Code review

The TeXRA Code Review GitHub Action posts a pull request review on each PR: a short summary at the top, and inline comments on the lines TeXRA wants to flag.

It runs from your own GitHub Actions environment, using model provider API keys you put in your repo's secrets. Your code and diffs are not sent through any TeXRA service; only a GitHub-signed workload identity is exchanged for a short-lived TeXRA GitHub App token.

This page walks through the whole setup from zero; no prior GitHub Actions experience is needed. Short version: from the repo, run texra install-github-action, then set one provider API key secret.

What you'll see on a PR

Once installed, every PR gets a single review from texra-ai-bot[bot]: a summary comment at the top with TeXRA's overall verdict, plus inline comments on the lines it wants to question. On the next push to the same PR, TeXRA updates those same threads instead of posting duplicates.

github-actionsbotreviewed2 hours ago

TeXRA Code Review

Changes requested

2 issues worth a look, otherwise looks good. The new summarize() path needs an empty-input guard before it indexes, and one log line leaks a token.

src/agent/summarize.ts

41export function summarize(items) {

42  const first = items[0].text;

43  return first.slice(0, 80);

github-actions[bot] Updated on re-push

Guard against the empty-array case here — items[0] throws when items is []. Return early or default the slice.

Reply to this thread…

One review per PR: a top-level verdict plus inline comments pinned to the flagged lines, refreshed in place on the next push.

How it works

If you have not used GitHub Actions before, here is the whole picture:

• GitHub Actions is GitHub's built-in automation service. You describe a job in a YAML file inside your repo (under .github/workflows/), and GitHub runs it on its own servers whenever the trigger you chose fires. Here, that is whenever a pull request is opened or updated.
• The job checks out your PR and asks an AI model to review the diff. It installs the TeXRA CLI, feeds it the pull request diff plus any files the model wants to read, and posts the result back as a normal GitHub review.
• The model call uses your API key, stored as an encrypted repository secret. The diff travels directly from GitHub's runner to your model provider (Anthropic, OpenAI, Google, …). There is no TeXRA server in the middle, and no TeXRA account or sign-in is needed.
• Cost: each review is one ordinary API call billed to your key by the provider. The price depends on the model you pick and the size of the diff. For typical PRs it is small, but very large diffs on premium models cost more.

What you need

• A GitHub repository you administer, with Actions enabled (default on GitHub).
• The TeXRA CLI installed locally (npm i -g @texra-ai/cli), plus gh authenticated for opening the workflow PR (gh auth login).
• An API key from at least one model provider. Prefer open-weight options when you can (DeepSeek, OpenRouter); Anthropic, OpenAI, Google, and xAI also work.

Setup

Quick setup (recommended)

From a clone of the repository you want TeXRA to review:

texra install-github-action

That command:

1. Opens the TeXRA GitHub App installer so you can grant access to the repo (reviews then post as texra-ai-bot[bot]).
2. Writes .github/workflows/texra-code-review.yml on a branch.
3. Pushes and opens a pull-request page for you to create (or use --no-pr to stop after committing locally).

Next, set one provider API key as a repository secret so the model can run. Prefer an open-weight option when you can:

gh secret set DEEPSEEK_API_KEY

(Or OPENROUTER_API_KEY, GOOGLE_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, or XAI_API_KEY; names must match exactly. The action also accepts MOONSHOT_API_KEY, DASHSCOPE_API_KEY, MINIMAX_API_KEY, and GLM_API_KEY, but the scaffolded workflow only wires the first six, so for those you add the matching moonshot-api-key, dashscope-api-key, minimax-api-key, or glm-api-key input to the review step yourself.)

Merge the install PR to your default branch. From then on, same-repo PRs get a TeXRA review. Open the PR checks (or the repo Actions tab) and select TeXRA Code Review to watch a run.

TIP

You must be able to install GitHub Apps on the repository and to add Actions secrets. If gh pr create --web fails with a workflow-scope error, run gh auth refresh -h github.com -s workflow and retry.

