Add multi-provider code review to GitHub Action #7404

keithah · 2026-01-09T01:42:38Z

Summary

Run parallel reviews with multiple free opencode providers
Synthesize results into comprehensive code review
Add configurable provider list via REVIEW_PROVIDERS env var
Include error handling and timeout management
Add documentation for the feature

Changes

Created github/multi-review.ts script to handle parallel reviews
Modified .github/workflows/review.yml to use multiple providers
Added github/MULTI_REVIEW.md documentation

Providers Used

opencode/big-pickle - Large reasoning model
opencode/grok-code - Code-specialized model
opencode/minimax-m2.1-free - Free tier model
opencode/glm-4.7-free - Free GLM model

Benefits

Comprehensive Reviews: Multiple perspectives catch different issues
Redundancy: If one provider fails, others continue
Cost Efficiency: Uses free providers
Quality Synthesis: Combines the best insights from all reviews

- Run parallel reviews with multiple free opencode providers - Synthesize results into comprehensive code review - Add configurable provider list via REVIEW_PROVIDERS env var - Include error handling and timeout management - Add documentation for the feature Providers: big-pickle, grok-code, minimax-m2.1-free, glm-4.7-free

github-actions · 2026-01-09T01:42:47Z

Hey! Your PR title Add multi-provider code review to GitHub Action doesn't follow conventional commit format.

Please update it to start with one of:

feat: or feat(scope): new feature
fix: or fix(scope): bug fix
docs: or docs(scope): documentation changes
chore: or chore(scope): maintenance tasks
refactor: or refactor(scope): code refactoring
test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

github-actions · 2026-01-09T01:43:39Z

The following comment was made by an LLM, it may be inaccurate:

No duplicate PRs found

Copilot

Pull request overview

This PR adds a multi-provider code review feature to the GitHub Action that runs parallel reviews with multiple free AI providers and synthesizes the results into a comprehensive review.

Key changes:

Created a new TypeScript script that orchestrates parallel code reviews across multiple AI providers
Modified the GitHub workflow to use environment-based configuration for provider selection
Added comprehensive documentation for the multi-provider review feature

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 14 comments.

File	Description
github/multi-review.ts	New script implementing parallel review execution, error handling, and synthesis logic
.github/workflows/review.yml	Updated workflow to configure and invoke multi-provider reviews via environment variables
github/MULTI_REVIEW.md	Documentation explaining the feature, configuration, and usage

Comments suppressed due to low confidence (1)

.github/workflows/review.yml:64

Missing input validation: The PR_BODY variable (from jq output) and PR_TITLE are directly interpolated into the REVIEW_PROMPT environment variable without validation or escaping. If these contain double quotes or other special characters, they could break the shell script or cause unexpected behavior when passed to the multi-review.ts script.

          PR_BODY=$(jq -r .body pr_data.json)
          PR_NUMBER="${{ steps.pr-number.outputs.number }}"

          export REVIEW_PROMPT="A new pull request has been created: '${PR_TITLE}'

          <pr-number>
          $PR_NUMBER
          </pr-number>

          <pr-description>
          $PR_BODY

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-09T01:52:01Z

github/multi-review.ts

+    return {
+      provider,
+      output: `Error: Review failed for ${provider}`,
+    }


Poor error handling design: When a review fails, the function returns a ReviewResult with output set to a generic error message string. This makes it impossible for callers to distinguish between a successful review that happened to output "Error: Review failed..." and an actual failure. Consider adding an error field to the ReviewResult type or using a discriminated union to properly distinguish between success and failure cases.

Copilot · 2026-01-09T01:52:02Z

github/multi-review.ts

+    const result = execSync(`opencode run -m ${provider} -- "${REVIEW_PROMPT}"`, {
+      encoding: "utf8",
+      timeout: 300000, // 5 minutes timeout
+    })


Potential buffer overflow: The execSync call doesn't specify a maxBuffer option, which defaults to 1MB. Code reviews could potentially produce output larger than this limit, causing the command to fail with a "maxBuffer exceeded" error. Consider adding a maxBuffer option (e.g., maxBuffer: 10 * 1024 * 1024 for 10MB) to handle larger outputs.

Copilot · 2026-01-09T01:52:02Z

github/multi-review.ts

+Please provide the synthesized review:`
+
+  try {
+    const synthesisResult = execSync(`opencode run -m opencode/big-pickle -- "${synthesisPrompt}"`, {


Command injection vulnerability: The synthesisPrompt is directly interpolated into a shell command without proper escaping. The aggregated reviews may contain user-controlled content (from PR descriptions, code, etc.) that could include shell metacharacters, leading to command injection. Use array-based command execution or properly escape the prompt.

Copilot · 2026-01-09T01:52:02Z

github/multi-review.ts

+  console.log(`Starting review with provider: ${provider}`)
+
+  try {
+    const result = execSync(`opencode run -m ${provider} -- "${REVIEW_PROMPT}"`, {


Potential command injection vulnerability: The provider variable is directly interpolated into a shell command. While REVIEW_PROVIDERS comes from a controlled environment variable, if it contains shell metacharacters, it could break the command or lead to unintended execution. Consider validating the provider format or using array-based command execution.

