On a fresh CI checkout (actions/checkout), git diff is empty, so ocr
scan's auto-discovery finds 0 files to review. Replace the bare
--path '.' with an explicit comma-separated file list built from find.
This ensures every file under SCAN_PATH is reviewed, matching the
behavior ocr scan shows when run locally with a dirty working tree.
Co-Authored-By: Claude <[email protected]>
The eval-based flag building used embedded quotes inside variables,
which shell interprets as literal quote characters. This caused
ocr scan --path '. to become --path with value '.'\'' (including
quotes), making it scan an empty directory set and exit immediately.
Fix: invoke ocr scan directly with properly quoted arguments,
using shell conditional expansion for the optional --no-plan flag.
Co-Authored-By: Claude <[email protected]>
Rewrite both ocr-review.yml and ocr-scan.yml to use direct CLI
invocation instead of the marketplace composite action, matching the
official OCR CI/CD documentation patterns.
Changes:
- ocr-review.yml: Replace alibaba/open-code-review@main action with
direct 'ocr review' CLI. Add --background (PR title context),
--concurrency (default 5), provider-based config (custom_providers.*),
credential validation via 'ocr llm test', version pin to 1.8.1.
- ocr-scan.yml: Switch to same provider config model. Add --concurrency
(default 5), --no-plan toggle (opt-out for speed, 'false' for quality).
Fix default model from claude-sonnet-4-20250514 to deepseek-v4-flash.
Add credential validation step.
- Design spec: docs/superpowers/specs/2026-07-30-ocr-workflow-optimization-design.md
Co-Authored-By: Claude <[email protected]>
From official docs at integrations/ci.md:
- Use llm.* config keys (llm.url, llm.auth_token, llm.model,
llm.use_anthropic) instead of custom_providers
- Add llm.extra_body to disable thinking mode for provider compat
- Model is configured via ocr config set, not --model flag
Docs ref: github.com/alibaba/open-code-review/blob/main/
pages/src/content/docs/en/integrations/ci.md
Root cause analysis (5-perspective adversarial review):
1. Wrong NPM package — used @open-code-review/cli (doesn't exist),
correct is @alibaba-group/open-code-review (verified on npmjs.com)
2. Missing LLM config — OCR_LLM_URL/OCR_LLM_TOKEN are custom env vars
OCR doesn't read. Added ocr config set step mapping to a custom
provider with the protocol/url/key from workflow secrets.
3. No install verification — previous install step swallowed all
errors with 2>/dev/null || true. Now uses npm install -g + ocr
scan --help + ocr llm test for fail-fast verification.
4. Wrong output path — scan --format json writes JSON to stdout, not
.ocr/result.json. Now captures stdout directly to .ocr/result.json.
5. Missing comments field in envelope — build-envelope.sh didn't
handle .comments[] from scan output (only handled .issues and
.review_comments). Added .comments extraction with field mapping.
Fixes:
- .github/workflows/ocr-scan.yml: Split into Install & Configure +
Run Scan steps. Correct package, LLM config via custom provider,
direct output capture, explicit --model flag.
- .github/actions/ocr-envelope/build-envelope.sh: Handle .comments[]
from scan output, map to uniform findings format with file/line/
message/severity, handle object-typed .summary field.
All workflow 'Summarize' / 'Read Agent Output' steps used
'cat file | jq ... >> ' pipelines. With
set -o pipefail (GitHub Actions default), a jq exit code 5 (parse
error on malformed JSON) would kill the entire step — even though
the envelope was written successfully.
Fix: Replace all cat|jq pipe patterns with direct 'jq -r ... file'
invocations. jq can read files directly without cat, and the error
handling uses 2>/dev/null || true for robust fallback when the file
happens to be malformed between write and read.
Co-Authored-By: Claude <[email protected]>
When a workflow inside a repo references a composite action from the same
repo, it must use './.github/actions/name' — not 'org/repo/.github/actions/name@tag'.
The latter is for external repos and fails with 'Can't find action.yml'.
Fixed across all 10 workflow files.
Co-Authored-By: Claude <[email protected]>
Three issues causing all workflow runs to fail:
1. github_token is a reserved name in workflow_call secrets
- Renamed to repo_token across ocr-review, ocr-scan, release, and
check-status workflows. Updated all secrets.repo_token refs.
2. Shell scripts not executable (exit code 126)
- chmod +x all .sh files in .github/actions/
3. pre-commit types_or rejected 'typescript' type tag
- Changed to 'ts' in .pre-commit-config.yaml for eslint and prettier hooks
Co-Authored-By: Claude <[email protected]>
Users can now set OCR_LLM_MODEL as a GitHub secret to configure the
LLM model once at the repo/org level without exposing it in workflow files.
Resolution order: secrets.ocr_llm_model -> inputs.ocr-llm-model ->
vars.OCR_LLM_MODEL -> built-in default (claude-sonnet-4-20250514)
Updated both ocr-review and ocr-scan workflows plus README documentation.
Co-Authored-By: Claude <[email protected]>
Two new optional reusable workflows integrating alibaba/open-code-review into
the heretek-actions ecosystem:
- ocr-review.yml — AI-powered PR review on pull_request_target, with
re-trigger support via /open-code-review or @open-code-review comments.
Outputs .agent/output.json with findings for agent consumption.
- ocr-scan.yml — Full codebase scan on workflow_dispatch, scans the entire
repo (or a sub-path) using OCR CLI. Outputs agent envelope with scan
findings. Optional issue creation from findings.
Shared component:
- .github/actions/ocr-envelope/ — Composite action that reads OCR output
and writes the standardized .agent/output.json with status, findings, and
suggestions for agents to act upon.
Documentation:
- Updated README with OCR usage examples, configuration guide (secrets/vars),
and workflow table entries
Co-Authored-By: Claude <[email protected]>