Forks don't get reviewed

PRs opened from a fork are not reviewed. GitHub deliberately does not share your repo secrets with forks, so the workflow has nothing to talk to the model provider with and exits quietly. If a contributor needs a TeXRA review, push their branch into your repo (or to a topic branch you control) and reopen the PR from there.

Manual setup

Use this when you cannot run the CLI, when the installer fails, or when you want to review every YAML line yourself.

1. Install the TeXRA GitHub App on the repository.
2. Add a provider API key under Settings → Secrets and variables → Actions (see the secret names in Quick setup).
3. Add .github/workflows/texra-code-review.yml from the texra-ai/texra-action examples (start with pr-review.yml), commit it to the default branch, and open a test PR.

The workflow needs permissions.id-token: write so the action can exchange a GitHub Actions OIDC token for a short-lived App installation token. Leave github-token unset unless you intentionally override App auth.

Pin the action version for reproducible CI

@v1 tracks the latest v1.x release. To change review behavior only when you decide, pin a reviewed release commit (uses: texra-ai/texra-action/review@<full-commit-sha>) and bump it deliberately.

Picking a model

You can skip this section. By default TeXRA picks a model for whichever provider key you set, trying providers in this order: DeepSeek → Anthropic → OpenAI → Google → OpenRouter → xAI → Moonshot → DashScope → MiniMax → GLM.

The built-in defaults:

Provider	Default model
DeepSeek	deepseekproT
Anthropic	opus48T
OpenAI	gpt55
Google	gemini31p
OpenRouter	gptoss
xAI	grok4
Moonshot	kimi26T
DashScope	qwenplus
MiniMax	minimaxM27
GLM	glm51

xAI users

The action's xAI default, grok4, is retired in the current CLI and cannot be selected, so an xAI-only setup fails until the action's default is updated. Set TEXRA_REVIEW_MODEL to a current model such as grok46 or grok45, or set TEXRA_REVIEW_MODEL_DEFAULTS to {"xai":"grok46"}, and wire the variable through as described below.

To override, add a repo variable: the same place as secrets, but the Variables tab (Settings → Secrets and variables → Actions → Variables → New repository variable). Variables are plain, non-secret settings:

• TEXRA_REVIEW_MODEL: pin one model id for every review, regardless of provider.
• TEXRA_REVIEW_MODEL_DEFAULTS: JSON map from provider id to default model id, used when you want provider-specific defaults. Example: {"deepseek":"deepseekproT","anthropic":"opus5T"}. This explicitly opts Anthropic reviews into Opus 5; the action's built-in default remains opus48T.

The scaffolded workflow does not pass either variable yet: the model input is present only as a commented-out line, and there is no model-defaults input. Wire them through under the review step's with: block:

model: ${{ vars.TEXRA_REVIEW_MODEL }}
model-defaults: ${{ vars.TEXRA_REVIEW_MODEL_DEFAULTS }}

An unset variable expands to an empty string, which the action treats as "use the default".

Migrating from older setups

Older per-provider variables such as TEXRA_REVIEW_DEEPSEEK_MODEL are no longer read by the external action. Move those values into TEXRA_REVIEW_MODEL_DEFAULTS.

Writing your own review prompt

By default, the action reviews with its bundled general-purpose prompt. If you want reviews tailored to your project ("focus on the math", "enforce our naming conventions", "be terse"), you can supply your own prompt file that replaces the bundled one.

There is one security rule to understand first: read the prompt from the trusted base branch, not from the PR being reviewed. The prompt is the reviewer's instructions. If the workflow read it from the PR's own checkout, any PR could rewrite the instructions (for example to "approve everything") before being reviewed. The pattern below checks the prompt out from the PR's base commit, so a PR can propose prompt changes but they only take effect after they are merged.

