Open Code Review: inspect review scope, filters and model work
Deploy Open Code Review with separate model and comment permissions
Prepare a pinned CLI rollout, protect configuration and separate model access from permission to post review comments in CI.
What you will learn
- Record the release and configuration
- Split the two credential roles
- Make rollback an ordinary operation
Before you start
- Git changes and merge-base comparisons
- Basic CLI use and model API credentials
Choose a review scope, explain exclusions, prepare a controlled pilot and distinguish source inspection from runtime evidence.
Key takeaways
- Model access and comment-writing authority are different credentials.
- Key-retrieval commands make configuration security important.
- CI publication needs its own acceptance check.
Record the release and configuration
A reproducible rollout records the CLI release, runtime environment, Git version and the selected provider protocol. The source snapshot declares Go 1.25.5 in go.mod for source builds. Installing a released binary or npm package has a different setup path from compiling the repository.
Keep configuration in a location writable only by the intended operator. The documented api_key_cmd mechanism executes a command to retrieve a key, so a writable configuration file can become an execution surface. Review the configuration as carefully as other executable deployment inputs.
Split the two credential roles
CI needs model credentials to obtain findings and platform permissions to publish comments. These serve separate purposes. A pilot can keep the publishing step disabled and retain a private artifact, allowing the team to assess usefulness before granting comment-writing authority.
The upstream CI page describes pull_request_target and issue-comment triggers. These can run with privileged context, so copying a recipe requires a review of checkout choices, dependency installation and access to secrets. Reading untrusted changes should not become execution of pull-request code with privileged credentials.
Make rollback an ordinary operation
Start with one repository and a limited trigger. Preserve the previous package version, configuration and permission settings. If the trial produces noise or unexpected data access, disable its trigger and restore those values while retaining sanitized evidence for diagnosis.
Treat a successful process exit, valid JSON and successful platform publication as separate checks. The CI documentation includes fallback behavior when inline comments cannot be posted. A completed review can therefore appear as a summary rather than a set of inline comments.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Pin the reviewed release and document the Git and provider configuration.
- 2
Pilot with synthetic or approved code and no automatic comment publishing.
- 3
Test failure handling and preserve the previous version and permissions for rollback.
Copy-ready example
{
"proposal": true,
"release": "record an audited version",
"modelAccess": "approved provider credential",
"commentPublication": false,
"rollback": "previous package and configuration",
"executed": false
}Frequently asked questions
Should the first deployment publish every finding automatically?
A private-artifact pilot allows you to assess accuracy and data handling before enabling publication.
Does a successful review imply inline comments were posted?
No. Check the publishing response and any summary fallback separately.
Sources
- Open Code Review / README.mdSource checked 2026-09-18
- Open Code Review / go.modSource checked 2026-09-18
- Open Code Review / pages/src/content/docs/en/configuration.mdSource checked 2026-09-18
- Open Code Review / pages/src/content/docs/en/integrations/ci.mdSource checked 2026-09-18