ReviewGround v1.7.0 — 100k Token Diff Budget & Universal Anti-Bikeshedding Engine

🚀 ReviewGround v1.7.0 Release Notes

ReviewGround v1.7.0 expands PR diff analysis capacity for modern LLMs, eliminates subjective syntactic flip-flopping across commits, and enhances visual architecture diagrams.

---

🌟 What's New in v1.7.0

1. 📦 Massive 100k Token PR Diff Budget (Default: 400,000 Characters)

• Previous Ceiling: Diff analysis was constrained to ~28,000 characters (~7,000 tokens), causing multi-file PRs (>30k tokens) to drop standard application files with [P1 — too large for remaining budget].
• New Dynamic Budget: Default diff capacity is now 100,000 tokens (~400,000 characters), fully leveraging modern context windows (Gemini 2.5 Flash, Claude 3.5 Sonnet, GPT-4o).
• Configurable Action Inputs:
  • max-diff-tokens: Default 100000 (100k tokens).
  • max-diff-chars: Default 400000 (overrides max-diff-tokens if explicitly set).
• Zero Configuration Required: All PRs automatically inherit the 100k token ceiling without touching existing .github/workflows/ files.

- uses: arungupta1526/ReviewGround@v1
  with:
    # Optional override (default is already 100,000 tokens):
    max-diff-tokens: 150000

2. 🛡️ Universal Anti-Bikeshedding & Syntactic Ping-Pong Prevention

• The Problem: In iterative PRs with multiple commits, LLMs often oscillate between functionally equivalent syntax (e.g. Run 1: "Use Promise .then().catch()", Run 2: "Use .finally()", Run 3: "Use async try/finally").
• The Solution: Introduces an invariant Anti-Syntactic Churn Rule into the core prompt:

  "Never suggest refactoring between valid, functionally equivalent syntax (e.g. switching between async/await vs Promise chaining, loops vs .map/.forEach, if/else vs ternary, arrow vs function declaration, type vs interface) unless you can prove a concrete bug, race condition, memory leak, or security vulnerability. If the existing code is working and idiomatic, DO NOT touch it."

• Dramatically increases review signal-to-noise ratio and eliminates developer frustration.

3. 📊 Autonumbered Mermaid Sequence Diagrams

• Directs AI reviewer models to include autonumber on architecture sequence diagrams, rendering clean, sequential step-by-step numbers on multi-component workflows (client -> API -> database).

4. ⚡ Streamlined Diff Bounds & Branching Optimization

• Refactored diff bounds checking in runReview to evaluate diff.length > maxDiffBudget upfront.
• Raw diffs within budget pass through directly without redundant slicing, memory allocation, or dead conditional branches.

---

🧪 Quality Verification

• 100% Pass Rate: 108 unit tests across 20 test suites.
• Zero Runtime Dependencies: Pre-compiled production bundle (dist/index.js) targeting Node 24 LTS.
• Marketplace Compatibility: action.yml metadata certified under marketplace character limits.

---

Full Changelog: v1.6.1...v1.7.0

v1.6.1

1.6.1 (2026-10-30)

Bug Fixes

• reviewer: auto-heal repeated mermaid sequence arrows, flowchart bleed, and syntax errors (d214e59)
• reviewer: auto-heal repeated mermaid sequence arrows, flowchart bleed, and syntax errors (9d97f6b)

ReviewGround v1.6.0 — Live In-Progress CI Timeline, True PR Commit SHA & Mermaid Self-Healer

🚀 ReviewGround v1.6.0 Release

Universal AI Code Reviewer & Post-CI Verification GitHub Action with Multi-Provider BYOK, Live Registry Search Grounding, 1-Click Suggestions, Sticky Comments, and Live Timeline Progress.

ReviewGround v1.6.0 introduces immediate t=0 in-progress feedback on commit pushes, automated history collapsing for previous CI runs, true PR commit SHA resolution, strict conversational prefix gating for slash commands, deep-linked action runs, and LLM Mermaid syntax self-healing.

