chore(ci): bump codeql-action init+analyze to v4.37.9 together #655
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: opencode-review | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| jobs: | |
| review: | |
| # Third-party AI review is supplemental; Dependabot updates need no review and | |
| # provider quota failures must not block the protected CI signal. | |
| if: github.actor != 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| steps: | |
| # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| persist-credentials: false | |
| # Pinned to the `latest` tag as of 2026-08 (anomalyco/opencode@latest) | |
| # SHA: 2c14fc5586fe0b88e5c04732d2e846769cc35671 | |
| - uses: anomalyco/opencode/github@2c14fc5586fe0b88e5c04732d2e846769cc35671 | |
| continue-on-error: true | |
| env: | |
| # DeepSeek API key. Get one at https://platform.deepseek.com/api_keys | |
| DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| # DeepSeek provider/model. Other options: deepseek/deepseek-v4-flash | |
| model: deepseek/deepseek-v4-pro | |
| use_github_token: true | |
| prompt: | | |
| Review this pull request for the openElement project: | |
| - Check for code quality issues, potential bugs, and regressions. | |
| - Look for over-engineering, unnecessary abstractions, and unused code. | |
| - Verify TypeScript types, ESM imports, and Deno conventions. | |
| - Suggest concrete improvements with line-specific comments when possible. | |
| - Keep the summary brief; prioritize bugs > readability > style > nits. |