| github-token | GitHub token for API access | yes | ${{ github.token }} |
| ai-provider | AI provider: openai, anthropic, gemini, azure, azure-responses, ollama (default: openai). Overridable via .sherlockqa.yml. | no | — |
| openai-api-key | OpenAI API key (required if ai-provider=openai) | no | — |
| model | Model to use. Defaults: openai=gpt-4o-mini, anthropic=claude-sonnet-4-5, gemini=gemini-2.0-flash, ollama=llama3.1 | no | — |
| anthropic-api-key | Anthropic API key (required if ai-provider=anthropic) | no | — |
| gemini-api-key | Google AI Studio / Gemini API key (required if ai-provider=gemini) | no | — |
| ollama-base-url | Ollama server base URL (default: http://localhost:11434). Only useful if your runner can reach an Ollama instance. | no | http://localhost:11434 |
| azure-api-key | Azure OpenAI API key (required if ai-provider=azure or azure-responses) | no | — |
| azure-endpoint | Azure OpenAI endpoint URL (e.g., https://your-resource.openai.azure.com) | no | — |
| azure-deployment | Azure OpenAI deployment name | no | — |
| azure-api-version | Azure OpenAI API version | no | 2024-02-15-preview |
| mode | Review mode: general (default) or security (audit for vulnerabilities only). Overridable via .sherlockqa.yml. | no | — |
| min-severity | Minimum severity to report: error, warning, suggestion (default: warning). Overridable via .sherlockqa.yml. | no | — |
| ignore-patterns | Comma-separated list of file patterns to ignore. Supports glob (*, **, ?). Default: *.md,*.txt,package-lock.json,yarn.lock. Overridable via .sherlockqa.yml. | no | — |
| persona | Custom persona/role instructions (e.g., "Act as a senior security engineer") | no | — |
| domain-knowledge | Domain-specific context for better reviews (e.g., freight forwarding, e-commerce) | no | — |
| max-tokens | Maximum tokens for AI response (default: 4096). Overridable via .sherlockqa.yml. | no | — |
| auto-approve | Submit APPROVE when verdict is approved (default: false; requires PAT or repo settings to allow Actions to approve PRs). Overridable via .sherlockqa.yml. | no | — |
| code-quality | Enable code quality analysis — repetitive code, code smells, maintainability issues (default: false). Overridable via .sherlockqa.yml. | no | — |
| review-style | Review output style - compact (verdict at top, concise) or detailed (verbose). Default: compact. Overridable via .sherlockqa.yml. | no | — |
| use-emoji | Use emojis in review output (default: true). Overridable via .sherlockqa.yml. | no | — |
| personality | Review personality - detective (Sherlock), bro (casual dude), desi (Hinglish), professional (formal), enthusiastic (hyped up). Default: detective. Overridable via .sherlockqa.yml. | no | — |
| review-strictness | How strict the review should be - lenient (only critical issues), balanced (reasonable checks), strict (thorough, flags more issues). Default: balanced. Overridable via .sherlockqa.yml. | no | — |
| update-summary-comment | Maintain a single sticky issue-comment with the current review summary, updated in place each run (default: true). Overridable via .sherlockqa.yml. | no | — |
| create-check-run | Create a GitHub Check Run so the verdict and annotations appear in the PR Checks column — requires checks:write permission (default: true). Overridable via .sherlockqa.yml. | no | — |