---

🌟 Highlights & Major Features

1. ⏳ Live In-Progress CI Verification Timeline (src/github/comments.ts, src/summary.ts)

• Immediate Push Feedback: When developers push a new commit to an active PR, ReviewGround updates the sticky comment at t=0 with ⏳ Commit <sha> pushed — CI verification pipeline is in progress....
• Automatic History Collapsing: Automatically wraps previous CI verification results under a clean <details><summary>📜 Previous CI Verification Results (X runs)</summary>...</details> block so reviewers can immediately see active status without losing previous run history.
• Stage-by-Stage Progression: Live status transitions seamlessly from in-progress to fully verified once tests and audits complete.

2. 🔍 True Head Commit SHA Resolution from Event Payload (src/index.ts)

• Eliminated Merge Commit Ambiguity: Solved the GitHub Actions quirk where GITHUB_SHA on pull_request triggers points to the ephemeral test merge commit (refs/pull/<pr>/merge).
• Precision Extraction: Surgically parses eventData.pull_request?.head?.sha from $GITHUB_EVENT_PATH with fallback to GITHUB_SHA, accurately attributing comments and cost history to the developer's actual commit.
• Configurable Input: Added commit-sha input in action.yml for manual workflow overrides.

3. 💬 Strict startsWith Slash Command Prefix Guard (src/slashCommands.ts, .github/workflows/reviewground-slash.yml)

• Zero Accidental Token Consumption: Incidental conversational mentions in PR discussions (e.g., "Maine @reviewground ka suggestion check kiya...") no longer trigger unintended workflow runs or LLM API calls.
• Anchored Parsing: Regex patterns in parseSlashCommand and extractChatQuery now strictly require command prefixes (@reviewground, /review, @review) to appear at the start of a comment or line (^).
• Workflow Filter Parity: Updated GitHub Actions issue_comment trigger condition from contains(...) to startsWith(...).

4. ⚡ Two-Stage Review & Post-CI Pipeline Architecture (.github/workflows/test.yml)

• Instant AI Review: Split the workflow so reviewground-review triggers at t=0 in parallel with security audits, typechecks, and tests, delivering inline AI review suggestions in seconds.
• Post-CI Verification Gate: Stage 5 reviewground-summary executes after all test jobs pass, updating the sticky comment with stage execution durations, audit statuses, and cost breakdown.

5. 🛡️ Dependency Security Hardening & Node LTS Engine Baseline (package.json)

• Audit Remediation: Bumped undici override to ^6.29.1 resolving high-severity Denial of Service advisories (GHSA-4qv8-2p9j-2685, GHSA-xjj6-f33q-929c).
• Node LTS Engine: Upgraded engine baseline to "node": ">=24.22.1" matching modern Node 24 runtime environments.

6. 🔗 Deep-Linked Actions Runs & Markdown Collision Defense (src/summary.ts)

• One-Click Run Navigation: Formatted run numbers as direct entity links ([Run #1](https://github.com/.../actions/runs/...)) in cost history and execution tables.
• GFM Autolink Escaping: Escaped standalone run numbers (Run #1) preventing GitHub Flavored Markdown from mistakenly autolinking to unrelated issues/PRs.
• Nested Backtick Sanitization: Hardened AI agent prompt blocks with safe delimiter fences to prevent backtick markdown collisions.

7. 🩹 Robust LLM Mermaid Diagram Glitch Healer (src/reviewer.ts)

• Syntax Glitch Recovery: Auto-heals common LLM Mermaid syntax glitches (e.g., malformed arrows like ->, -->> in sequence diagrams).
• Unclosed Block Recovery: Automatically detects and closes dangling Mermaid code fences, preventing malformed PR comment rendering.
• Reasoning Model Headroom: Raised max-tokens headroom for thinking/reasoning models (DeepSeek, Gemini Flash Thinking).

8. 📌 Configurable Sticky Comment Toggle (action.yml, src/github/comments.ts)

• Added sticky-comment: true|false action input allowing teams to choose between single sticky PR comments or individual commit-by-commit timeline review comments.

