flowcore-io/Usable PR Validator
Validate Pull Requests against your Usable knowledge base standards using AI (OpenCode with OpenRouter, Anthropic, OpenAI, or Google Gemini) and Usable MCP integration
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 10, 2026
- License
- MIT
Pinned Snippet
uses: flowcore-io/usable-pr-validator@48bbaaff5573f5166adc1bba82a846bfc6699a07 # v2.2.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| prompt-file | Path to validation prompt markdown file (optional if use-dynamic-prompts is enabled) | no | "" |
| use-dynamic-prompts | Fetch latest prompt from Usable API instead of using static prompt file | no | false |
| prompt-fragment-id | Usable fragment UUID to use as prompt (required when use-dynamic-prompts is true) | no | "" |
| merge-custom-prompt | Merge fetched Usable prompt with custom prompt-file (only when both are provided) | no | true |
| override-comment | User comment requesting validation override or clarification (typically from @usable mention) | no | "" |
| gemini-model | Gemini model to use (gemini-2.5-flash, gemini-2.0-flash, gemini-2.5-pro) | no | gemini-2.5-flash |
| service-account-key-secret | Name of secret containing base64-encoded Gemini service account key | no | GEMINI_SERVICE_ACCOUNT_KEY |
| mcp-server-url | HTTP URL of MCP server | no | https://usable.dev/api/mcp |
| mcp-token-secret | Name of secret containing Usable API token | no | USABLE_API_TOKEN |
| workspace-id | Usable workspace UUID (required - used to fetch MCP system prompt) | yes | — |
| fail-on-critical | Fail build when critical violations are found | no | true |
| comment-mode | PR comment behavior: update, new, or none | no | update |
| comment-title | Title for PR comment (used to identify which comment to update in multi-stage validations) | no | Automated Standards Validation |
| artifact-retention-days | Days to retain validation report artifacts | no | 30 |
| max-retries | Maximum retry attempts for API failures | no | 2 |
| timeout-minutes | Maximum validation execution time in minutes | no | 15 |
| base-ref | Base reference for diff comparison (defaults to PR base branch). Useful for release-please branches to compare against last release tag. | no | "" |
| head-ref | Head reference for diff comparison (defaults to PR head branch) | no | "" |
| allow-web-fetch | Allow AI to use web_fetch tool for external resources (security consideration) | no | false |
| provider | AI provider to use (opencode or gemini) | no | opencode |
| opencode-provider | AI provider for OpenCode (e.g., openrouter, anthropic, openai) | no | openrouter |
| opencode-model | Model ID for OpenCode (e.g., moonshotai/kimi-k2.5 for openrouter, claude-sonnet-4-5 for anthropic) | no | moonshotai/kimi-k2.5 |
| opencode-api-key-secret | Name of secret containing the API key for the configured opencode-provider | no | OPENCODE_API_KEY |
| fallback-opencode-provider | Optional opencode-provider to fall back to when primary exhausts retries on retryable errors (e.g. 429/503/504/timeout). Empty disables fallback. | no | "" |
| fallback-opencode-model | Model ID for the fallback opencode-provider (required when fallback-opencode-provider is set) | no | "" |
| fallback-opencode-api-key-secret | Name of secret holding the fallback API key. Optional when fallback-opencode-provider equals opencode-provider (primary key is reused). Required when providers differ. | no | "" |
Outputs
| name | description |
|---|---|
| validation-status | Validation result: passed or failed |
| validation-passed | Boolean indicating if validation passed (true/false) |
| critical-issues | Count of critical violations found |
| report-artifact-name | Name of artifact containing validation report |