Run Open Code Review with GitLab CI

Prerequisites#

• A GitLab project with a runner that uses the Docker executor, such as GitLab.com hosted Linux runners.
• A masked ANTHROPIC_API_KEY CI/CD variable (opens in new tab) and an unmasked OCR_MODEL variable.

Set up#

Add the open-code-review job to your project's .gitlab-ci.yml. It runs only in merge request pipelines.

The job runs ghcr.io/hambn/open-code-review:ubuntu. Replace the tag with @sha256:<digest> to pin one build.

Variables#

Workspace#

The runner clones the full history (GIT_DEPTH: "0") into $CI_PROJECT_DIR and runs the script as the image user, sysadmin (UID 1000). The clone belongs to a different user, so the first script line marks it as a Git safe directory. The job clears the image's ocr entrypoint because the runner passes a shell as the command. The review covers $CI_MERGE_REQUEST_DIFF_BASE_SHA to HEAD.

Files#

• gitlab-ci.yml: merge request review job.

Limitations#

• Merge request pipelines that run in a fork do not get the parent project's CI/CD variables, so the job stops at the variable check.
• The review is advisory: the job does not comment on the merge request or fail on findings. Read it in the job log.
• The diff is untrusted model input, and the job environment, including CI_JOB_TOKEN, is visible to any command the agent runs.
• ocr review exits 0 even when it reports findings. The upstream CI guide (opens in new tab) shows how to post findings as review comments.

# Add this job to your project's .gitlab-ci.yml and set a masked ANTHROPIC_API_KEY and an OCR_MODEL CI/CD variable.
open-code-review:
  image:
    name: ghcr.io/hambn/open-code-review:ubuntu
    # The runner passes a shell as the command, so clear the image's CLI entrypoint.
    entrypoint: [""]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    # A full clone keeps the merge request's diff base commit available.
    GIT_DEPTH: "0"
  timeout: 30m
  script:
    # The runner clones as a different user than sysadmin, so Git needs the path marked safe.
    - git config --global --add safe.directory "$CI_PROJECT_DIR"
    - ': "${ANTHROPIC_API_KEY:?Set ANTHROPIC_API_KEY as a masked CI/CD variable}"'
    - ': "${OCR_MODEL:?Set OCR_MODEL as a CI/CD variable}"'
    # ocr reads the provider and model from its config and the key from ANTHROPIC_API_KEY.
    - ocr config set provider anthropic
    - ocr config set model "$OCR_MODEL"
    - ocr review --from "$CI_MERGE_REQUEST_DIFF_BASE_SHA" --to HEAD