---

📦 Detailed Conventional Commit Changelog

### Features
• summary: track commit sha and show in-progress state on new commits (463994b)
• comments: add configurable sticky-comment toggle for commit-by-commit timeline (5ebacae)
• ci(workflow): split reviewground into instant review and post-ci summary stages (5de5e6b)

### Bug Fixes
• slash: trigger PR comment commands only on startswith prefix (da9e45e, 221fcdb)
• deps: bump undici override to 6.29.1 and set min node engine to 24.22.1 (9485abb)
• summary: resolve actual PR head commit sha from event payload (a0bce84)
• metrics: link CI run numbers to GitHub Actions runs and escape hash fallback (d1ff08c, 4840f45)
• reviewer: heal unclosed Mermaid blocks and raise max-tokens headroom for thinking models (f611ffa, 6fd1364)
• reviewer: auto-heal LLM arrow syntax glitches in Mermaid sequence diagrams (ca623b1, b46996e)
• summary: prevent markdown backtick collision in ai agent prompt box (8c8b02d, 38378b5)

### Documentation & Maintenance
• docs(agents): document automated CI & AI review monitoring and auto-fix loop protocol (7bf7f53)
• docs(readme): document commit-sha input and startswith slash command configuration

ReviewGround v1.5.0 — Review Effort Estimator, Pre-Merge Invariant Checks & AI Hardening Suite

🚀 ReviewGround v1.5.0 Release

Universal AI Code Reviewer & Post-CI Verification GitHub Action with Multi-Provider BYOK, Live Registry Search Grounding, 1-Click Suggestions, and Sticky Comments.

This release represents a major evolutionary leap for ReviewGround, introducing Coderabbit-inspired ergonomics, intelligent review effort estimations, pre-merge invariant verification tables, automated multi-tier architecture sequence diagrams, and hardened prompt injection defenses for downstream AI coding agents.

---

🌟 Highlights & Major Features

1. ⏱️ Review Effort & Complexity Estimator (src/utils/effortEstimator.ts)

• Automatically inspects unified git diff hunks and calculates an objective complexity tier:
  • Tier 1: Trivial (1–3 files, <20 lines, docs/types)
  • Tier 2: Simple (2–5 files, <100 lines)
  • Tier 3: Moderate (5–10 files, 100–300 lines)
  • Tier 4: Complex (10–20 files, 300–800 lines)
  • Tier 5: Substantial (>20 files or >800 lines)
• Dynamic Risk Escalation: Automatically elevates the tier when changes touch security, authentication, payment processing, or database migration files.
• Generates a human-friendly duration estimate (~15–20 mins, ~45–60 mins) and embeds a badge directly in the review header:
  ⏱️ Review Effort: 4 (Complex) · ~45–60 mins (648 lines across 15 files)

2. 📋 Pre-Merge Invariant Checks Table (src/utils/preMergeChecks.ts)

• Implements an expandable, executive pre-merge health table:
  • Unit Test Coverage: Analyzes new function/route exports against test additions (test/, __tests__/).
  • Secret Leak Sanitization: Verifies pre-flight entropy & pattern sanitization completed cleanly.
  • Registry Verification: Cross-references package changes against npm/PyPI registries.
  • Code Quality & Security Gate: Tracks 0 Blocker / 0 Warning thresholds.
• Provides clear Pass (✅ Passed), Warning (⚠️ Warning), and Fail (❌ Failed) indicators with actionable resolution steps.

3. 🛡️ Indirect Prompt Injection Defense & Validation Guidance

• Defensive Handoff Framing: Shields downstream AI coding agents (Cursor, Claude Code, Antigravity) from indirect prompt injection via malicious diff content by prefixing prompt boxes with explicit untrusted review data warnings.
• Verification Commands: Automatically generates project-specific validation commands (npm run typecheck && npm test) to guide AI tools in verifying their generated patches.

4. 🎯 Actionable Findings Banner & Review Scope Distribution

• Executive Summary Badge: Top-level banner categorizing findings by severity ([BLOCKER], [WARNING], and Committable Suggestions).
• Review Scope Dropdown: Collapsible table detailing analyzed files (P0/P1 priorities) vs budget-skipped low-priority lockfiles and binary assets (P2).

