Merged
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 20 minutes and 55 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughA new GitHub Actions setup and integration for Claude Code is introduced, consisting of a composite action that clones and patches the claude-code-action repository, installs Bun, and a workflow configuration that triggers Claude Code on GitHub issues and pull requests with LiteLLM proxy routing enabled for Anthropic API calls. Changes
Sequence DiagramsequenceDiagram
participant GHA as GitHub Actions
participant Setup as setup-claude-code-action
participant Claude as claude-code-action
participant Proxy as FastAPI Proxy
participant LiteLLM as LiteLLM
participant Anthropic as Anthropic API
GHA->>Setup: Trigger workflow
Setup->>Setup: Clone upstream repo
Setup->>Setup: Apply litellm-proxy.patch
Setup->>Setup: Install Bun v1.3.13
Setup->>Claude: Return action_path
GHA->>Claude: Execute with LiteLLM enabled
Claude->>Proxy: Make request to localhost proxy
Note over Proxy: FastAPI intercepts request
Proxy->>LiteLLM: Forward via LiteLLM router
LiteLLM->>Anthropic: Route to Anthropic API
Anthropic-->>LiteLLM: Response (streaming SSE)
LiteLLM-->>Proxy: Stream back to proxy
Proxy-->>Claude: Return response
Claude-->>GHA: Complete action execution
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PhilippMatthes
requested review from
SoWieMarkus,
auhlig,
juliusclausnitzer,
mblos and
umswmayj
as code owners
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (8)
.github/workflows/claude-code.yaml (2)
16-20: Double-check whetherid-token: writeis actually required.
id-token: writeis only needed for OIDC-based auth flows (e.g., cloud federated credentials, signing). The LiteLLM/SAP AI Core path authenticates viaAICORE_CLIENT_ID/AICORE_CLIENT_SECRET/AICORE_SERVICE_KEYsecrets, and the workflow usessecrets.GITHUB_TOKENfor GitHub API. If no step actually performs OIDC token exchange, drop this permission to tighten the least-privilege surface.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/claude-code.yaml around lines 16 - 20, Review whether the workflow actually performs any OIDC token exchange; if not, remove the "id-token: write" permission from the permissions block (the "id-token" entry) to reduce granted privileges, otherwise keep it and document which step uses the OIDC flow; also scan the workflow for any steps that reference OIDC or use actions like "google-github-actions/auth" or "aws-actions/configure-aws-credentials" and only retain "id-token: write" if such steps are present.
3-11: Workflow triggers launch a full runner on every comment/review, not just trigger-phrased ones.With no
if:guard on the job and no trigger-phrase filter at the workflow level, everyissue_comment,pull_request_review, etc. in the repository will spin up a runner, clone the upstream action, install Bun+Python+LiteLLM, etc., before the Claude action internally no-ops on comments without@claude-code. Consider adding a lightweight guard to skip runs that clearly won't match (e.g.,if: github.event.issue.pull_request == null || contains(github.event.comment.body, '@claude-code') || ...) to reduce CI cost and noise.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/claude-code.yaml around lines 3 - 11, The workflow currently triggers heavy runners for every issue/PR comment and review because the jobs lack a guard; update the workflow to short-circuit runs by adding an If-condition on the jobs (or a top-level conditional) that checks the event payload and comment body, e.g., use github.event.issue.pull_request to ensure the comment is on a PR and contains(github.event.comment.body, '@claude-code') (also handle github.event.review.body for review submissions), so jobs only proceed when the comment or review contains the trigger phrase or when the event is a real PR action you want to run..github/actions/setup-claude-code-action/action.yml (3)
34-38: Patch application has no idempotency or conflict diagnostics.
git applywill fail silently-to-the-logs if the upstream repository has drifted from what the patch expects (e.g., when someone bumpsupstream_ref). Considergit apply --checkfirst (orgit apply --3way) so the failure mode is clearer, and surface a helpful message pointing to the pinned SHA.♻️ Proposed refactor
- name: Apply LiteLLM proxy patch shell: bash run: | cd "${{ inputs.checkout_path }}" - git apply "${{ github.workspace }}/.github/patches/claude-code-action/litellm-proxy.patch" + PATCH="${{ github.workspace }}/.github/patches/claude-code-action/litellm-proxy.patch" + if ! git apply --check "$PATCH" 2>/tmp/patch-err; then + echo "::error::Patch no longer applies cleanly to upstream ref ${{ inputs.upstream_ref }}." + cat /tmp/patch-err + exit 1 + fi + git apply "$PATCH"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/setup-claude-code-action/action.yml around lines 34 - 38, Replace the current git apply invocation with a guarded sequence that first runs git apply --check (or git apply --3way) against "${{ github.workspace }}/.github/patches/claude-code-action/litellm-proxy.patch" and, on failure, emits a clear diagnostic mentioning the pinned upstream SHA and exits non‑zero; update the run block that currently executes git apply "${{ github.workspace }}/.github/patches/claude-code-action/litellm-proxy.patch" to perform the check, print a helpful error suggesting the upstream_ref/pinned SHA to inspect, and only proceed to git apply when the check succeeds (or fall back to --3way).
