josiahsiegel/UmActually PR Review
Provider-agnostic PR review action. Runs in dry-run mode by default and emits ::set-output lines for the GitHub Actions runner. Inputs are parsed strictly as strings; the entrypoint (dist/index.js) reads INPUT_* env vars to drive either the GitHub or Azure DevOps review contract.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- MIT
Pinned Snippet
uses: josiahsiegel/umactually@44aca921eecc8642891d134a1370a1a1b0713f1b # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github_token | GitHub token used to read the workflow event payload and post the review. | no | "" |
| diff | Path to the PR diff file. When unset, the action falls back to a 3-line placeholder diff which the model correctly rejects as 'no pull request diff was provided'. Workflows should always pass this input pointing at the actual PR diff. | no | "" |
| api-key | Provider API key for the review request. | no | "" |
| api-url | Provider base URL. Interpretation depends on `--provider`: for `openai-compatible`, the action tries the URL as-pasted (e.g. https://gateway.example.com/openai) and falls back to origin+`/v1` if both `/responses` and `/chat/completions` 404 there. For `anthropic`, the URL is treated as a path prefix per the `@anthropic-ai/sdk` convention (https://api.minimax.io/anthropic resolves to https://api.minimax.io/anthropic/v1/messages). Required for `openai-compatible`; optional for `anthropic` (defaults to https://api.anthropic.com/v1); ignored for `copilot` (which uses `github-api-base` for token exchange). On dual-protocol gateways (e.g. MiniMax) the dispatcher auto-discovers which protocol the URL serves — see docs/providers.md. | no | "" |
| model | Provider model id. "auto" lets the retry ladder pick. | no | auto |
| prompt | Inline system prompt override. Wins over prompt-file when both are set. | no | "" |
| prompt-file | Repository-relative prompt file. | no | "" |
| additional-prompt | Inline additional prompt override. Wins over additional-prompt-file when both are set. | no | "" |
| additional-prompt-file | Repository-relative additional prompt file. | no | "" |
| effort | Reasoning effort hint (low|medium|high). Currently forwarded as reasoning.effort to providers that support it; medium is the default. | no | medium |
| provider | Provider family. Default `openai-compatible` (OpenAI Chat Completions / Responses API over any OpenAI-protocol gateway). Set to `copilot` to use GitHub Copilot (requires a GitHub PAT as `UMACTUALLY_API_KEY` and `UMACTUALLY_GITHUB_API_BASE` for Enterprise Server). Set to `anthropic` to use the native Anthropic Messages API (`POST /v1/messages` with `x-api-key`/`anthropic-version` headers) — useful when running against an Anthropic API key without an OpenAI proxy in front. The Anthropic provider defaults to `https://api.anthropic.com/v1`; override via `api-url` for a self-hosted Anthropic-protocol gateway. On dual-protocol gateways (e.g. MiniMax serves Anthropic-protocol at `/anthropic/v1/messages` and OpenAI-protocol at `/v1/responses` under the same hostname with the same API key), `--provider` is advisory: the dispatcher transparently retries the OTHER protocol at the same URL when the named protocol returns a routing-level rejection (404). Payload-level 400s do NOT trigger fallback (would mask wire-shape bugs). The `::notice::` annotations on each run show which protocol produced the review. See docs/providers.md#cross-protocol-auto-discovery-the-dispatcher. | no | openai-compatible |
| github-api-base | GitHub API base URL for Copilot provider token exchange. Defaults to https://api.github.com; set to https://<tenant>.ghe.com for GitHub Enterprise Server data residency. | no | "" |
| walkthrough | Generate a separate PR walkthrough comment. | no | false |
| diagnostic | Inject a synthetic low-severity finding for pipeline smoke tests. | no | false |
| dry-run | Generate review output without posting comments or status. | no | false |
| dry_run | Synonym for dry-run; some runners require an underscore key for boolean inputs. | no | false |
| debug-raw-response | Echo the raw provider response into the workflow log. | no | false |
| simulate-findings | Replace an empty live provider payload with a deterministic multi-finding fixture. Live results are always preferred when the provider returns real findings. | no | false |
| review-timeout-seconds | Hard ceiling for the full model-call retry budget. | no | 300 |
| stall-seconds | Stream stall budget for the SSE channel. | no | 270 |
| max-output-tokens | max_output_tokens sent to the provider. | no | 16000 |
| minimum-severity | Minimum severity to post inline (low|medium|high). Defaults to "medium" — low-severity findings (style, hygiene) are filtered out of the postable set. Set to "low" to keep them. `security` and `leak` findings ALWAYS survive any threshold and are never suppressed by this option. | no | medium |
| max-comments | Cap on posted comments per review. | no | 50 |
| review-file-limit | Soft cap on the number of changed files the live review path will process. When a PR's diff touches more files than this, the CLI skips the chunked review and posts a "diff too large to review" parent card with zero inline findings, rather than feeding arbitrarily-large chunks to the LLM (which produces hallucinated findings). Set to 0 to disable the limit. | no | 200 |
| include-sonarqube | Pull SonarQube issues alongside the PR review. | no | false |
| sonar-host-url | SonarQube base URL. | no | "" |
| sonar-token | SonarQube token. | no | "" |
| sonar-project-key | SonarQube project key. | no | "" |
| sonar-timeout-seconds | SonarQube HTTP timeout in seconds. | no | 300 |
| detect-leaks | Run secret-leak detection on the diff. | no | true |
| platform | Platform to dispatch (auto|github|azure). | no | auto |
| pr-number | Pull request number. | no | "" |
| repo | Repository in owner/name form. | no | "" |
Outputs
no outputs