Codebase Argus Action

Run an evidence-first Codebase Argus review from a GitHub Actions workflow. The default pass is deterministic and read-only: it reads pull request metadata, files, and check runs, then writes a Markdown report to the job summary. It does not post comments or change the pull request.

First review

Create .github/workflows/codebase-argus.yml in the repository you want to review:

name: Codebase Argus

on:
  pull_request:

permissions:
  contents: read
  pull-requests: read
  checks: read

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: AaronZ345/codebase-argus-action@v1
        with:
          pull-request: ${{ github.repository }}#${{ github.event.pull_request.number }}

Open the workflow run and read the result in its job summary. No model key is needed for this path.

Review modes

Mode	What it reads	Result
review	PR metadata, patch, checks, and optional policy	Evidence-backed risk review
ci-github	Failing GitHub Actions job logs	CI failure diagnosis
autofix-plan	PR files and deterministic findings	A gated branch plan; no changes are applied

For failing CI diagnosis:

- uses: AaronZ345/codebase-argus-action@v1
  with:
    pull-request: ${{ github.repository }}#${{ github.event.pull_request.number }}
    mode: ci-github

Agent providers

Set provider to openai-api, anthropic-api, or gemini-api and expose the matching API key to the step environment. Local CLI providers are intended for self-hosted runners where that CLI is already installed.

- uses: AaronZ345/codebase-argus-action@v1
  with:
    pull-request: ${{ github.repository }}#${{ github.event.pull_request.number }}
    provider: openai-api
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

Use tribunal for a comma-separated multi-provider pass, for example openai-api,anthropic-api. Provider failures stay visible in the report instead of being silently discarded.

Inputs

Input	Default	Notes
pull-request	required	owner/repo#123 or a GitHub PR URL
mode	review	review, ci-github, or autofix-plan
provider	rule-based	Deterministic or agent-backed reviewer
tribunal	empty	Comma-separated provider list
policy	empty	Review policy path relative to the caller workspace
timeout-ms	120000	Agent-provider timeout
core-ref	v0.2.0	Pinned Codebase Argus release or commit
github-token	workflow token	Used only through the environment, never a CLI argument

The report-path output points to the generated Markdown file for later steps in the same job.

Security model

• The action is read-only and does not persist checkout credentials.
• The workflow token is passed through GITHUB_TOKEN, not the process argument list.
• The core implementation is pinned with core-ref; set it to a full commit SHA if your policy requires immutable dependencies.
• Automatic comments and code changes are intentionally outside this action.

The core project, CLI documentation, and a reproducible public-PR case study live in Codebase Argus.