driches/Vor

Vor — AI code review + parallel vulnerability scanning for GitHub PRs. Inline comments via Claude or OpenAI.

Trust Signals

name	description	required	default
anthropic_api_key	Anthropic API key. Required when using a Claude model (the default). Optional for OpenAI-only setups.	no	—
openai_api_key	OpenAI API key. Required when using a GPT or o-series model.	no	—
provider	LLM provider override (anthropic \| openai). Inferred from `model` when omitted.	no	—
github_token	GitHub token with pull-requests:write. Defaults to the workflow token.	yes	${{ github.token }}
model	Model ID — Claude (claude-sonnet-4-6, claude-haiku-4-5, claude-opus-4-7) or OpenAI (gpt-4.1, gpt-4o-mini, o4-mini, …). Default claude-sonnet-4-6.	no	claude-sonnet-4-6
max_turns	Maximum agent turns per review. Larger PRs may need more.	no	40
config_path	Path to .vor.yml in the consumer repo.	no	.vor.yml
dry_run	If true, log the review instead of posting it.	no	false
pr_number	PR number. Auto-detected from pull_request events; required for manual triggers.	no	—
allow_auto_trigger	By default this action runs automatically on pull_request events. Set to "false" to opt out and restrict runs to manual workflow_dispatch triggers only. Note: pull_request_target, pull_request_review, and pull_request_review_comment events are never auto-triggered regardless of this setting — pull_request_target carries fork-secret risk, and review events produce iteration loops.	no	true

name	description
review_id	GitHub review ID that was created.
comment_count	Number of inline comments posted.
ended	How the review ended (summary_posted \| max_turns \| output_truncated \| budget_exceeded \| aborted \| error \| skipped_draft \| skipped_no_key_anthropic \| skipped_no_key_openai).
cost_usd	Total API cost in USD.