khezen/CodeSpy Code Review
Automated code review powered by AI. Detects bugs, security vulnerabilities, and documentation issues in your PRs.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 13, 2026
- License
- MIT
Pinned Snippet
uses: khezen/codespy@28a289153bc7d1c49d1c681d0219d25c4dd40a9e # 0.4.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token for PR access and posting comments. Uses GITHUB_TOKEN by default. | no | ${{ github.token }} |
| model | Default LLM model to use (e.g., anthropic/claude-sonnet-4-5-20250929, openai/gpt-5, bedrock/us.anthropic.claude-sonnet-4-5-20250929-v1:0) | yes | — |
| extraction-model | Model for field extraction (smaller model recommended) | no | anthropic/claude-haiku-4-5-20251001 |
| pr-url | URL of the pull request to review. Defaults to the current PR context. | no | "" |
| post-comment | Post review as a Git platform PR/MR comment | no | true |
| output-format | Output format: markdown or json | no | markdown |
| anthropic-api-key | Anthropic API key (for Claude models) | no | — |
| openai-api-key | OpenAI API key (for GPT models) | no | — |
| gemini-api-key | Google Gemini API key | no | — |
| aws-access-key-id | AWS Access Key ID (for Bedrock models) | no | — |
| aws-secret-access-key | AWS Secret Access Key (for Bedrock models) | no | — |
| aws-region | AWS Region (for Bedrock models) | no | us-east-1 |
| default-max-iters | Default maximum iterations for all signatures | no | 3 |
| default-max-context-size | Default maximum context size for all signatures | no | 50000 |
| default-max-reasoning-tokens | Default maximum reasoning tokens for all signatures | no | 8000 |
| default-temperature | Default temperature for LLM calls (0.0-1.0) | no | 0.1 |
| llm-retries | Number of retries for LLM API calls | no | 3 |
| llm-timeout | Timeout in seconds for LLM calls | no | 120 |
| enable-prompt-caching | Enable provider-side prompt caching (reduces latency and costs) | no | true |
| scope-enabled | Enable scope identification signature | no | true |
| scope-model | Model for scope identification (empty = use default) | no | — |
| scope-max-iters | Max iterations for scope identification | no | — |
| scope-max-context-size | Max context size for scope identification | no | — |
| scope-max-reasoning-tokens | Max reasoning tokens for scope identification | no | — |
| scope-temperature | Temperature for scope identification | no | — |
| code-review-enabled | Enable code review signature (bugs, security vulnerabilities, code smells) | no | true |
| code-review-model | Model for code review (empty = use default) | no | — |
| code-review-max-iters | Max iterations for code review | no | — |
| code-review-max-context-size | Max context size for code review | no | — |
| code-review-max-reasoning-tokens | Max reasoning tokens for code review | no | — |
| code-review-temperature | Temperature for code review | no | — |
| doc-enabled | Enable documentation review signature (stale/wrong documentation) | no | true |
| doc-model | Model for doc review (empty = use default) | no | — |
| doc-max-iters | Max iterations for doc review | no | — |
| doc-max-context-size | Max context size for doc review | no | — |
| doc-max-reasoning-tokens | Max reasoning tokens for doc review | no | — |
| doc-temperature | Temperature for doc review | no | — |
| supply-chain-enabled | Enable supply chain security signature | no | true |
| supply-chain-model | Model for supply chain security (empty = use default) | no | — |
| supply-chain-max-iters | Max iterations for supply chain security | no | — |
| supply-chain-max-context-size | Max context size for supply chain security | no | — |
| supply-chain-max-reasoning-tokens | Max reasoning tokens for supply chain security | no | — |
| supply-chain-temperature | Temperature for supply chain security | no | — |
| supply-chain-scan-unchanged | Scan all artifacts/manifests even if not modified in the PR (default: only scan changed) | no | false |
| summarization-enabled | Enable PR summarization signature | no | true |
| summarization-model | Model for summarization (empty = use default) | no | — |
| summarization-max-iters | Max iterations for summarization | no | — |
| summarization-max-context-size | Max context size for summarization | no | — |
| summarization-max-reasoning-tokens | Max reasoning tokens for summarization | no | — |
| summarization-temperature | Temperature for summarization | no | — |
| excluded-directories | JSON array of directories to exclude from review (e.g., ["vendor", "dist"]) | no | — |
| fail-on-critical | Fail the action if critical issues are found | no | false |
| codespy-version | Version of codespy Docker image to use | no | latest |
Outputs
| name | description |
|---|---|
| issues-count | Total number of issues found |
| critical-count | Number of critical issues found |
| high-count | Number of high severity issues found |
| review-output | The full review output |