lambdaclass/actions

Reusable GitHub Actions workflows for the lambdaclass organization.

AI Code Review Workflows

Automated PR code review using various AI providers. Each workflow posts review comments directly on pull requests.

Available Workflows

Workflow	Provider	Model
ai-review-kimi.yml	Moonshot AI	kimi-k2.6
ai-review-codex.yml	OpenAI	gpt-5.4
ai-review-claude.yml	Anthropic	sonnet

Quick Start

1. Add the required secret to your repository (Settings > Secrets and variables > Actions):

   • KIMI_API_KEY for Kimi
   • OPENAI_API_KEY for Codex
   • ANTHROPIC_API_KEY for Claude

2. Create a workflow file in your repo at .github/workflows/ai-review.yml:

name: AI Code Review

on:
  pull_request:
    types: [opened, ready_for_review]
  issue_comment:
    types: [created]

jobs:
  claude-review:
    uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@v1
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

On-Demand Reviews

Trigger reviews by commenting on a PR:

• /kimi - Trigger Kimi review
• /codex - Trigger Codex review
• /claude - Trigger Claude review

Note: Slash commands require write access to the repository.

Custom Prompts

You can customize the review prompt in three ways (in order of priority):

1. prompt input - Pass a custom prompt directly in the workflow
2. .github/prompts/ai-review.md - Create this file in your repo with custom instructions
3. Default prompt - Generic security/bugs/performance review

When a custom prompt is used, the review footer will show "· custom prompt".

Example: Custom prompt file

Create .github/prompts/ai-review.md in your repository:

You are a DevOps-focused code reviewer.

Review the pull request changes with special attention to:
1. **Infrastructure security** - AWS credentials, secrets exposure, IAM permissions
2. **CI/CD reliability** - Workflow syntax errors, missing error handling
3. **Terraform/IaC issues** - State management, resource naming, cost implications

Guidelines:
- Be concise and actionable
- Reference specific file names and line numbers
- Only flag real issues, not style preferences
- If no issues found, say "LGTM from DevOps perspective"

Workflow Options

Kimi (ai-review-kimi.yml)

jobs:
  kimi-review:
    uses: lambdaclass/actions/.github/workflows/ai-review-kimi.yml@v1
    secrets:
      KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
    with:
      model: 'kimi-k2.6'               # Kimi model
      thinking: 'disabled'             # 'disabled', 'enabled', or '' to omit
      max_diff_lines: 10000            # Max lines of diff to review
      max_tokens: 4096                 # Max response tokens
      temperature: ''                  # '' omits it; Kimi pins temperature per model
      prompt: ''                       # Custom prompt (overrides prompt file)

Codex (ai-review-codex.yml)

jobs:
  codex-review:
    uses: lambdaclass/actions/.github/workflows/ai-review-codex.yml@v1
    secrets:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
    with:
      model: 'gpt-5.4'                 # Codex model
      safety_strategy: 'drop-sudo'     # Codex safety strategy
      max_diff_lines: 10000            # Advisory: agent can regenerate the diff
      timeout_minutes: 20              # Cancel the review job after this long
      prompt: ''                       # Custom prompt (overrides prompt file)

Two caveats on the Codex failure notice.

max_diff_lines bounds what is written to /tmp/pr_diff.txt, but the agent has the repository checked out at fetch-depth: 0 and can regenerate the full diff with git diff. Treat it as advisory. The kimi input of the same name is a hard cap, because there the diff is the request payload.

The workflow comments whenever the review job does not report for itself, and a cancel is a cancel: if a consumer sets concurrency: cancel-in-progress: true, every superseded run posts a "did not complete" comment. No Actions expression distinguishes a timeout-cancel from a concurrency-cancel.

A review that does not happen now fails the run, in both ai-review-codex.yml and ai-review-kimi.yml -- an empty model response is red, not a green run with an explanatory comment. The comment is still posted first. If you gate merges on these workflows, note that a provider outage will now block, where previously it passed.

Claude (ai-review-claude.yml)

jobs:
  claude-review:
    uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@v1
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    with:
      model: 'sonnet'                 # sonnet, opus, or haiku
      max_turns: 30                   # Max agentic turns
      allowed_tools: '...'            # Allowed Claude tools
      prompt: ''                       # Custom prompt (overrides prompt file)

Default Review Focus

All workflows use a default prompt that focuses on:

1. Security vulnerabilities - Labeled by criticality (Critical/High/Medium/Low)
2. Bugs - Logic errors, edge cases, incorrect behavior
3. Significant performance issues - Only obvious problems like O(n²) loops

Using Multiple Reviewers

You can run multiple AI reviewers in parallel:

name: AI Code Review

on:
  pull_request:
    types: [opened, ready_for_review]
  issue_comment:
    types: [created]

jobs:
  kimi:
    uses: lambdaclass/actions/.github/workflows/ai-review-kimi.yml@v1
    secrets:
      KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}

  codex:
    uses: lambdaclass/actions/.github/workflows/ai-review-codex.yml@v1
    secrets:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

  claude:
    uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@v1
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Security

• Fork protection: Reviews will not run on PRs from forks (to protect secrets)
• Access control: Slash commands only work for users with write access

Versioning

Pin to a release tag (e.g., @v1) or a specific commit SHA:

uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@v1

Contributing

1. Create a branch
2. Make changes
3. Test in a real repo using @your-branch
4. Open a PR

License

MIT