5. 🔄 Multi-Tier Architecture Sequence Diagram Prompts

• Instructs LLMs to automatically generate Mermaid sequenceDiagram blocks when pull requests introduce or modify multi-tier workflows (Client -> API -> Service -> Database -> External Gateway), giving human reviewers instant visual clarity on complex request lifecycles.

6. 🌐 PR Diff API Priority for issue_comment Workflows

• Fixed a subtle diff fallback bug in slash commands: ReviewGround now prioritizes the GitHub PR diff REST API (/repos/{owner}/{repo}/pulls/{number}) over local git diffs, eliminating false fallbacks to HEAD~1 on default-branch checkouts.

7. 💬 Dedicated Slash Commands Workflow Isolation

• Added .github/workflows/reviewground-slash.yml with isolated concurrency (reviewground-slash-${{ github.event.issue.number }}) and issues: write permission documentation for zero-waste runner executions.

8. 🏗️ Architecture Diagram Parity & High-Resolution Assets

• Updated images/architecture-diagram.mmd and README.md to reflect all Subgraph 4 post-processing additions.
• Regenerated high-resolution SVG and PNG architecture assets via Mermaid CLI.

---

📦 Detailed Conventional Commit Changelog

### Features
• review effort estimator, pre-merge invariant checks, and prompt injection defense (a73add9)
• prompts: harden ai agent prompts with prompt injection defense and validation commands (75bddff)
• reviewer: add code review effort estimator and pre-merge invariant checks (7f9b2d9)
• reviewer: add actionable findings banner, ai agent prompt box, and review scope dropdown (ec5a1ea)
• actionable findings banner, ai agent prompt box, and isolated slash commands (5991eea)
• ci: enable conditional concurrency cancellation on non-main branches (905c33b)

### Bug Fixes
• reviewer: prioritize PR diff API over local diff and auto-detect comment mode (d488719)
• reviewer: sanitize nested code fences and details tags in ai agent prompts (5109723)
• workflows: guard floating tag update and isolate slash commands (0f81d08)

### Documentation & Maintenance
• docs(architecture): sync architecture diagram with effort estimator, pre-merge checks, and actionable banner (b8e09cf)
• docs(readme): document effort estimator, pre-merge checks, and issues:write permissions (b1f9ea4)
• docs(architecture): add github app webhook specification and optimize readme workflow (b4141c0)
• chore(deps): bump zod and @types/node
• test(providers): isolate provider env vars and normalize CRLF in diagram parity test (c11b561)

ReviewGround v1.4.0 — Enterprise-Grade Intelligence & Zero-Hallucination Suite

🚀 ReviewGround v1.4.0 — Enterprise-Grade Intelligence & Zero-Hallucination Suite

ReviewGround v1.4.0 introduces massive advancements in repository awareness, developer security, conversational PR collaboration, and CI efficiency. ReviewGround remains 100% self-hosted, BYOK (Bring Your Own Key), and zero-SDK-bloat via GitHub Actions.

---

🌟 Key Highlights in v1.4.0

1. 🛡️ Pre-Flight Diff Secret & Credential Sanitizer

Never leak credentials to AI model providers:

• Proactively scans and masks API keys, AWS credentials, GitHub tokens, private keys, and bearer tokens in git diffs before prompting LLMs.
• Eliminates the risk of accidental secret exposure in prompt payloads.

2. 🧠 Repository Structure Grounding (Zero Hallucinations)

Gives LLMs full contextual awareness of your project layout:

• Ingests repository tree hierarchy, configuration files, and package manifests into prompt context.
• Prevents AI from hallucinating missing utility functions or recommending libraries that already exist in your codebase.

3. 💬 Conversational PR Comment Assistant

Engage in interactive technical discussions with ReviewGround:

• Ask questions in PR comments (@reviewground explain this SQL query, @reviewground how can we optimize this function?).
• Conversational intent classifier routes requests to deep architectural explanations or targeted code patches.