Copilot · 2026-01-09T01:52:03Z

github/multi-review.ts

+
+  process.stdout.write(synthesis)


Code duplication: The synthesis output is logged twice - once via console.log and once via process.stdout.write. The process.stdout.write on line 89 appears to duplicate the console.log on line 87. Consider removing the redundant output or clarifying if both are needed for different purposes.

Suggested change

process.stdout.write(synthesis)

Copilot · 2026-01-09T01:52:04Z

github/multi-review.ts

+  try {
+    const result = execSync(`opencode run -m ${provider} -- "${REVIEW_PROMPT}"`, {
+      encoding: "utf8",
+      timeout: 300000, // 5 minutes timeout
+    })
+    return {
+      provider,
+      output: result,
+    }
+  } catch (error) {
+    console.error(`Error running review with ${provider}:`, error)
+    return {
+      provider,
+      output: `Error: Review failed for ${provider}`,
+    }
+  }


Code style violation: The code uses try/catch blocks extensively, which goes against the project's style guide that states "AVOID try/catch where possible". Consider handling errors through return values or other patterns consistent with the project's style.

Copilot · 2026-01-09T01:52:04Z

github/multi-review.ts

+
+const REVIEW_PROVIDERS = process.env.REVIEW_PROVIDERS?.split(",").map((p) => p.trim()) || []
+const REVIEW_PROMPT = process.env.REVIEW_PROMPT || ""
+// ANTHROPIC_API_KEY is optional for testing


Misleading or outdated comment: The comment states "ANTHROPIC_API_KEY is optional for testing" but this variable is not used anywhere in this file. The multi-review.ts script uses opencode providers, not Anthropic. This comment should be removed or updated to reflect the actual usage.

Suggested change

// ANTHROPIC_API_KEY is optional for testing

Copilot · 2026-01-09T01:52:05Z

github/MULTI_REVIEW.md

+- Running parallel reviews with error handling
+- 5-minute timeout per provider
+- Graceful fallback if a provider fails
+- Synthesis using the first provider in the list


Misleading documentation: The documentation states "Synthesis using the first provider in the list", but the code hardcodes "opencode/big-pickle" for synthesis (line 65 of multi-review.ts) rather than using REVIEW_PROVIDERS[0]. While these happen to match in the current configuration, if someone changes the provider list order or removes big-pickle, the synthesis would still try to use big-pickle. Either update the code to use REVIEW_PROVIDERS[0] or clarify the documentation to state the specific hardcoded provider.

Suggested change

- Synthesis using the first provider in the list

- Synthesis using the dedicated `opencode/big-pickle` provider

Copilot · 2026-01-09T01:52:05Z

github/multi-review.ts

+  console.log(`Running reviews with ${REVIEW_PROVIDERS.length} providers: ${REVIEW_PROVIDERS.join(", ")}`)
+  console.log(`Prompt length: ${REVIEW_PROMPT.length} characters`)
+
+  const results = await Promise.all(REVIEW_PROVIDERS.map((provider) => runReview(provider)))


Potential performance issue: Running 4 parallel reviews with Promise.all could cause rate limiting issues or excessive resource consumption. Each review has a 5-minute timeout, and if all fail slowly, this could take up to 5 minutes. Consider adding configuration for maximum concurrency or implementing sequential execution with a configurable parallelism limit.

Copilot · 2026-01-09T01:52:06Z

github/multi-review.ts

+// ANTHROPIC_API_KEY is optional for testing
+
+if (REVIEW_PROVIDERS.length === 0) {
+  console.error("REVIEW_PROVIDERS not set")


Unhelpful error message: The error message "REVIEW_PROVIDERS not set" doesn't provide guidance on how to fix the issue or what format is expected. Consider adding more context, such as "REVIEW_PROVIDERS environment variable must be set to a comma-separated list of provider models (e.g., 'opencode/big-pickle,opencode/grok-code')".

Suggested change

console.error("REVIEW_PROVIDERS not set")

console.error(

"REVIEW_PROVIDERS environment variable must be set to a comma-separated list of provider models (e.g., 'opencode/big-pickle,opencode/grok-code').",

)

fwang and others added 5 commits January 8, 2026 19:44

wip: zen

a32bedb

wip: zen

53a1e49

wip: black

137c66a

chore: generate

fa8881d

Copilot AI review requested due to automatic review settings January 9, 2026 01:42

github-actions bot added the needs:title label Jan 9, 2026

Copilot started reviewing on behalf of keithah January 9, 2026 01:43 View session

Copilot AI reviewed Jan 9, 2026

View reviewed changes

Add multi-review-script.ts for GitHub Actions

d71e4b2

fwang force-pushed the dev branch from 4da2998 to a618fbe Compare January 9, 2026 06:32

	- Synthesis using the first provider in the list
	- Synthesis using the dedicated `opencode/big-pickle` provider

Add multi-provider code review to GitHub Action #7404

Are you sure you want to change the base?

Add multi-provider code review to GitHub Action #7404

Uh oh!

Conversation

keithah commented Jan 9, 2026

Summary

Changes

Providers Used

Benefits

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

github-actions bot commented Jan 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants