tool-containers
Search docs…Ctrl K
Menu
GitHub (opens in new tab)

Run Open Code Review with GitHub Actions

workflow.yml reviews each pull request with Open Code Review and writes the review to the job log. It saves the anthropic provider and the OCR_MODEL model with ocr config set, then runs ocr review --from <base> --to HEAD.

Images
  • GHCRghcr.io/hambn/open-code-review
  • Docker Hubdocker.io/hambn/open-code-review
Use case
Code review in CI on GitHub pull requests
Upstream
github.com/alibaba/open-code-review (opens in new tab)
Source
tools/ai/open-code-review/docs/github-actions (opens in new tab)
On this page

Prerequisites

Set up

Shell
mkdir -p .github/workflows
cp workflow.yml .github/workflows/open-code-review.yml

It runs on every pull request opened from a branch of the same repository.

The workflow runs ghcr.io/hambn/open-code-review:ubuntu. Replace the tag with @sha256:<digest> to pin one build.

Variables

Variable Required Purpose
ANTHROPIC_API_KEY yes Repository secret: Anthropic API key. With the anthropic provider and no saved key, ocr reads this variable.
OCR_MODEL yes Repository variable: model name for the anthropic provider, for example claude-opus-4-6; not a secret.

Workspace

The runner checks out the pull request merge commit and its first parent. The review container mounts the checkout read-only at /workspace and runs as sysadmin (UID 1000); it does not receive the job's GitHub token. Because the checkout belongs to the runner user, the step passes GIT_CONFIG_* variables that mark /workspace as a Git safe directory.

Files

Limitations

  • Pull requests from forks are skipped, because GitHub does not pass secrets to workflows they trigger.
  • The review is advisory: the job does not comment on the pull request or fail on findings. Read it in the job log.
  • The diff is untrusted model input. The step has a read-only mount and no GitHub token, which limits what a crafted change can make the agent do.
  • ocr review exits 0 even when it reports findings. The upstream CI guide (opens in new tab) shows how to post findings as review comments.

File contents

workflow.yml44 lines
# Copy to .github/workflows/open-code-review.yml and add an ANTHROPIC_API_KEY repository secret and an OCR_MODEL variable.
name: open-code-review

on:
  pull_request:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  review:
    name: Review with Open Code Review
    # GitHub does not pass secrets to workflows triggered from forks, so skip those pull requests.
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # The pull request merge commit and its first parent, the base branch, cover the diff.
          fetch-depth: 2
          persist-credentials: false
      - name: Review
        # An explicit bash shell adds pipefail, so a failed git diff fails the step.
        shell: bash
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          OCR_MODEL: ${{ vars.OCR_MODEL }}
        run: |
          # The checkout belongs to the runner user, so Git in the container needs it marked safe.
          # ocr reads the provider and model from its config and the key from ANTHROPIC_API_KEY.
          docker run --rm -e ANTHROPIC_API_KEY -e OCR_MODEL \
            -e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0=/workspace \
            -v "$GITHUB_WORKSPACE:/workspace:ro" \
            --entrypoint sh ghcr.io/hambn/open-code-review:ubuntu -ec '
              : "${OCR_MODEL:?Set the OCR_MODEL repository variable}"
              ocr config set provider anthropic
              ocr config set model "$OCR_MODEL"
              ocr review --from HEAD^1 --to HEAD'

Topics