4. ⏸️ CI Failure Gating (skip-on-ci-failure)

Save API tokens and prevent notification fatigue:

• New optional input skip-on-ci-failure: true automatically pauses AI review runs if prior CI test or build steps fail.
• Only executes code review once the underlying build and lint suites pass cleanly.

5. 📜 Universal Coding Standards Auto-Ingestion

Enforce team guidelines out of the box:

• Automatically detects and ingests repository rules from AGENTS.md, CLAUDE.md, and .cursorrules.
• Evaluates code changes directly against your team's documented engineering invariants.

6. 🧹 Outdated Review Thread Auto-Resolution

Keep PR diffs clean and uncluttered:

• Automatically resolves outdated AI review comment threads when subsequent commits fix the reported issues.
• Configurable inline suggestion pruning via enable-prune-inline-suggestions: true.

7. 🪙 Cumulative Multi-Run Spend & Per-CI Cost Analytics

Gain granular visibility into AI review ROI:

• Accurately tracks cumulative LLM tokens and micro-cost across multiple commits and re-runs on a single PR.
• Transparent model-aware pricing footer showing exact spend down to fractions of a cent.

---

🛡️ Security, Runtime & Performance Invariants

• Node 24 LTS & TypeScript 7.0.2+: Zero external heavy SDK bloat; powered by native fetch with AbortSignal.timeout(...).
• Zero-Dependency Production Bundle: Complete engine bundled into a single self-contained dist/index.js (< 1.6MB).
• Hardened Execution: Replaced shell invocations with execFileSync to eliminate OS command injection vectors.
• Surrogate Pair Safe: Fixed Unicode surrogate pair slicing in GitHub Check Runs.
• 100% Test Coverage: All 43 test suites passing cleanly.
• Floating v1 Tag: Automatically updated to point to v1.4.0 (uses: arungupta1526/ReviewGround@v1).

---

Full Changelog: v1.3.0...v1.4.0

ReviewGround v1.3.0 — The 7-Feature Competitive Suite

🚀 ReviewGround v1.3.0 — The 7-Feature Competitive Suite

ReviewGround v1.3.0 is our biggest release yet. It elevates ReviewGround beyond expensive proprietary per-seat AI code review bots (CodeRabbit, Qodo PR-Agent, Greptile) while keeping everything 100% self-hosted, BYOK (Bring Your Own Key), and zero-SDK-bloat via GitHub Actions.

---

🌟 What's New in v1.3.0

1. 💬 Interactive PR Slash Commands (mode: 'slash-command')

Engage directly with ReviewGround inside GitHub PR comments via issue_comment triggers:

• @reviewground explain — AI explains the architectural rationale and security implications behind any flagged issue.
• @reviewground fix — AI proposes concrete, copy-pasteable alternative code patches.
• /review security / /review full — On-demand re-review targeting specific audit angles.
• Security Guardrail: Includes author_association validation to prevent Denial-of-Wallet attacks from unauthorized external users.

2. 📝 Automated PR Description & Walkthrough Generator (mode: 'describe')

Never write a manual PR description again:

• Generates Executive Summary, Key Changes bullets, 2-Column File Walkthrough Table (| File | Summary |), Interactive Testing Checklist, and Risk Assessment Badges.
• Intelligent body merge preserves human author notes (Fixes #42) while cleanly injecting or replacing the AI walkthrough.

3. 🌐 Multi-Ecosystem Package Grounding (Anti-Hallucination)

Proactively verifies newly added libraries against live public package registries before prompting LLMs:

• NPM (package.json)
• PyPI (requirements.txt, pyproject.toml)
• Crates.io (Cargo.toml)
• Go Proxy (go.mod)

4. 🪙 Real-Time Token & Cost Transparency Footer

Gain complete visibility over LLM expenditures in every sticky PR comment:

• Displays exact estimated tokens used, response latency, and micro-cost calculation per provider ($0.06–$0.80/M across 7 providers).
• Quantifies estimated monthly savings compared to commercial $20–$50/seat AI code review bots.

