mattjcoles/lgtmaybe

Provider-agnostic PR reviewer. After Marketplace install, choose the provider, model, and authentication in your workflow.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 6, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: mattjcoles/lgtmaybe@b94438d54368271853bee2fca8d3762d644022bd # lgtmaybe-v0.11.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
provider	Set this in the workflow `with:` block. LLM provider: openai, anthropic, openrouter, zai, bedrock, vertex, azure, ollama, or openai-compatible (any OpenAI /v1 endpoint via api_base — DeepSeek, llama.cpp, LM Studio, vLLM).	no	""
model	Set this beside `provider` in the workflow `with:` block. Model name understood by the chosen provider (e.g. gpt-5.5, claude-sonnet-4-6).	no	""
preset	Review preset. fast (the default) covers all nine lenses in four model calls: dedicated security and correctness calls (the stated intent folds into correctness), plus merged code-health (performance/complexity/ponytail/deprecation) and artefacts (tests/documentation) calls — roughly half the calls and wall time, trading some recall on the softer lenses. full runs one call per lens, for release branches and deep audits. An explicit categories list in .lgtmaybe.yml overrides the preset.	no	""
fallback_model	Model to retry with if the primary model fails.	no	""
triage_model	Cheap model that runs first to skip plainly-non-substantive files and rank the rest by risk; the strong `model` then reviews only the survivors. Security-relevant files (auth/crypto/IaC/CI paths, security tokens, static-analysis hits, large hunks) always escalate past triage. Unset = no triage (every file gets the full review).	no	""
reflect_model	Model for the self-reflection (false-positive audit) pass. Defaults to model; point it at a stronger model to audit a weaker reviewer's findings.	no	""
api_key	API key for key-based providers (openai/anthropic/openrouter/azure, and openai-compatible hosted endpoints like DeepSeek). Leave empty for bedrock/vertex/ollama and keyless local openai-compatible servers.	no	""
api_base	Resource endpoint for azure (https://<resource>.openai.azure.com), the OpenAI /v1 base for openai-compatible (e.g. https://api.deepseek.com/v1), or a custom base URL for other providers.	no	""
timeout	Per-request timeout in seconds for each model call. Leave empty for the provider default (ollama and openai-compatible 300, cloud 60).	no	""
max_review_seconds	Soft wall-clock ceiling for the whole review, in seconds (default 600). Once it passes, no further model calls are dispatched — in-flight calls finish and the review posts partial results with an incomplete-results notice. Set 0 to disable.	no	""
temperature	Sampling temperature (default 0.0 for deterministic reviews).	no	""
num_ctx	Ollama context window (ollama only; ignored for hosted providers). Raise it so a large multi-file diff isn't truncated. Leave empty for the default (32768).	no	""
max_input_tokens	Token budget per model call before the diff is split into batches (any provider). Leave empty for the default (100000).	no	""
max_concurrency	Concurrent review calls across the whole fan-out (all batches and lenses share one pool). Leave empty for the provider-aware default: 8 for cloud providers, 1 for ollama and openai-compatible (a single-slot llama.cpp/LM Studio server wants 1; raise it explicitly for a batching vLLM server).	no	""
resolve_fixed	Auto-resolve a review conversation once its finding is fixed: on a re-run, when a flagged finding is no longer produced and the thread is outdated, lgtmaybe replies and resolves it. Set to false to leave conversations for manual resolution.	no	""
recursive	Walk a file whose diff exceeds max_input_tokens hunk-by-hunk (RLM-style) instead of sending it whole and letting the model drop the tail. On by default; set to false to disable.	no	""
structured_output	Constrain model output to the findings JSON schema via the provider's response_format (JSON mode). On by default; set to false for an openai-compatible gateway/proxy that rejects response_format (the lenient parser still handles fenced/prose output either way).	no	""
symbol_resolution	During reflection, use ast-grep to resolve a deferred finding's referenced symbol to the file that defines it — searched in a read-only shallow clone of the PR's base branch — so the auditor re-judges a cross-file finding against the real definition. On by default; set to false to disable.	no	""
prompt_cache	Cache the static system prompt across the per-lens calls on providers with an explicit cache breakpoint (anthropic, bedrock Claude/Nova) — cached reads are billed at a steep discount. Feature-detected per model and a safe no-op elsewhere. On by default; set to false to disable.	no	""
incremental	Commit-scoped incremental review: on a synchronize push, review only the diff of the commits added since the last completed review instead of the whole PR. Auto by default (on for synchronize, full review everywhere else); set to true/false to force. Falls back to a full review after a force-push/rebase or when no previous review exists. `/review full` forces a full re-review on demand.	no	""
static_analysis	Run installed deterministic linters (ruff, bandit, semgrep with local rules) over the changed files in a sandboxed, network-less subprocess and feed their findings to the model as untrusted hints to confirm or discard. Off by default; tools not present in the image are skipped silently.	no	""
auto_describe	On a freshly opened (or reopened) PR, post a structured description comment — title, change type, summary, per-file walkthrough, and an intent check — before the review runs, updated in place by later /describe runs. Off by default.	no	""
auto_diagram	On a freshly opened (or reopened) PR, post a C4-style change diagram comment — a Mermaid C4 diagram of the components the PR touches (rendered natively by GitHub), with an ASCII fallback — before the review runs, updated in place by later /diagram runs. Off by default.	no	""
pr_labels	Attach labels derived from the review (no extra model calls): a review-effort/1-5 size estimate, possible-security-issue when a high/critical security finding posts, and consider-splitting when the diff spans many unrelated directories. Best-effort; off by default.	no	""
profile	Print a timing profile at the end of the run in the Action log: total wall time, per-stage and per-call tables (with token and prompt-cache usage), and cache hit totals. Off by default.	no	""
aws_role_arn	IAM role ARN to assume via GitHub OIDC for bedrock. No static AWS key is ever stored.	no	""
aws_region	AWS region for bedrock (used with aws_role_arn).	no	us-east-1
gcp_wif_provider	GCP Workload Identity Federation provider resource name for vertex.	no	""
gcp_service_account	GCP service account email to impersonate via WIF (used with gcp_wif_provider).	no	""
azure_client_id	Entra (Azure AD) client ID with a federated credential trusting this repo — keyless azure via GitHub OIDC. No static key is stored.	no	""
azure_tenant_id	Entra (Azure AD) tenant ID for keyless azure (used with azure_client_id).	no	""
config_path	Path to the .lgtmaybe.yml config file, relative to the repo root.	no	.lgtmaybe.yml
image	Override the container image (advanced; defaults to the released GHCR image).	no	ghcr.io/mattjcoles/lgtmaybe:v0
github_token	Token used to fetch the diff and post the review. Defaults to the workflow token.	no	${{ github.token }}
app_id	GitHub App ID. Set it (with app_private_key) to post reviews as your own branded App identity — e.g. lgtmaybe[bot] with an avatar, plus higher API rate limits — instead of the default github-actions[bot]. The App needs `pull requests: write` + `contents: read`. Left empty, the default workflow token is used.	no	""
app_private_key	Private key (PEM) of the GitHub App named by app_id. Wire a repository secret to it. Used only to mint a short-lived installation token, which is auto-revoked at the end of the job — no static key is stored.	no	""
app_owner	Owner for a cross-repo App token (defaults to the current repository's owner). Set with app_repositories to review PRs across a monorepo or org.	no	""
app_repositories	Newline- or comma-separated list of repositories the minted App token may access (defaults to just the current repository). Used with app_owner for cross-repo reach.	no	""

Outputs

no outputs