pgup-ai/J-Bot Code Review

Open-source agentic PR review in your own CI — bring your model key or a CLI subscription (Codex, Cursor & more). $0/seat.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 11, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: pgup-ai/jbot-review-action@5ccf68a44a3b0a0f2afc4adc272515d1a53dcad3 # v0.2.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
provider	LLM provider. Defaults to opencode when unset.	no	""
model	Provider model id, optionally prefixed as provider/model. Uses provider default if unset; required for openai-compatible.	no	""
sdk-engine	SDK routing: auto uses pi when its catalog has the selected model, otherwise opencode; opencode pins every SDK session to opencode.	no	""
opencode-api-key	OpenCode API key. Used when provider or aux-provider is opencode/opencode-go.	no	""
deepseek-api-key	DeepSeek API key. Used when provider or aux-provider is deepseek.	no	""
openai-api-key	OpenAI API key. Used when provider or aux-provider is openai.	no	""
openai-compatible-api-key	API key for provider openai-compatible. Kept separate from the direct OpenAI key.	no	""
openai-compatible-base-url	Base URL for provider openai-compatible, including any required API version path.	no	""
anthropic-api-key	Anthropic API key. Used when provider or aux-provider is anthropic.	no	""
gemini-api-key	Gemini API key. Used when provider or aux-provider is google.	no	""
openrouter-api-key	OpenRouter API key. Used when provider or aux-provider is openrouter.	no	""
nvidia-api-key	NVIDIA API key. Used when provider or aux-provider is nvidia.	no	""
zai-api-key	Z.AI API key. Used when provider or aux-provider is zai-coding-plan.	no	""
kimi-api-key	Kimi API key. Used when provider or aux-provider is kimi-for-coding.	no	""
xai-api-key	xAI API key. Used by xai, or by grok when grok-auth is empty.	no	""
fireworks-api-key	Fireworks AI API key. Used when provider or aux-provider is fireworks-ai.	no	""
mimo-api-key	Xiaomi MiMo Token Plan API key (tp-… / sk-…). Used when provider or aux-provider is xiaomi-token-plan-sgp.	no	""
devin-windsurf-api-key	Devin/Windsurf API key. Used when provider or active aux-provider is devin.	no	""
commandcode-access-key	CommandCode CLI access key. Used when provider or active aux-provider is commandcode.	no	""
cursor-api-key	Cursor API key. Used when provider or active aux-provider is cursor.	no	""
poolside-api-key	Poolside API key. Used when provider or active aux-provider is poolside.	no	""
qoder-token	Qoder personal access token. Used when provider or active aux-provider is qoder.	no	""
codex-auth	Codex CLI auth: the contents of ~/.codex/auth.json. Used when provider or active aux-provider is codex.	no	""
cline-auth	Cline CLI auth: the contents of ~/.cline/data/settings/providers.json. Used when provider or active aux-provider is cline or cline-pass.	no	""
grok-auth	Grok Build CLI account auth: the contents of ~/.grok/auth.json. Preferred over xai-api-key when grok is selected.	no	""
kilo-auth	Kilo CLI auth: the contents of ~/.local/share/kilo/auth.json. Used when provider or active aux-provider is kilo.	no	""
enable-context7	Enable Context7 MCP documentation lookup for external API/SDK/framework/workflow changes. Use auto, true, or false.	no	auto
context7-api-key	Optional Context7 API key for reliable MCP documentation lookup in CI.	no	""
github-token	Token to read the PR and post the review.	yes	${{ github.token }}
thread-resolution-token	Optional token used only to resolve addressed review threads. Falls back to github-token when unset.	no	""
pr-number	Pull request number for manual workflow_dispatch runs.	no	""
dry-run	Log the review body and inline comments without posting to GitHub.	no	false
max-findings	Maximum number of findings to post or log. Use 0 for no limit.	no	0
min-severity	Minimum severity to include: P0, P1, P2, P3, or nit.	no	nit
include-prior-comments	Include prior PR review comments in the review context.	no	true
enable-guideline-pass	Run a dedicated guideline-compliance review session when repository guidelines are discovered.	no	true
aux-model	Model for auxiliary sessions (addressed-thread check, guideline compliance, finding verification). Uses aux-provider/JBOT_AUX_PROVIDER when set, otherwise the main provider. Uses the main model when unset.	no	""
aux-provider	Optional provider for aux-model. Defaults to provider/JBOT_REVIEW_PROVIDER when unset.	no	""
review-passes	Total review passes (1-3). Passes beyond the first add focused recall lenses (interactions, then integrity) in parallel on the aux model; findings are merged and deduped. Each extra pass costs roughly one extra model session — cheap on paid tiers, but adds queue time on throttled free tiers. Default 1; raise to 2-3 for maximum recall.	no	1
verify-findings	Adversarially verify blocking findings in a dedicated session before posting: refuted findings are dropped, uncertain ones demoted to advisory.	no	true
time-budget-minutes	Wall-clock target in minutes (0 = no budget). Derives per-session timeouts; an auxiliary session over its share fails open (degrades only itself), while a main review shard that still fails after its retry aborts the run rather than posting partial coverage.	no	30
review-shards	Parallel shards for the main review. 1 = no sharding, one full-diff session (default). 0 = auto from diff size, capped at 4. N = pin N shards. Sharding only speeds up review on providers that serve concurrent sessions; on free/throttled tiers the shards serialize on one API key, so 1 is the better default. Either way the review covers the complete diff. Raise it (and pair with max-concurrent-sessions) only on paid tiers with real concurrency, or for very large PRs where smaller per-shard context helps depth.	no	1
dynamic-fanout	Scale recall-supplement fan-out (extra lenses + the guideline pass) to diff risk/size; false forces the full requested fan-out on every PR.	no	true
model-options	JSON object of provider options for the main model. Native providers default to {"reasoningEffort":"medium"}; Poolside uses {"reasoningEffort":"default"} to leave reasoning provider-managed; custom providers default to {} because arbitrary endpoints may reject unknown options. Aux-model sessions are unaffected.	no	—
prompt-cache	Enable opencode prompt caching (provider setCacheKey). Parallel shards and re-reviews share an identical prompt prefix, so caching cuts input-token cost on models that honor it; models marked unsupported omit the cache key. Per-session cache hits are logged.	no	true
skip-doc-only	Skip the full LLM review when a PR changes only documentation, prose, or diagram assets (.md, .mdx, .markdown, .rst, .adoc, .txt, .pdf, .svg, .drawio, .dio, .excalidraw, .mmd, .puml, .plantuml). The reaction is left unchanged (a docs push does not change the verdict, so a prior clean reaction stays and an open-findings PR stays reaction-less); a single code/config file forces a full review. Deterministic, no model call.	no	true
max-concurrent-sessions	Max model sessions in flight at once (default 3; 0 = unlimited). Throttled provider tiers serialize concurrent requests on one key upstream; capping on our side keeps session deadlines measuring model time, not queue time. Set 2 on tight free tiers, or 0 for unlimited on paid concurrent tiers.	no	3
review-telemetry	Emit per-finding disposition + per-session telemetry to .jbot-review/telemetry.jsonl (default true). Near-zero overhead: in-memory tagging plus one post-review write. Set false to disable.	no	true
evidence-quotes	Ask each finding to carry a verbatim quote of the changed line it flags (default true). Grounds finding verification and lets a would-be-orphaned finding be re-anchored. Set false to keep the pre-F12 prompt.	no	true
fail-on-error	Fail the workflow when the review cannot complete.	no	true

Outputs

no outputs