5. 🎯 Smart Diff Prioritization for Large PRs (>28k chars)

Never lose critical security reviews to LLM context truncation:

• P0 (Highest Priority): Auth, API routing, database models, payment gateways, encryption logic.
• P1 (Standard Priority): Application components, utilities, business logic.
• P2 (Deprioritized): Lockfiles, SVG assets, compiled snapshots.
• Truncates cleanly at complete newline boundaries rather than mid-line cuts.

6. 🏷️ OWASP Top 10 & CWE Taxonomy Mapping

Security findings are categorized with industry-standard classifications:

• Flags vulnerabilities with official IDs like CWE-89: SQL Injection, CWE-79: Cross-Site Scripting (XSS), CWE-798: Hardcoded Credentials, and OWASP Top 10 categories.

7. 🧪 Missing Unit Test Warnings & Test Stubs

Ensure high code quality before merging:

• Proactively scans git diffs for newly exported functions, classes, and HTTP route endpoints across TypeScript, JavaScript, Python, and Go.
• Emits collapsible warnings with ready-to-paste unit test templates (Vitest/Jest, pytest, Go testing).

---

🛡️ Runtime & Performance Invariants

• Node 24 LTS & TypeScript 7.0.2+: Zero external heavy SDK bloat; powered by native fetch with AbortSignal.timeout(...).
• Zero-Dependency Production Bundle: Complete engine bundled into a single dist/index.js (< 1.6MB).
• 100% Test Invariants: All 43 test suites passing cleanly.
• GitHub Marketplace Compliant: Strict < 125 character description ceiling for marketplace discovery.

---

Full Changelog: v1.2.0...v1.3.0

ReviewGround v1.2.0 — Enterprise Release Automation & Engine Synchronization

🛡️ ReviewGround v1.2.0 — Enterprise Release Automation & Engine Synchronization

🌟 What's New in v1.2.0

1. Automated Semver Release Lifecycle

• Full integration with Google Release Please (googleapis/release-please-action@v5) for zero-touch semver bumps, automated changelog generation, and floating major tag (v1) synchronization.

2. Workflow Permissions & Security Alignment

• Standardized GitHub Actions token permissions across all workflows (contents: write, pull-requests: write, checks: write).
• Automated multi-provider fallback chains and secret resolution without requiring local checkout.

3. Maintenance & Dependency Synchronization

• Synchronized package dependencies and version manifest across package.json, package-lock.json, and .release-please-manifest.json.

---

Full Changelog: v1.1.0...v1.2.0

ReviewGround v1.1.0 — Smart CI Verification, Dynamic Job Discovery & Clear PR Error Reporting

🛡️ ReviewGround v1.1.0 — Smart CI Verification, Dynamic Job Discovery & Clear PR Error Reporting

🌟 What's New in v1.1.0

1. Dynamic CI Workflow Job Auto-Discovery

• Automatically discovers all running and completed jobs in the current workflow run via the GitHub Actions API.
• Replaces hardcoded stage names with real job names, live durations (8s, 1m 12s), and direct links to execution logs.

2. Smart CI Verification Auto-Skip (hasCiData())

• In default mode: all, ReviewGround intelligently detects whether any CI results (gitleaks, audit, build, test, extra-stages) or workflow jobs are active.
• If no CI data exists, ReviewGround cleanly suppresses the post-CI verification table instead of printing confusing unknown status rows.

3. Actionable Missing-Key Setup Notice on PR Comments

• When a pull request runs without any configured LLM API keys, ReviewGround posts a clean, interactive setup banner on the PR with direct links to free provider keys (GEMINI_API_KEY, GROQ_API_KEY, OPENROUTER_API_KEY).

4. Diagnostic Quota & Failure Error Reporting

• When all configured AI providers fail due to quota exhaustion, rate limits, or network timeouts, posts a diagnostic notice linking to GitHub Actions run logs with clear troubleshooting steps.

5. ReviewGround Brand Upgrade

• Branded PR comment headers with ## 🛡️ ReviewGround AI Code Review & Security Analysis.
• Added collapsible live demo screenshots under <details> accordions in README.md.

