continuum-ai-corp/Orca-Code-Review

AI PR review via the OrcaRouter gateway — cost-tiered cascade with a severity merge gate.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 7, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: continuum-ai-corp/orca-code-review@bc283169758b51174346958cda9def0fa69bdafa # v1.0.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
orcarouter-api-key	OrcaRouter API key.	yes	—
orcarouter-url	OrcaRouter chat-completions endpoint.	no	https://api.orcarouter.ai/v1/chat/completions
github-token	Token used to fetch the PR head, post review comments, and manage the tier label.	no	${{ github.token }}
brand	Name shown on PR comments.	no	Orca-Code-Review
router	OrcaRouter router alias (orcarouter/<name>) that owns model selection. The action names no models: it injects the cascade's raw facts (x-cr-prev-tier / x-cr-prev-p0p1) as headers and this router's DSL recipe maps them to the cheap/strong model. See recipes/code-review.dsl.yaml.	no	orcarouter/code-review
fix-first	Severities that withhold the strong tier until fixed at the cheap tier.	no	P0,P1
block-on	Severities that fail the check (block the merge).	no	P0,P1
auto-review-authors	Comma-separated GitHub author-association allowlist for AUTOMATIC reviews (pull_request events). Empty = review everyone (default). On a PUBLIC repo, pull_request_target bypasses GitHub's fork-approval gate and the review key is wallet-metered, so an external user can trigger paid cascades by opening PRs — set e.g. "OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR" to auto-review only known contributors (others can still be reviewed on demand via /orca-code-review). Also set a wallet budget + alert on the key. Case-insensitive; values: OWNER, MEMBER, COLLABORATOR, CONTRIBUTOR, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER, MANNEQUIN, NONE.	no	""
max-diff-kb	Skip the review when the PR's merge-base diff is bigger than this many KB. A skip posts a notice without running the engine; whether the check then fails or passes is `on-oversized-diff` (default: fail, so the merge gate cannot be padded around).	no	512
max-diff-files	Skip the review when the diff touches more than this many files (same notice + on-oversized-diff outcome as max-diff-kb).	no	300
on-oversized-diff	What an oversized-diff skip does to the check. "fail" (default) fails it — a diff padded past max-diff-kb / max-diff-files can then never bypass a required merge gate. "pass" restores the advisory behavior: the skip notice posts and the check stays green.	no	fail
settings	Fetch per-repo review settings from the OrcaRouter dashboard at the start of each run. Set "false" to skip the fetch entirely and make this workflow file authoritative: inputs (or their documented defaults) apply as-is and no dashboard value can override them.	no	true
report	Send a best-effort per-tier run summary (repo, PR number, head SHA, tier, P0/P1/P2 counts, gate result, engine version — never code or finding text) to the OrcaRouter control plane. Set "false" to disable.	no	true
engine-version	Pinned @alibaba-group/open-code-review version (the review engine). Bump deliberately after testing — the later steps parse its JSON output shape.	no	1.3.13
timeout-minutes	Wall-clock ceiling (in minutes) for ONE engine review pass. If the engine hasn't produced a result within this window it is killed and the run fails closed with a distinct "wall-clock timeout" error (separate from "no usable result", so the log makes clear which mode failed). Accepts decimals (e.g. "0.5" = 30 seconds) for testing. Default 20 covers most PRs on shipped models; bump for very large diffs or slow-per-call models where per-file review takes longer.	no	20
precision-filter	Post-processing between the engine and the merge gate. When `"true"` (default), a deterministic filter (L1) verifies each finding's `existing_code` snippet against the reviewed commit and re-homes or drops findings whose snippet does not match the claimed path; then an LLM judge (L2) clusters findings by root cause and drops low-confidence ones. Set to `"false"` to post the engine's raw findings directly. Both layers are soft-fail — errors keep the prior stage's findings and never abort the review.	no	true
judge-model	Model used by the L2 judge stage. Should differ from the reviewer model so the judge acts as an independent second opinion. Ignored when `precision-filter` is `"false"`.	no	deepseek/deepseek-v4-pro
judge-threshold	Keep-threshold for the L2 judge's per-cluster confidence score (0–1). Findings with confidence below this are dropped. Lower to keep more; raise to be stricter.	no	0.5

Outputs

no outputs