26-32: Simplify the clone-then-fetch-SHA dance.The current flow does a shallow clone of the default branch (an extra network round-trip and a working tree you immediately overwrite), then fetches the pinned SHA and checks it out. Fetching a SHA directly into an empty repo is more efficient and makes the "pin" explicit:
♻️ Proposed refactor
- - name: Clone upstream claude-code-action - shell: bash - run: | - git clone --depth 1 "https://github.com/${{ inputs.upstream_repo }}.git" "${{ inputs.checkout_path }}" - cd "${{ inputs.checkout_path }}" - git fetch --depth 1 origin "${{ inputs.upstream_ref }}" - git checkout "${{ inputs.upstream_ref }}" + - name: Clone upstream claude-code-action + shell: bash + run: | + mkdir -p "${{ inputs.checkout_path }}" + cd "${{ inputs.checkout_path }}" + git init -q + git remote add origin "https://github.com/${{ inputs.upstream_repo }}.git" + git fetch --depth 1 origin "${{ inputs.upstream_ref }}" + git checkout --detach FETCH_HEAD🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/setup-claude-code-action/action.yml around lines 26 - 32, The current "Clone upstream claude-code-action" step does a shallow clone then separately fetches and checks out a pinned ref, causing an extra network round-trip and wasted working tree; replace the clone-then-fetch flow by initializing an empty repo, adding the upstream as a remote, and fetching the pinned SHA/ref directly (e.g. use git init / git remote add origin / git fetch --depth 1 origin <upstream_ref> and git checkout --detach FETCH_HEAD) so the action fetches only the pinned commit and checks it out without cloning the default branch first; update the step that currently runs git clone, git fetch, and git checkout to this single-fetch approach to make the pinning explicit and efficient.
40-44: Consider reverting tooven-sh/setup-bunaction for github.com workflows.Piping a remote install script into
bashwithout checksum verification presents a supply-chain risk — any compromise ofbun.shwould execute arbitrary code on your runners. The upstream usesoven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6pinned by commit SHA. This wrapper's patch replaced it with curl piping to avoid GHES API-token issues, but those constraints don't apply toubuntu-latest(github.com).For workflows running on github.com, revert to
oven-sh/setup-bun@v2(or pin to a specific commit SHA as the upstream does); GHES-specific workarounds can be added conditionally in the wrapper if needed.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/setup-claude-code-action/action.yml around lines 40 - 44, The Install Bun step currently pipes https://bun.sh/install into bash which is a supply-chain risk; revert GitHub-hosted workflows to use the official oven-sh/setup-bun action (e.g., oven-sh/setup-bun@v2 or pin to the same commit SHA used upstream) for the step named "Install Bun" (replace the curl | bash run block), and add a conditional fallback only for GHES runners that applies the curl install workaround when needed; update the action invocation and condition logic around the "Install Bun" step to prefer oven-sh/setup-bun for github.com runs and use the curl install only when GHES-specific constraints require it..github/patches/claude-code-action/litellm-proxy.patch (3)
46-50: Pin pip itself and avoid--quietwhen debugging future failures.Two small hardening nits for the installation step: (1)
pip install ... --quietwill swallow the resolver's warnings/conflict output, which makes diagnosing an unsolvable resolve on a later Python image painful — drop--quietor at least use-qonly alongside--progress-bar off; (2) nopython -m pip install --upgrade pipstep, so you are at the mercy of whatever pip ships with the ubuntu-latest Python 3.12 image, which has caused resolver differences between runners in the past. Neither is a blocker.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/patches/claude-code-action/litellm-proxy.patch around lines 46 - 50, Update the "Install LiteLLM dependencies" step so it first upgrades pip using "python -m pip install --upgrade pip" when inputs.use_litellm == 'true', and remove the "--quiet" flag from the pip install command (or replace with "-q --progress-bar off" if quieter output is desired) so resolver warnings/conflicts are visible; target the step named "Install LiteLLM dependencies" in the job that checks inputs.use_litellm to make these changes.
22-32: Install-by-curl bypasses supply-chain verification.Replacing
oven-sh/setup-bun@<pinned-sha>withcurl … | bash -s "bun-v1.3.13"means every CI run fetches a brand-new install script and a brand-new binary with no checksum verification. The upstream action's patch header notes this was done to dodge GHES API-token rate-limits — fair — but the current workflow runs onubuntu-latest(github.com) where that constraint doesn't apply. If the GHES case isn't actually exercised here, consider keeping the original pinned action; otherwise verify a knownbunbinary SHA256 after install.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/patches/claude-code-action/litellm-proxy.patch around lines 22 - 32, The change replaces the pinned action uses: oven-sh/setup-bun@0c5077e... with a curl | bash installer (the run block installing bun-v1.3.13 and echo "$HOME/.bun/bin" >> "$GITHUB_PATH") which removes supply-chain verification; either revert to the pinned action under the if: inputs.path_to_bun_executable == '' branch or, if the curl installer must be used for GHES, add explicit checksum verification after download: fetch the bun binary, compute and compare its SHA256 against a trusted value before adding $HOME/.bun/bin to GITHUB_PATH and failing the job on mismatch (keep the conditional and ensure the verification step references the same bun-v1.3.13 identifier used in the installer).
59-65: TOCTOU on the free-port picker.The Python one-liner binds port 0, reads the OS-assigned port, closes the socket, and then starts
uvicorn— betweens.close()anduvicorn.run(...)binding, another process can grab that port. On an ephemeral runner this is extremely unlikely, but if it ever races the readiness loop will hit a totally unrelated service and (worse) the dummy API key will be sent to it. Consider letting uvicorn pick the port and reading it back, or wrapping the health check with a strict response-body match.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/patches/claude-code-action/litellm-proxy.patch around lines 59 - 65, The current free-port picker uses a Python one-liner to bind/close and then launch litellm-proxy.py on LITELLM_PORT, which risks a TOCTOU race before uvicorn binds; modify the startup so uvicorn chooses the port (remove the pre-bound LITELLM_PORT) and then discover the actual port from the running process or have litellm-proxy.py print the bound port on startup so the action reads and exports it, or alternatively keep a fixed startup port but strengthen the readiness health check in the action to validate a strict response body (and API key echo) rather than merely connecting, referencing LITELLM_PORT, litellm-proxy.py (uvicorn.run) and the health-check loop to implement the safer approach.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/actions/setup-claude-code-action/action.yml:
- Around line 18-21: The action declares outputs.action_path (value: ${{
inputs.checkout_path }}) but downstream workflow uses the hardcoded path
"./.claude-code-action"; update the workflow to consume the action output
instead of the hardcoded path by replacing the hardcoded invocation with the
step output reference (e.g., use ${ { steps.<step_id>.outputs.action_path } }
where <step_id> is the step that runs this action), or alternatively document
the coupling by clearly stating in the action description that
inputs.checkout_path must not be overridden and keep outputs.action_path removed
if you prefer the coupling; target symbols: outputs.action_path,
inputs.checkout_path, and any workflow step that currently references
"./.claude-code-action".
In @.github/patches/claude-code-action/litellm-proxy.patch:
- Around line 279-295: The except block that catches Exception around
is_streaming/_handle_streaming/_handle_non_streaming currently returns str(e) to
the client which may leak sensitive upstream details; keep the
logger.exception(e) call but change the JSONResponse content to return a
generic, non-sensitive message (e.g., "internal server error" or "upstream
service error") and optionally a non-sensitive error_type or code, removing the
raw str(e) from the response payload while preserving full details in server
logs.
- Around line 355-360: The new main block binds the FastAPI app to 0.0.0.0 which
exposes the proxy externally; change the host passed to uvicorn.run from
"0.0.0.0" to "127.0.0.1" so the proxy only listens on localhost, keep the
existing port retrieval (port = int(os.environ.get("LITELLM_PROXY_PORT",
"4000"))) and the logger.info(...) line intact but ensure it still logs the
chosen bind address; update the uvicorn.run(app, host=..., port=port,
log_level="info") call accordingly.
- Around line 130-146: The Stop LiteLLM Proxy step uses wait "${LITELLM_PID}"
which fails because LITELLM_PID was set in a different shell so the process is
not a child; replace the ineffective wait with a loop that polls kill -0
"${LITELLM_PID}" until the process exits or a short timeout elapses (e.g., retry
sleep intervals with a max attempts) after sending kill, or alternatively run
pkill -f scripts/litellm-proxy.py to terminate and then poll until kill -0 no
longer succeeds; update the step that references LITELLM_PID and the Stop
LiteLLM Proxy step to implement this polling/timeout logic to ensure synchronous
cleanup.
- Around line 257-295: In the messages request handler move the request body
parsing into the existing try/except so JSON decode errors produce the same
Anthropic-style error envelope; specifically, in the messages(...) function
relocate "body = await request.json()" to be the first line inside the try block
(before inspecting body.get("stream") and before overriding body["model"] with
LITELLM_MODEL), and keep the rest of the logic that calls _handle_streaming and
_handle_non_streaming and the existing exception response unchanged so malformed
JSON is caught and returned as the formatted error response.
- Around line 321-342: The SSE generator in event_generator currently defaults
missing chunk["type"] to "content_block_delta", which mislabels events; update
the logic that computes event_type (inside async def event_generator when
iterating over response/chunk) to avoid assuming "content_block_delta" — if
chunk has no explicit "type" either emit a generic "message" event_type (e.g.,
"message") or skip/don't yield the frame, and ensure error handling still yields
an "error" event; adjust references to chunk/model_dump/data.get("type", ...)
accordingly so downstream consumers don't misinterpret unlabeled frames.
In @.github/workflows/claude-code.yaml:
- Around line 36-43: Remove the duplicate AICORE_BASE_URL entry from the env
mapping so the AICORE_BASE_URL key is defined only once; edit the env block (the
AICORE_* environment variables) to delete the repeated AICORE_BASE_URL line and
ensure the remaining AICORE_BASE_URL, AICORE_AUTH_URL, AICORE_CLIENT_ID,
AICORE_CLIENT_SECRET, AICORE_SERVICE_KEY and AICORE_RESOURCE_GROUP entries are
preserved and correctly indented.
- Line 35: Remove the path_to_bun_executable input from the workflow (the key
"path_to_bun_executable") and any references to it in the same job/step; the
setup action already prepends $HOME/.bun/bin to PATH so downstream steps can
invoke "bun" directly without a hardcoded path, so delete the input and rely on
PATH instead.
---
Nitpick comments:
In @.github/actions/setup-claude-code-action/action.yml:
- Around line 34-38: Replace the current git apply invocation with a guarded
sequence that first runs git apply --check (or git apply --3way) against "${{
github.workspace }}/.github/patches/claude-code-action/litellm-proxy.patch" and,
on failure, emits a clear diagnostic mentioning the pinned upstream SHA and
exits non‑zero; update the run block that currently executes git apply "${{
github.workspace }}/.github/patches/claude-code-action/litellm-proxy.patch" to
perform the check, print a helpful error suggesting the upstream_ref/pinned SHA
to inspect, and only proceed to git apply when the check succeeds (or fall back
to --3way).
- Around line 26-32: The current "Clone upstream claude-code-action" step does a
shallow clone then separately fetches and checks out a pinned ref, causing an
extra network round-trip and wasted working tree; replace the clone-then-fetch
flow by initializing an empty repo, adding the upstream as a remote, and
fetching the pinned SHA/ref directly (e.g. use git init / git remote add origin
/ git fetch --depth 1 origin <upstream_ref> and git checkout --detach
FETCH_HEAD) so the action fetches only the pinned commit and checks it out
without cloning the default branch first; update the step that currently runs
git clone, git fetch, and git checkout to this single-fetch approach to make the
pinning explicit and efficient.
- Around line 40-44: The Install Bun step currently pipes https://bun.sh/install
into bash which is a supply-chain risk; revert GitHub-hosted workflows to use
the official oven-sh/setup-bun action (e.g., oven-sh/setup-bun@v2 or pin to the
same commit SHA used upstream) for the step named "Install Bun" (replace the
curl | bash run block), and add a conditional fallback only for GHES runners
that applies the curl install workaround when needed; update the action
invocation and condition logic around the "Install Bun" step to prefer
oven-sh/setup-bun for github.com runs and use the curl install only when
GHES-specific constraints require it.