6. Flexible Secret Aliases

• Support for popular environment variable aliases: GEMINI_KEY, GROQ_KEY, OPENROUTER_KEY, OPENAI_KEY, ANTHROPIC_KEY, DEEPSEEK_KEY, OLLAMA_BASE_URL.

7. Automated Semver Releases via Google Release Please

• Integrated Google Release Please (googleapis/release-please-action@v5) with automated semver bumps and floating v1 major tag synchronization.

---

Full Changelog: v1.0.0...v1.1.0

ReviewGround v1.0.0 — AI Code Review & DevSecOps Grounding

🚀 ReviewGround v1.0.0 — Official Marketplace Release

ReviewGround is a fast, zero-dependency, open-source GitHub Action that automates AI-powered code reviews with native 1-click diff suggestions, real-time npm grounding, and sticky post-CI summaries.

---

🌟 Key Highlights

• 🤖 7-Provider BYOK Engine: True Bring-Your-Own-Key freedom across Google Gemini, Groq, OpenAI, Anthropic Claude, DeepSeek, OpenRouter, and self-hosted local endpoints (Ollama/vLLM) with automatic sequential failover.
• 🌐 Live NPM Registry Grounding: Proactively verifies package versions against registry.npmjs.org before prompting LLMs — completely eliminating false-positive version hallucinations.
• 💬 Native 1-Click Commit Suggestions: Formats code suggestions directly into GitHub Pull Request review comments with native [ Apply suggestion ] buttons in the diff.
• ⏱️ Post-CI Stage Timing Metrics: Calculates exact execution runtimes (8s, 1m 15s) via the GitHub Jobs API and updates a single sticky summary comment via in-place PATCH.
• 🛡️ Enterprise Merge Gates & Risk Badges:
  • enable-check-run: 'true' creates a native GitHub Check Run pass/fail merge gate.
  • enable-pr-description-update: 'true' automatically prepends a 🟢 Low / 🟡 Moderate / 🔴 High Risk badge to the PR description.
• 🌍 Multi-Language Reviews: Get AI reviews in your preferred language (ja, es, zh, de, fr, etc.) via review-language.
• 📋 Custom Repository Rules: Enforce team guidelines from .reviewground.yml.
• ⚡ Zero-Dependency Bundle: Self-contained bundle (<1MB) running on Node 24 LTS with zero npm install needed in workflows.

---

⚡ Quick Start

name: ReviewGround AI Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write
  actions: read

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: arungupta1526/ReviewGround@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          mode: review
        env:
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          # Or use any other provider key:
          # GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
          # OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          # OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

Tip: Adding mode: review ensures ReviewGround executes pure AI code review without expecting downstream CI stage results.

