jander99/AI Review

AI-powered repository reviews. Selects between the OpenCode CLI (`tool: opencode`, default) and the Claude Code CLI (`tool: claude`) at the action boundary; the rest of the pipeline is shared. The chosen runtime CLI must be installed before this action runs. This action requires `pull-requests: write` for pull_request events and `checks: write` for non-PR events (push, workflow_dispatch).

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
tool	Review runtime CLI. `opencode` (default) invokes the OpenCode CLI; `claude` invokes the Claude Code CLI. The `model` input must be in `provider/model` format; for `claude`, the provider portion is stripped before being passed as `--model`.	no	opencode
opencode-version	OpenCode version expected to already be installed on PATH. Only consulted when `tool: opencode`.	no	1.18.4
claude-version	Expected Claude Code CLI version. Only consulted when `tool: claude`. When empty, the action only verifies the `claude` binary is on PATH without pinning a specific version.	no	""
debug	Capture redacted, gzipped CLI stdout and stderr as an artifact.	no	false
github-token	GITHUB_TOKEN or fine-grained PAT for posting results (falls back to github.token when omitted). Install the chosen runtime CLI as a separate workflow step before this action. Requires `pull-requests: write` for pull_request events and `checks: write` for non-PR events.	no	—
model	Model in `provider/model` format. For `tool: opencode`, the full string is passed to OpenCode as `--model`. For `tool: claude`, the provider portion is stripped (e.g., `anthropic/claude-sonnet-4.6` becomes `claude-sonnet-4.6`).	no	anthropic/claude-sonnet-4.6
models	Comma-separated models; overrides `model` when set. The same `provider/model` formatting rules apply per `tool`.	no	""
prompts	Comma-separated prompt sources using file: or text: prefixes.	yes	—
opencode-config	Path to a user-provided OpenCode config. Only consulted when `tool: opencode`; ignored for `tool: claude`.	no	—
permission	JSON object defining OpenCode tool permissions. Only consulted when `tool: opencode`; ignored for `tool: claude` (Claude Code uses hardcoded `--allowedTools`).	no	—
timeout-minutes	Timeout for each CLI invocation.	no	30
fail-on-error	Exit non-zero when any review fails.	no	false
post-comment	Post the review as a PR comment (pull_request events only). Set to false to only expose outputs without commenting.	no	true
post-check-run	Post the review as a check run (non-PR events only). Set to false to only expose outputs without publishing.	no	true
max-comment-chars	Truncate the PR comment at this many characters. GitHub hard-limits comments to 65536 characters.	no	65000
check-name	Name of the check run created on non-PR events.	no	ai-review
check-conclusion	Conclusion of the check run created on non-PR events. One of: action_required, cancelled, failure, neutral, success, skipped, stale, timed_out. Default neutral. Future iterations may derive this from the review severity (deferred).	no	neutral
check-details-url	URL linked from the check run details on non-PR events.	no	https://github.com

Outputs

name	description
review	Canonical review document. When a single review invocation produces a valid document, that document is returned. When multiple invocations succeed, the documents are deterministically merged into one canonical document. Empty when no invocation produced a valid document, or when valid invocations merged past the contract maximum (see `failure-reason`).
comment-url	URL of the posted PR comment (pull_request events). Empty when post-comment is false, when permissions were insufficient, on non-PR events, or when the normal post was skipped in favour of the error post. The error publication path also exposes `comment-url`; this output mirrors whichever one fired.
check-run-url	URL of the created check run (push, workflow_dispatch, and other non-pull_request events). Empty on pull_request events, when post-check-run is false, or when the normal check run was skipped in favour of the error check run. The error publication path also exposes `check-run-url`; this output mirrors whichever one fired.
models-used	Comma-separated list of models that completed successfully.
effective-model	The effective first model (provider/model format) selected from the inputs.model or inputs.models list.
cost	Reviewer-only cost in USD. The validator cost is reported separately under `validate-cost`; the sum is exposed as `total-cost`.
validate-cost	Validator cost in USD.
total-cost	Reviewer + validator cost in USD.
cost-by-model	JSON object containing cost by model (reviewer only).
tokens	JSON object containing total input and output tokens (reviewer only).
validate-tokens	JSON object with input/output tokens for the validator call.
tokens-by-model	JSON object containing token usage by model (reviewer only).
debug-artifact-path	Directory containing redacted, gzipped debug output when debug is enabled.
validate-status	Status from the structural validator: "valid" or "invalid". Empty when validation was skipped.
validate-reason	Human-readable reason when the validator rejects the review. Empty when validation was skipped (e.g. all review invocations failed before producing a document); see `failure-reason` for the canonical fallback message covering both reviewer and validator failures.
failure-reason	Canonical failure message (empty on success). Covers BOTH reviewer failures (reviewer could not produce a valid document) AND validator failures (reviewer succeeded but the document failed structural + model validation). When both fail, the reviewer message wins because the validator typically was skipped.
review-output-path	Runner-local path to the authoritative review markdown file written by the action from a validated model response.
config-json	OpenCode config JSON for the validator invocation (no agent review prompts, no path leakage, no user-supplied secrets).