OrcaCode Review

AI code review that catches serious issues before they merge — powered by OrcaRouter.

Automatically review every pull request, post findings directly on the affected lines, and block serious issues from merging.

P0/P1 → ❌ Block · P2 → 💬 Comment · Clean → ✅ Pass

How it works

PR → Fast Review → Strong Review → Merge Gate
        │               │
     P0/P1?           P0/P1?
        ↓               ↓
      BLOCK           BLOCK

Every PR starts with a fast, low-cost model. Once clear of P0/P1 issues, OrcaCode automatically escalates to a stronger model for the final review.

You choose the models in OrcaRouter. OrcaCode handles the review.

What you get

• 🔍 Automatic review on every PR
• 💬 Inline P0 / P1 / P2 findings
• 🛑 Merge gate for serious issues
• ⚡ Fast → strong model cascade
• 🧠 Choose your own review models
• 🎯 Precision filtering to reduce false positives
• 🔒 OrcaRouter guardrails + security policies
• 🔄 Re-run anytime with /orcacode-review

---

Quick Start

1. Enable OrcaCode Review

Go to OrcaRouter → Apps → OrcaCode Review and turn it on.

Configure your models, review mode, severity rules, merge policy, and other settings directly from the console.

2. Install the GitHub Action

Install OrcaCode Review from GitHub Marketplace →

Add the Action to your repository:

- uses: Continuum-AI-Corp/orca-code-review@v1
  with:
    orcarouter-api-key: ${{ secrets.ORCAROUTER_API_KEY }}

3. Add your API key

Create or copy a key from OrcaRouter → API Keys.

Add it to your GitHub repository as:

ORCAROUTER_API_KEY

under Settings → Secrets and variables → Actions.

4. Open a PR

That's it.

OrcaCode automatically reviews new PRs and pushes, posts findings inline, and reports the merge gate.

---

Severity

Severity	Meaning	Result
P0	Critical / blocker	❌ Block
P1	High severity	❌ Block
P2	Advisory	💬 Comment

Customize the rubric and blocking policy from OrcaRouter → Apps → OrcaCode Review.

---

Configure without touching YAML

Manage OrcaCode from OrcaRouter → Apps → OrcaCode Review:

• Models — choose your fast + strong reviewers
• Review mode — every push, ready for review, or on demand
• Merge policy — choose which severities block
• Exhaustive review — run additional strong-model passes
• Quiet mode — keep P2 findings in the summary
• Custom rubric — define your own review rules
• Guardrails — add security and policy checks

Change your review strategy anytime. No GitHub workflow edits required.

---

Re-run a review

Comment on any PR:

/orcacode-review

to request another review.

---

Block merges

To make P0/P1 findings actually prevent merging:

GitHub → Settings → Branches / Rulesets → Require status checks to pass

Add the review check as required.

---

Security & Privacy

OrcaCode reads the PR diff and repository files required for review. It does not execute PR code.

Optional run reporting sends only review metadata — repository, PR, commit SHA, tier, severity counts, gate result, and engine version.

No source code, diff, or finding text is included in run reports.

OrcaRouter guardrails can add secret detection, PII detection, prompt-injection protection, code-security rules, and external security scanners.

See SECURITY.md for details.

---

Under the hood

OrcaCode Review uses Open Code Review as its review engine and OrcaRouter for model routing, policy, and control.

OrcaCode decides how to review. OrcaRouter decides what model runs it.

License

MIT © Continuum-AI-Corp.

Open Code Review is Apache-2.0. Attribution is preserved in NOTICE.