From 12e40f236bf526e736b0bd252d0af41434734be8 Mon Sep 17 00:00:00 2001
From: John Smith <you@example.com>
Date: Mon, 19 Oct 2026 16:41:57 -0400
Subject: [PATCH] ci(ocr): reconcile caller to org standard (pinned)

Pin reusable workflow to a440b485d779b9177b1602c4d4f7f58cff0483a2 (main). Drop unknown with: inputs (llm_url/llm_model/use_anthropic not in workflow_call schema). Adopt pull_request_target + standard comment gates, guarded concurrency, minimal permissions, secrets: inherit.
---
 .github/workflows/ocr.yml | 55 +++++++++++++++++++++------------------
 1 file changed, 29 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/ocr.yml b/.github/workflows/ocr.yml
index 0d0bac0..5b8081e 100644
--- a/.github/workflows/ocr.yml
+++ b/.github/workflows/ocr.yml
@@ -1,38 +1,41 @@
 name: OpenCodeReview
 
+concurrency:
+  group: >-
+    ${{
+      (
+        github.event_name == 'pull_request_target'
+        || (
+          github.event_name == 'issue_comment'
+          && github.event.issue.pull_request
+          && github.event.comment.user.type != 'Bot'
+          && (
+            github.event.comment.author_association == 'MEMBER'
+            || github.event.comment.author_association == 'OWNER'
+            || github.event.comment.author_association == 'COLLABORATOR'
+          )
+          && (
+            startsWith(github.event.comment.body, '/open-code-review')
+            || startsWith(github.event.comment.body, '@open-code-review')
+          )
+        )
+      )
+      && format('ocr-{0}', github.event.pull_request.number || github.event.issue.number)
+      || format('noop-{0}', github.run_id)
+    }}
+  cancel-in-progress: true
+
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
   issue_comment:
     types: [created]
 
-concurrency:
-  group: ocr-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
   pull-requests: write
-  issues: write
-  checks: write
 
 jobs:
-  ocr:
-    if: >-
-      github.event_name == 'pull_request' ||
-      (
-        github.event_name == 'issue_comment' &&
-        github.event.issue.pull_request &&
-        contains(github.event.comment.body, '@ocr') &&
-        contains(
-          fromJSON('["OWNER","MEMBER","COLLABORATOR"]'),
-          github.event.comment.author_association
-        )
-      )
-    uses: Heretek-AI/.github/.github/workflows/ocr-review.yml@main
-    with:
-      llm_url: ${{ vars.OCR_LLM_URL || 'https://token-plan-sgp.xiaomimimo.com/v1' }}
-      llm_model: ${{ vars.OCR_LLM_MODEL || 'mimo-v2.6-flash' }}
-      use_anthropic: ${{ vars.OCR_LLM_USE_ANTHROPIC == 'true' }}
-    secrets:
-      OCR_LLM_TOKEN: ${{ secrets.OCR_LLM_TOKEN }}
+  review:
+    uses: Heretek-AI/.github/.github/workflows/ocr-review.yml@a440b485d779b9177b1602c4d4f7f58cff0483a2 # main
+    secrets: inherit