1. Add your prompt at .github/prompts/texra-code-review-prompt.md on your default branch. Start from the bundled prompt in texra-ai/texra-action and edit the review-focus parts. The prompt file fully replaces the bundled instructions, so keep the parts describing the expected JSON review output intact.

2. In the workflow, add a second checkout step after "Checkout pull request":

   - name: Checkout trusted review prompt
     if: steps.keys.outputs.present == 'true' && steps.merge-ref.outputs.available == 'true'
     uses: actions/checkout@v6
     with:
       ref: ${{ github.event.pull_request.base.sha }}
       path: .trusted-review-prompt
       sparse-checkout: .github/prompts/texra-code-review-prompt.md
       sparse-checkout-cone-mode: false
       persist-credentials: false

3. Point the review step at the trusted copy by adding one input:

   prompt-file: .trusted-review-prompt/.github/prompts/texra-code-review-prompt.md

To go back to the bundled prompt, remove the prompt-file input and the extra checkout step.

Pinning the TeXRA CLI version

By default the workflow installs the latest published texra CLI on each run. To pin a specific version (for example, for reproducibility), add a texra-version input to the review step. The scaffolded workflow carries it as a commented-out example; uncomment it with a literal version, or read it from a repository variable:

texra-version: ${{ vars.TEXRA_CLI_VERSION }}

Then set TEXRA_CLI_VERSION to the version you want: 0.40.3, latest, or empty for latest. The action supports @texra-ai/cli 0.40.3 and newer.

Everyday controls

Pausing reviews

Set the repository variable TEXRA_REVIEW_ENABLED to false to pause TeXRA reviews without removing the workflow file. Set it back to anything else (or unset it) to resume.

Letting TeXRA resolve its own threads

With resolve-threads: 'true' on the review step (as in the richer examples under texra-ai/texra-action), the TeXRA GitHub App can resolve fixed findings and reply to earlier threads under the same bot identity. No personal access token is needed.

Choosing whose PRs get reviewed

require-write-access: 'true' limits reviews to PRs authored by users with write access, so outside accounts cannot spend your API budget. Allow-list trusted bots with allow-bots (comma-separated), for example dependabot[bot].

Troubleshooting

My PR didn't get a review

Work down this checklist; each item maps to a quiet skip:

1. Is the workflow on the default branch? PRs only trigger it once .github/workflows/texra-code-review.yml exists on your default branch (usually main), or the PR itself contains it.
2. Is the PR from a fork? Fork PRs are skipped because secrets are not shared with forks (see the warning above).
3. Is the secret named exactly right? A typo like ANTHROPIC_KEY means no key is found; the run logs a "no model provider API key" notice and skips.
4. Does the PR have a merge conflict? GitHub cannot produce a merge preview for conflicted PRs, so there is nothing to review. Resolve the conflict and push.
5. Is TEXRA_REVIEW_ENABLED set to false? Unset it or set it to true.
6. Does the PR author have write access? With require-write-access enabled, PRs from non-writers (and non-allow-listed bots) are skipped.

In every case the Actions tab shows the run (or its absence) and a notice explaining the skip.

The check failed

If the model provider or CLI run fails, the action fails the workflow check instead of posting a fallback review. Treat that failed check as the signal that no review was completed. Open the run log from the Actions tab to see the error. Common causes are an expired or out-of-credit API key and provider outages. Use Re-run failed jobs on the run page to try again.

Common questions

Where does my code go? From GitHub's runner directly to the model provider your key belongs to, and nowhere else. No TeXRA service sees your code or diffs.

What does it cost? Whatever your provider charges for the tokens in the review call, billed to your API key like any other usage. No TeXRA account or subscription is involved.

Can I add keys for several providers? Yes. TeXRA uses the first available provider in its default order (DeepSeek → Anthropic → OpenAI → Google → OpenRouter → xAI → Moonshot → DashScope → MiniMax → GLM), or exactly what you pin via TEXRA_REVIEW_MODEL.

Next steps

• TeXRA CLI: the texra command the action runs.
• Built-in agents: what the review agent checks.