Yang Code Review (YCR)

Yang Code Review (YCR) is a AI agent that helps you review code changes in your GitHub repositories.

---

📝 Review Process Overview

Yang Code Review first classifies the change domain, then applies the matching OWASP catalog(s):

• OWASP Web Top 10
• OWASP Mobile Top 10
• OWASP API Security Top 10
• OWASP Machine Learning Security Top 10
• OWASP IoT Top 10
• OWASP Top 10 for LLM Applications
• OWASP MCP Top 10
• OWASP IaC Security Cheat Sheet

Usage

1. Create an API key with one of the supported AI providers.
2. Save it as a GitHub Actions repository secret.
3. Configure PROVIDER, API_KEY, and MODEL_NAME in the action step.

🤖 Providers Supported

Provider base URLs are hardcoded in the action:

Provider	Base URL	Models
openai	https://api.openai.com/v1	Models
anthropic	https://api.anthropic.com/v1	Models
google	https://generativelanguage.googleapis.com/v1beta	Models
nvidia	https://integrate.api.nvidia.com/v1	Models
openrouter	https://openrouter.ai/api/v1	Models
yangyang	https://inference.yyng.icu/v1/agents (agent=yang-code-review)	auto

🔐 Required Secrets

• API_KEY — key for the selected provider
• GITHUB_TOKEN — GitHub token used to read changes and post PR comments

⚙️ Inputs

Name	Required	Description
PROVIDER	yes	openai, anthropic, google, nvidia, openrouter, or yangyang
API_KEY	yes	Provider API key
MODEL_NAME	yes	Provider model identifier. yangyang uses auto
MODEL_TEMPERATURE	no	Temperature from 0 to 1; omitted by default for model compatibility
MAX_TOKENS	no	Maximum output tokens; default 4096
GITHUB_TOKEN	yes	GitHub token for PR comments

🚀 Usage Example

name: YangYang Code Review (YCR)

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  code-review:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
      issues: write
      security-events: write   # SARIF → Security / Code scanning
      actions: write          # upload Actions artifacts
    steps:
      - name: yang-code-review
        uses: YangYang-Research/yang-code-review@<version>
        with:
          PROVIDER: openai
          API_KEY: ${{ secrets.OPENAI_API_KEY }}
          MODEL_NAME: gpt-5.4
          MODEL_TEMPERATURE: 0.2
          GITHUB_TOKEN: ${{ github.token }}

Outputs

Name	Description
sarif_path	Path to generated SARIF file
md_path	Path to generated markdown report
artifact_name	Actions artifact name
findings_count	Structured findings parsed into SARIF

Artifacts & Security tab

After each run the action:

1. Writes .md + .sarif, uploads Actions artifact
   yang-code-review-report-<YYYY-MM-DD>-pr-<pr_id> (PR) or
   yang-code-review-report-<YYYY-MM-DD> (push)
2. Uploads SARIF via github/codeql-action/upload-sarif@v4 → Security and quality → Code scanning
   Alerts are Dependabot-style: short severity title, Overview / Impact / Proof of concept / Remediation (+ Code fix) markdown, severity tags.

Needs security-events: write. Private/internal repos also need GitHub Code Security / Advanced Security.

Provider examples

Anthropic:

with:
  PROVIDER: anthropic
  API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  MODEL_NAME: claude-sonnet-4-5
  GITHUB_TOKEN: ${{ github.token }}

Google Gemini:

with:
  PROVIDER: google
  API_KEY: ${{ secrets.GEMINI_API_KEY }}
  MODEL_NAME: gemini-2.5-pro
  GITHUB_TOKEN: ${{ github.token }}

NVIDIA NIM:

with:
  PROVIDER: nvidia
  API_KEY: ${{ secrets.NVIDIA_API_KEY }}
  MODEL_NAME: meta/llama
  GITHUB_TOKEN: ${{ github.token }}

OpenRouter:

with:
  PROVIDER: openrouter
  API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
  MODEL_NAME: openai/gpt-5.2
  GITHUB_TOKEN: ${{ github.token }}

YangYang Inference:

with:
  PROVIDER: yangyang
  API_KEY: ${{ secrets.YANG_API_TOKEN }}
  MODEL_NAME: auto
  GITHUB_TOKEN: ${{ github.token }}

Report Template

# Yang Code Review (YCR) Report

## Scope and Classification
- Reviewed target: [repo/module/change-set]
- Detected domain(s): [Web/API/Mobile/ML/IoT/LLM/MCP/IaC]
- OWASP edition(s) applied: [e.g., Web 2025, API 2023, LLM 2025]

## Executive Summary
- Total findings: [count]
- Critical: [count]
- High: [count]
- Medium: [count]
- Low: [count]
- Info: [count]
- Top risks:
  1. [...]
  2. [...]
  3. [...]

## Detailed Findings

### YCR-001
- Severity: [Critical|High|Medium|Low|Info]
- OWASP Mapping: [category + edition]
- Location: [file:line]
- Description: [...]
- Impact: [...]
- Evidence: [...]
- Remediation: [...]
- Secure code example (optional): [...]

## Residual Risk and Verification Gaps
- Not fully verified: [...]
- Recommended follow-up tests: [...]

### Report Generated by Yang Code Review (YCR) - YangYang Organization

🛡 Security

• API_KEY and GITHUB_TOKEN are masked automatically in GitHub Actions logs.
• Keep provider keys in GitHub Secrets only; never print or commit them.
• The code diff is sent directly to the selected provider. Review that provider's data retention policy before enabling the action on private code.

🏷 Marketplace

This action is marketplace-ready:

• Bundled with @vercel/ncc
• Branded icon & color
• Semantic versioning recommended (v1, v1.1.0)

🏗 Build (Required) - For Developers

This action uses @vercel/ncc to bundle all dependencies into a single file.

npm install
npm run build

This will generate dist/index.js which must be committed.

📝 License

This project is licensed under the MIT License - see the LICENSE.md file for details.

🤝 Contributing

Contributions are welcome! Please feel free to submit a pull request.