| provider | LLM provider to use. Options: gateway (default — route via mcp-llm-bridge), cli-bridge (local CLI tools: Claude Code, OpenCode, Copilot), ollama (local). Legacy values (github, anthropic, openai, google, etc.) are automatically remapped to "gateway" for backward compatibility. | no | gateway |
| model | LLM model identifier. For gateway/cli-bridge, use "auto" to let the provider select the best available model. | no | — |
| mode | Review mode. "simple" = single LLM call, "workflow" = 5 specialist agents, "consensus" = for/against/neutral voting. | no | simple |
| api-key | LLM provider credential. For gateway: bearer token. For cli-bridge: tool API key (optional). For ollama: not required. | no | — |
| github-token | GitHub token for fetching PR diffs and posting comments. Defaults to the automatic GITHUB_TOKEN. | no | ${{ github.token }} |
| enabled-tools | Comma-separated list of tool names to force-enable (overrides auto-detect). Example: "ruff,clippy,bandit". See README for the full list of 16 tools. | no | "" |
| disabled-tools | Comma-separated list of tool names to force-disable (overrides always-on and auto-detect). Example: "gitleaks,cpd". See README for the full list of 16 tools. | no | "" |
| enable-semgrep | [DEPRECATED — use disabled-tools instead] Enable Semgrep security analysis. Runs directly on the runner. First run installs via pip (~2 min), subsequent runs use cache (~10s). | no | true |
| enable-trivy | [DEPRECATED — use disabled-tools instead] Enable Trivy vulnerability scanning. Runs directly on the runner. First run installs via official script (~1 min), subsequent runs use cache (~5s). | no | true |
| enable-cpd | [DEPRECATED — use disabled-tools instead] Enable PMD/CPD copy-paste detection. Runs directly on the runner. First run downloads PMD (~1 min), subsequent runs use cache (~5s). | no | true |
| enable-memory | Enable review memory. Caches observations between runs via @actions/cache. Set to 'false' to disable. | no | true |
| embedding-provider | Optional semantic-search embedding provider for review memory. Options: none (default — keyword-only), openai-compatible (any /v1/embeddings-compatible HTTP API: OpenAI, Voyage-compatible endpoints, self-hosted servers). "local" is NOT available in the Action (no bundled model) and is coerced to "none" with a warning. | no | none |
| embedding-model | Embedding model identifier for embedding-provider "openai-compatible" (e.g. "text-embedding-3-small"). | no | — |
| embedding-base-url | Base URL for the embedding-provider "openai-compatible" HTTP API (e.g. "https://api.openai.com/v1"). | no | — |
| embedding-api-key | API key/bearer token for the embedding-provider "openai-compatible" HTTP API. Omit for unauthenticated self-hosted endpoints. | no | — |
| embedding-dimension | Expected vector dimension for embedding-provider "openai-compatible" (e.g. "1536" for text-embedding-3-small). | no | — |
| embedding-candidate-k | Bounded cosine candidate set size for semantic memory search. Defaults to 200. | no | — |