Automated Application Security code review on Pull Request changes only.
Runs in under 2 minutes and posts a concise, actionable comment back to the PR.

• Reviews only changed hunks — fast and relevant
• Identifies risks: injection, secrets, auth/z gaps, insecure configs
• Structured output: Risk summary, findings, safeguards checklist
• Works with OpenAI, OpenRouter, or any ChatGPT-compatible endpoint

• contents: read — fetch PR diff
• pull-requests: write — update a single comment

name: Secure Code Review
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: DevSecOps-AppSec/ai-secure-code-review-action@v1.0.2
        with:
          openai_api_key: ${{ secrets.OPENAI_API_KEY }}
          model: gpt-4o-mini
          time_budget_seconds: 90
          max_files: 20
          max_lines: 1000