ai-code-review.yml

Multi-agent PR review. Picks one of the configured AI agents at random and dispatches that agent’s own review workflow for the PR, falling through to the next candidate when one can’t be dispatched.

It sits above whichever per-agent review workflows a repo has installed — claude-code-review.yml and gemini-code-review.yml — rather than reviewing anything itself, so those stubs have to exist in the caller repo and be named to match the *-review-workflow-file inputs below.

What the fallback covers

The fallback covers an agent that is unavailable at dispatch time: no API key or token secret configured for it, or its review workflow file missing or disabled in the caller repo.

It does not cover an agent that dispatches successfully and then fails partway through its own run. gh workflow run returns as soon as the run is queued and reports no run id, so there is nothing to wait on; failing over on a runtime failure needs the dispatched run to be located and awaited, tracked in gha#362.

Inputs

Input	Type	Default	Description
agents	string	'claude, gemini'	Comma-separated agents to select from. Unrecognized names are warned about and skipped.
pr-number	string	''	Pull request number to review. Required on workflow_dispatch; taken from the event on pull_request.
claude-review-workflow-file	string	'claude-code-review.yml'	Caller-repo workflow file dispatched for a Claude review.
gemini-review-workflow-file	string	'gemini-code-review.yml'	Caller-repo workflow file dispatched for a Gemini review.

Secrets

Secret	Required	Description
CLAUDE_CODE_OAUTH_TOKEN	no	Max-plan OAuth token. Either this or ANTHROPIC_API_KEY makes claude an eligible candidate.
ANTHROPIC_API_KEY	no	Direct Anthropic API key.
GEMINI_API_KEY	no	Gemini API key. Makes gemini an eligible candidate.

Permissions

Grant contents: read, pull-requests: read, and actions: write (the last so it can dispatch the selected agent’s review workflow).

The dispatch uses GITHUB_TOKEN, so no personal access token is needed: actions: write is enough to start a workflow in the caller’s own repository. Each agent’s own review workflow declares whatever permissions it needs for itself.

Example

# Copy to .github/workflows/ai-code-review.yml in your repo.
name: AI Code Review

on:
  # Optional: automatic review on PR activity.
  # pull_request:
  #   types: [opened, synchronize, ready_for_review, reopened]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'Pull request number to review'
        required: true
        type: string

jobs:
  ai-review:
    permissions:
      contents: read
      pull-requests: read
      actions: write
    uses: Morrison-Lab/gha/.github/workflows/ai-code-review.yml@v2
    secrets:
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
    with:
      pr-number: ${{ inputs.pr_number }}
    # with:
    #   agents: 'claude, gemini'
    #   claude-review-workflow-file: claude-code-review.yml
    #   gemini-review-workflow-file: gemini-code-review.yml

See the examples/ directory for the full caller stub (ai-code-review.yml).