| github_token | GitHub token for PR access (usually secrets.GITHUB_TOKEN) | yes | — |
| anthropic_auth_token | API key for the AI endpoint (Anthropic, z.ai/GLM, OpenRouter, OpenAI, or any compatible provider) | yes | — |
| ai_provider | API dialect: 'anthropic' for Anthropic-compatible endpoints (default, the existing behavior); 'openai' for OpenAI-compatible /chat/completions endpoints (OpenAI, OpenRouter, z.ai coding API, local servers). The anthropic_* inputs apply to whichever dialect is selected | no | anthropic |
| anthropic_base_url | Base URL for the AI API. Change for z.ai/GLM, OpenRouter, OpenAI, or custom endpoints | no | https://api.anthropic.com |
| anthropic_model | Model id, or a comma-separated fallback chain tried in order (the next is used when a model is rejected as unknown or exhausts its retries on a capacity/transient failure) | no | glm-5.2 |
| model_pricing | Optional per-model prices in USD per MILLION tokens, comma-separated model=input/output pairs (e.g. "glm-5.2=0.6/2.2,glm-5.2[1m]=1/3"). When set, the summary comment, action outputs and Backstage payload include an estimated run cost. Client-side estimate from token counts — not billing data | no | "" |
| max_tokens | 0 (default) = auto: use the model's full native output capacity (e.g. 131072 on GLM-5.2) so a review is never truncated by a self-imposed cap; if an endpoint advertises a smaller maximum in its rejection, it is discovered and latched automatically. Set a positive number to cap output tokens manually | no | 0 |
| thinking_budget | Extended-thinking budget in tokens, added on top of max_tokens. NOTE: GLM endpoints treat thinking as on/off and do NOT enforce this budget — with the default max_tokens auto mode the full output capacity absorbs even a long think. Set 0 to disable thinking. Auto-disabled if the endpoint rejects the thinking param | no | 4096 |
| context_window | Total context window of the target model, in tokens. The prompt is trimmed to fit within this minus reserved output, avoiding model_context_window_exceeded. Default 1000000 (GLM-5.2 / Opus 4.8); if a request still overflows after a fallback to a smaller model, the compact retry recovers it | no | 1000000 |
| temperature | AI temperature (0.0 - 1.0) | no | 0.2 |
| review_mode | combined (default): one comprehensive all-at-once review covering every category. separate: 8 parallel specialist agents selected by review_profile/toggles | no | combined |
| review_profile | Review intensity for separate mode: strict (all 8 agents), standard (6 agents), minimal (2 agents). Ignored in combined mode | no | standard |
| enable_security_review | Enable/disable the security review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| enable_code_quality_review | Enable/disable the code quality review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| enable_performance_review | Enable/disable the performance review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| enable_type_safety_review | Enable/disable the type safety review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| enable_architecture_review | Enable/disable the architecture review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| enable_testing_review | Enable/disable the testing review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| enable_api_design_review | Enable/disable the api design review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| enable_documentation_review | Enable/disable the documentation review agent in separate mode (true/false overrides the profile; empty follows the profile) | no | "" |
| framework | Framework for prompt additions: angular, loopback4, both, generic (none), auto (detect from repo) | no | auto |
| pr_number | Pull request number to review. Defaults to the PR of the triggering pull_request event | no | "" |
| jira_url | JIRA instance URL (e.g., https://company.atlassian.net) | no | "" |
| jira_email | JIRA user email for API authentication | no | "" |
| jira_api_token | JIRA API token | no | "" |
| jira_project_key | JIRA project key for ticket validation (e.g., PLM, PROJ) | no | "" |
| fail_on_critical | Fail the action (exit code 1) when findings at or above fail_threshold exist | no | false |
| fail_threshold | Minimum severity to fail: critical, high, medium | no | critical |
| post_inline_comments | Post inline review comments on specific diff lines | no | true |
| post_data_url | Optional Backstage/webhook endpoint. When set, review metrics and all individual findings are POSTed as JSON after the review — including skip/failure runs, so the tracker sees every run (fire-and-forget, never fails the action). See docs/backstage-integration.md | no | "" |
| enable_reply_handling | Verify human replies on previous review threads against the code, post a justification reply in each, and resolve the thread when the reply is valid | no | true |
| enable_rerun_focus | On re-runs (a completed AI review already exists on this PR): limit NEW inline comments to critical/high findings plus documentation suggestions, reopen resolved threads whose critical/high issue reappeared, and keep the existing PR description/diagrams. Summary totals still count all severities. Disable to restore full first-run behavior on every run | no | true |
| enable_bot_comment_cleanup | Minimize noisy recurring bot comments (e.g. sonarqubecloud, unit-test-quality reports): known noise is hidden entirely, other recurring types keep only the latest occurrence | no | true |
| max_files_to_review | Skip review if PR has more changed files than this | no | 50 |
| exclude_patterns | Comma-separated glob patterns to exclude (appended to built-in defaults: package-lock, openapi.json, migrations, .bpmn, dist, node_modules, .d.ts, etc.) | no | "" |
| include_patterns | Comma-separated glob patterns to include (if set, only these are reviewed) | no | "" |
| enable_context_tools | Let the reviewer model fetch missing context itself via bounded local-repo tools (read_file, grep, find_references, list_dir). Hard-capped: at most 2 extra AI turns per review and 12 tool calls per run; requires the local-clone context engine (falls back to no tools when unavailable) | no | true |
| related_context | How much unchanged-file context is fetched for the reviewer: full (import graph incl. tsconfig path aliases, npm-workspace packages and barrel re-exports, plus framework expansion — Angular sibling templates/styles/modules, LoopBack4 string-key DI bindings), imports-only (import graph only), off (none) | no | full |
| system_prompt_override | Full replacement of the default system prompt (replaces all built-in prompts) | no | "" |
| system_prompt_append | Text appended to the default system prompt (adds to built-in prompts) | no | "" |
| angular_prompt_append | Additional instructions appended for Angular-specific reviews | no | "" |
| loopback4_prompt_append | Additional instructions appended for LoopBack4-specific reviews | no | "" |
| comment_header | Custom header for the review summary comment | no | AI Code Review |
| comment_footer | Custom footer text for the review summary comment | no | "" |
| enable_diagrams | Generate AI Mermaid diagrams (validated via Kroki.io, rendered natively by GitHub) in the PR description | no | true |
| agent_timeout | Timeout in seconds for each review agent AI call. Progress-aware: it applies in full to silent calls (no tokens = hung endpoint), but a call still streaming tokens at the deadline keeps running while deltas keep arriving — up to a 30-minute hard cap (or this value if set higher). A stream silent for 60s past the deadline is aborted as stalled | no | 800 |
| max_retries | Maximum retries per agent on transient AI API failure (5xx/network). Rate limits (429) retry on their own patient budget — up to 400 attempts with escalating waits (10s up to 2min, max 5h total, riding out fair-usage throttling spells) — independent of this setting | no | 3 |
| cancel_on_pr_close | Cancel the review run (neutral exit, not a failure) if the PR is closed or merged while the review is still running, freeing the runner and AI quota | no | true |
| debug | Enable debug logging | no | false |