---

📦 Full What's Changed in v1.0.0

🚀 Added

• Marketplace Launch: Initial public release of ReviewGround on the GitHub Marketplace.
• Multi-Provider BYOK Engine: Support for Gemini (gemini-3.5-flash-lite, gemini-3.1-flash-lite), OpenAI (gpt-4o, gpt-4o-mini), Claude (claude-3-5-haiku, claude-3-5-sonnet), Groq (qwen/qwen3.8-27b), DeepSeek (deepseek-chat), OpenRouter, and local custom endpoints (Ollama/vLLM).
• Smart Provider Auto-Detection: Automatically maps models (e.g. claude-* → Anthropic, qwen/* → Groq/OpenRouter, gpt-* → OpenAI).
• Sequential Provider Failovers: Gracefully reroutes to configured secondary provider keys when a primary hits quota limits.
• Configurable Fallback Models: fallback-models input allows defining a comma-separated fallback chain across providers.
• First-Class OpenRouter Support: Direct OpenRouter integration with full model pass-through and optional site attribution headers (HTTP-Referer, X-Title).
• Live NPM Registry Search Grounding: Verifies package changes against registry.npmjs.org before LLM analysis to eradicate package version hallucinations.
• Google Search Grounding: Real-time web retrieval grounding for Gemini (enable-search-grounding: 'true').
• Interactive Inline Suggestions: Formats code diffs into native GitHub [ Apply suggestion ] buttons (enable-inline-suggestions: 'true').
• Sticky PR Comment Pattern: Single comment updated via in-place PATCH to eliminate PR notification noise.
• Post-CI Stage Timing: Calculates exact execution durations (9s, 1m 24s) via GitHub Actions API.
• Step Summary Integration: Posts execution summaries to the native GitHub Actions job run page.
• Zero-Commit Repository Variables: Switch models or providers on the fly using GitHub Repository Variables (REVIEWGROUND_MODEL, REVIEWGROUND_PROVIDER, REVIEWGROUND_REVIEW_LEVEL).
• Automatic Event Context: Infers PR numbers and commits directly from GitHub Actions webhook payloads.
• Dependabot & Bot Safety: Detects automated bot PRs (e.g. dependabot[bot]) and gracefully skips AI review without failing CI.
• Dual Diff Strategy: Extracts diffs via local git diff with automatic GitHub Pulls API fallback.
• Runtime Schema Validation: Zod v4 validation across all AI suggestion responses (with z.coerce.number() line safety).
• Modern Runtime Baseline: Node 24 LTS and TypeScript 7.0 in a standalone esbuild bundle (<1MB).
• Multi-Language Reviews: review-language input supports any language (ja, es, zh, de, fr, etc.).
• PR Description Auto-Badging: enable-pr-description-update prepends 🟢 Low / 🟡 Moderate / 🔴 High Risk badges to the PR body.
• GitHub Check Run Gates: enable-check-run generates a blocking pass/fail Check Run for branch protection rules.
• Custom Stages: extra-stages input for injecting arbitrary JSON CI stages into the summary table.
• Exponential Backoff Utility: Shared fetchWithRetry.ts with jitter (50–250ms) across all 7 provider adapters.
• Provider-Specific Prompt Tuning: Claude XML tags, Gemini structured schemas, Groq markdown headers.
• Granular AI Control: temperature (default 0.2), max-tokens (default 2048), review-level (critical, standard, comprehensive), and ignore-patterns (glob filters).
• Custom Repository Rules: Loads repository guidelines from .reviewground.yml.
• Clean Diff Hunk Truncation: truncateDiffClean() prevents malformed diff cuts reaching LLMs.
• Paginated Comment Search: Correctly locates sticky comments across PRs with >100 comments.
• License: AGPL-3.0 open-source license.

🛠️ Fixed

• TypeScript Node Globals: Added "types": ["node"] to tsconfig.json compilerOptions for NodeNext ESM compatibility.
• Active Model Endpoints: Updated Gemini defaults to active endpoints (gemini-3.5-flash-lite, gemini-3.1-flash-lite) and Groq models to qwen/qwen3.8-27b and openai/gpt-oss-120b to eliminate 404 deprecated model errors.
• Custom Model Routing Preservation: Preserved custom provider endpoints (custom, openrouter) without accidental hijacking or rerouting to fallback models.
• Clean Hunk Boundary Truncation (Bug #1): Truncates diffs strictly at clean diff --git boundaries instead of cutting mid-hunk.
• Sticky Comment Pagination (Bug #2): Full pagination prevents duplicate review comments on high-activity PRs.
• Async FS (Bug #3): Replaced synchronous fs.appendFileSync with non-blocking await fs.promises.appendFile.
• Prompt Truncation Notification (Bug #4): Emits visible CI warning when large diffs hit Groq's 16,000-char context window.
• Model Detection (Bug #5): Added prefix matching for o4 and o4-mini OpenAI models.
• Inline Suggestion Cap Notification (Bug #6): Explicitly logs suggestion count vs cap of 5.
• Action Parser Integrity: Removed embedded ${{ needs... }} expressions from action.yml descriptions that caused GitHub workflow parser crashes.
• Marketplace Description Limit: Trimmed action.yml description to 114 characters to comply with GitHub Marketplace's 125-character ceiling.

🔄 Changed

• Dynamically tailored review prompt based on review-level (critical mode focuses strictly on security and bugs).
• Standardized all 7 LLM provider adapters onto fetchWithRetry for built-in resilience against transient API blips.