In @.github/patches/claude-code-action/litellm-proxy.patch:
- Around line 46-50: Update the "Install LiteLLM dependencies" step so it first
upgrades pip using "python -m pip install --upgrade pip" when inputs.use_litellm
== 'true', and remove the "--quiet" flag from the pip install command (or
replace with "-q --progress-bar off" if quieter output is desired) so resolver
warnings/conflicts are visible; target the step named "Install LiteLLM
dependencies" in the job that checks inputs.use_litellm to make these changes.
- Around line 22-32: The change replaces the pinned action uses:
oven-sh/setup-bun@0c5077e... with a curl | bash installer (the run block
installing bun-v1.3.13 and echo "$HOME/.bun/bin" >> "$GITHUB_PATH") which
removes supply-chain verification; either revert to the pinned action under the
if: inputs.path_to_bun_executable == '' branch or, if the curl installer must be
used for GHES, add explicit checksum verification after download: fetch the bun
binary, compute and compare its SHA256 against a trusted value before adding
$HOME/.bun/bin to GITHUB_PATH and failing the job on mismatch (keep the
conditional and ensure the verification step references the same bun-v1.3.13
identifier used in the installer).
- Around line 59-65: The current free-port picker uses a Python one-liner to
bind/close and then launch litellm-proxy.py on LITELLM_PORT, which risks a
TOCTOU race before uvicorn binds; modify the startup so uvicorn chooses the port
(remove the pre-bound LITELLM_PORT) and then discover the actual port from the
running process or have litellm-proxy.py print the bound port on startup so the
action reads and exports it, or alternatively keep a fixed startup port but
strengthen the readiness health check in the action to validate a strict
response body (and API key echo) rather than merely connecting, referencing
LITELLM_PORT, litellm-proxy.py (uvicorn.run) and the health-check loop to
implement the safer approach.
In @.github/workflows/claude-code.yaml:
- Around line 16-20: Review whether the workflow actually performs any OIDC
token exchange; if not, remove the "id-token: write" permission from the
permissions block (the "id-token" entry) to reduce granted privileges, otherwise
keep it and document which step uses the OIDC flow; also scan the workflow for
any steps that reference OIDC or use actions like "google-github-actions/auth"
or "aws-actions/configure-aws-credentials" and only retain "id-token: write" if
such steps are present.
- Around line 3-11: The workflow currently triggers heavy runners for every
issue/PR comment and review because the jobs lack a guard; update the workflow
to short-circuit runs by adding an If-condition on the jobs (or a top-level
conditional) that checks the event payload and comment body, e.g., use
github.event.issue.pull_request to ensure the comment is on a PR and
contains(github.event.comment.body, '@claude-code') (also handle
github.event.review.body for review submissions), so jobs only proceed when the
comment or review contains the trigger phrase or when the event is a real PR
action you want to run.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f6cac51a-28b2-4229-a2ff-d21509662b18
📒 Files selected for processing (3)
.github/actions/setup-claude-code-action/action.yml.github/patches/claude-code-action/litellm-proxy.patch.github/workflows/claude-code.yaml
- Remove path_to_bun_executable (env.HOME resolves to empty in Actions) - Remove duplicate AICORE_BASE_URL and unused AICORE_SERVICE_KEY - Remove unused action_path output from composite action - Bind LiteLLM proxy to 127.0.0.1 instead of 0.0.0.0 - Replace wait with kill-0 polling loop for proxy shutdown - Move JSON parsing inside try/except for consistent error responses - Scrub str(e) from error responses to prevent credential leakage - Skip SSE chunks with missing type instead of mislabeling them
The previous patch had corrupted hunk headers (line counts didn't match actual content) after in-place edits, causing git apply to fail. Regenerated by applying changes to a fresh upstream checkout and capturing git diff output.
Member
Author
|
@claude does this work? |
Filter on github.event.sender.type == 'User' so the job is skipped entirely when bots (coderabbitai, renovate, dependabot, etc.) trigger issue comments, PR reviews, or other events.
Contributor
Test Coverage ReportTest Coverage 📊: 70.0% |
This was referenced Apr 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Patch adapted from anthropics/claude-code-action@13742ea
Adds a GitHub Actions workflow that integrates claude-code-action with SAP AI Core via a LiteLLM proxy. Since the upstream action does not support LiteLLM natively, we clone it at a pinned commit and apply a local patch.