factory-ai/Droid Exec Action v1.0
Flexible GitHub automation platform with Droid. Auto-detects mode based on event type: PR reviews, @droid mentions, or custom automation.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 29, 2026
- License
- None
Pinned Snippet
uses: factory-ai/droid-action@e3d1f5e7861c36fe4a9c4dca3edec87b964b2bc4 # v5tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| trigger_phrase | The trigger phrase to look for in comments or issue body | no | @droid |
| assignee_trigger | The assignee username that triggers the action (e.g. @droid) | no | — |
| label_trigger | The label that triggers the action (e.g. droid) | no | droid |
| allowed_bots | Comma-separated list of allowed bot usernames, or '*' to allow all bots. Empty string (default) allows no bots. | no | "" |
| allowed_non_write_users | Comma-separated list of usernames to allow without write permissions, or '*' to allow all users. Only works when github_token input is provided. WARNING: Use with extreme caution - this bypasses security checks and should only be used for workflows with very limited permissions (e.g., issue labeling). | no | "" |
| settings | Droid Exec settings as JSON string or path to settings JSON file | no | "" |
| factory_api_key | Factory API key (required for Droid Exec runtime) | yes | — |
| github_token | GitHub token with repo and pull request permissions (optional if using GitHub App) | no | — |
| droid_args | Additional arguments to pass directly to Droid CLI | no | "" |
| additional_permissions | Additional GitHub permissions to request (e.g., 'actions: read') | no | "" |
| use_sticky_comment | Use just one comment to deliver issue/PR comments | no | false |
| track_progress | Force tag mode with tracking comments for pull_request and issue events. Only applicable to pull_request (opened, synchronize, ready_for_review, reopened) and issue (opened, edited, labeled, assigned) events. | no | false |
| automatic_review | Automatically run the review flow for pull request contexts without requiring an explicit @droid review command. Only supported for PR-related events. | no | false |
| automatic_security_review | Automatically run the security review flow for pull request contexts without requiring an explicit @droid security command. Only supported for PR-related events. | no | false |
| security_model | Override the model used for security review (e.g., 'claude-sonnet-4-5-20250929', 'gpt-5.1-codex'). Only applies to security review flows. | no | "" |
| security_severity_threshold | Minimum severity to report in security reviews (critical, high, medium, low). Findings below this threshold will be filtered out. | no | medium |
| security_block_on_critical | Submit REQUEST_CHANGES review when critical severity findings are detected. | no | true |
| security_block_on_high | Submit REQUEST_CHANGES review when high severity findings are detected. | no | false |
| security_notify_team | GitHub team to @mention on critical findings (e.g., '@org/security-team'). | no | "" |
| security_scan_schedule | Enable scheduled security scans. Set to 'true' for schedule events to trigger full repository scans. | no | false |
| security_scan_days | Number of days of commits to scan for scheduled security scans. Only applies when security_scan_schedule is enabled. | no | 7 |
| review_depth | Review depth preset: 'shallow' (fast, uses kimi-k2.6) or 'deep' (thorough, uses gpt-5.2 with high reasoning). Defaults to deep. Setting review_model or reasoning_effort explicitly overrides the preset values. | no | deep |
| review_model | Override the model used for code review (e.g., 'claude-sonnet-4-5-20250929', 'gpt-5.1-codex'). If empty, the model is determined by review_depth. | no | "" |
| reasoning_effort | Override reasoning effort for review flows (passed to Droid Exec as --reasoning-effort). If empty, determined by review_depth (shallow=default, deep=high). | no | "" |
| include_suggestions | Include code suggestion blocks in review comments when the fix is high-confidence. Set to 'false' to disable suggestions. | no | true |
| review_candidates_path | Path to write review candidates JSON (pass 1 of the two-pass review). | no | ${{ runner.temp }}/droid-prompts/review_candidates.json |
| review_validated_path | Path to write review validated JSON (pass 2 of the two-pass review). | no | ${{ runner.temp }}/droid-prompts/review_validated.json |
| fill_model | Override the model used for PR description fill (e.g., 'claude-sonnet-4-5-20250929', 'gpt-5.1-codex'). Only applies to fill flows. | no | "" |
| experimental_allowed_domains | Restrict network access to these domains only (newline-separated). If not set, no restrictions are applied. Provider domains are auto-detected. | no | "" |
| path_to_droid_executable | Optional path to a custom Droid CLI executable. If provided, skips automatic installation and uses this executable instead. WARNING: Using an older version may cause problems if the action begins taking advantage of new Droid Exec features. This input is typically not needed unless you're debugging something specific or have unique needs in your environment. | no | "" |
| path_to_bun_executable | Optional path to a custom Bun executable. If provided, skips automatic Bun installation and uses this executable instead. WARNING: Using an incompatible version may cause problems if the action requires specific Bun features. This input is typically not needed unless you're debugging something specific or have unique needs in your environment. | no | "" |
| show_full_output | Show full JSON output from Droid Exec. WARNING: This outputs ALL Droid messages including tool execution results which may contain secrets, API keys, or other sensitive information. These logs are publicly visible in GitHub Actions. Only enable for debugging in non-sensitive environments. | no | false |
Outputs
| name | description |
|---|---|
| github_token | The GitHub token used by the action (Droid App token if available) |