongside repo to trigger PR label and PR review steps on repository_dispatch events. | no | "" |
| issue-number | Issue number for repository_dispatch invocations. Must be set alongside repo to trigger the issue triage step on repository_dispatch events. | no | "" |
| since | For scheduled batch triage: triage all issues without labels created since this date (YYYY-MM-DD or RFC3339). If empty, all unlabeled issues in the repository are triaged. Only used when the workflow is triggered by a schedule event. | no | "" |
| issue-state | For scheduled batch triage: filter issues by state (open, closed, all). Only used when the workflow is triggered by a schedule event. | no | open |
| instructions-file | Path to repository instructions file for PR review context. When set, overrides the default AGENTS.md and .github/instructions/pr-review.md files. Leave empty to use default file discovery. | no | — |
| repo-path | Path to the local repository root for AST context injection into PR review prompts. When set (or inferred from the current working directory when omitted), `aptu pr review` will analyse changed source files (Rust, Python, Go, Java, TypeScript, TSX, JavaScript, C, C++, C#, Fortran) and append function signatures and call-graph context to the prompt. Set to an explicit path to override CWD inference. | no | "" |
| deep | Force cross-file call graph context in PR review unconditionally. When omitted, call graph is auto-enabled when budget_remaining (= max_prompt_chars minus the pre-call-graph prompt size estimate) exceeds min-budget-for-call-graph. Set to 'true' to always include call graph regardless of available budget. | no | false |
| max-prompt-chars | Total prompt character budget for PR review. When the assembled prompt exceeds this limit, sections are dropped in order: call graph, AST, full file content, diff hunks. System prompt and PR metadata are never dropped. Maps to [review] max_prompt_chars in config.toml. | no | 120000 |
| max-full-content-files | Maximum number of files fetched in full via the GitHub Contents API per review. Maps to [review] max_full_content_files in config.toml. | no | 10 |
| max-chars-per-file | Maximum characters of full file content included per file in the review prompt. Maps to [review] max_chars_per_file in config.toml. | no | 16000 |
| max-diff-chars | Maximum total diff characters across all files in the review prompt. Diffs exceeding this limit are dropped from the prompt before assembly. Maps to [review] max_diff_chars in config.toml. | no | 200000 |
| max-patch-chars-per-file | Maximum characters for an individual file patch in the review prompt. File patches exceeding this limit are dropped entirely rather than sliced mid-hunk. Maps to [review] max_patch_chars_per_file in config.toml. | no | 10000 |
| max-instructions-chars | Maximum characters of instructions file content included in the review prompt. Maps to [review] max_instructions_chars in config.toml. | no | 1500 |
| min-budget-for-call-graph | Minimum remaining prompt budget (chars) to auto-enable call-graph enrichment. budget_remaining = max-prompt-chars minus the pre-call-graph prompt size estimate; call graph is built only when budget_remaining > this value (strict greater-than). Setting this above half of max-prompt-chars means call graph rarely fires; setting it >= max-prompt-chars disables auto-enable entirely (use deep: true instead). Set to 0 to always include call graph when repo-path is available. Maps to [review] min_budget_for_call_graph in config.toml. | no | 20000 |
| max-dep-packages | Maximum number of dependency bump packages for which upstream release notes are fetched and included in the review prompt. Maps to [review] max_dep_packages in config.toml. | no | 3 |
| max-dep-release-chars | Maximum characters of upstream release notes included per dependency package. Maps to [review] max_dep_release_chars in config.toml. | no | 2000 |
| max-diff-bytes | Maximum bytes for the raw PR diff; prompt-injection defence pre-check applied before prompt assembly. Raise for large refactor PRs. Maps to [prompt] max_diff_bytes in config.toml. | no | 524288 |
| scan-path | Path to scan for security issues with aptu scan-security. Leave empty to skip the security scan step. | no | "" |
| scan-security-diff | Path to a unified diff file to scan for security issues (overrides scan-path when set). Leave empty to use scan-path directory scan. | no | "" |
| pr-queue | Run aptu pr queue to output a ranked reviewability list of open PRs. Useful for workflow_dispatch or scheduled summary workflows. | no | false |
| command | Command to run (issue or pr) | no | issue |
| subcommand | Subcommand to run (triage for issue, label or review for pr) | no | triage |
Outputs
| name | description |
|---|---|
| input-tokens | Total input tokens consumed across all AI calls in this run |
| output-tokens | Total output tokens consumed across all AI calls in this run |
| duration-ms | Total AI call duration in milliseconds |
| cost-usd | Estimated total cost in USD (provider-dependent, may be empty) |
| effective-token-units | Effective Token Units (normalized throughput signal) |
| cache-hit-ratio | Cache hit ratio as integer percent (cache_read / (input + cache_read)), or n/a |