GitHub Action

The OpenCorvus GitHub Action triggers the AI coding agent from supported GitHub events, including comments, issue or PR lifecycle events, schedules, and manual workflows.

Source: github/action.yml (Action definition), packages/opencorvus/src/cli/cmd/github.ts (runtime).

What it does

Published as a composite action. Runtime sequence:

1. Sets up Bun for the runner.
2. Runs the repository source entrypoint: bun "$GITHUB_ACTION_PATH/../packages/opencorvus/src/index.ts" github run.
3. Parses the GitHub event payload, opens the target project, creates a session, and calls SessionPrompt.prompt in-process.
4. Writes the reply back via Octokit; on dirty working tree, commits, pushes, and opens a PR.

Supported triggers (packages/opencorvus/src/cli/cmd/github.ts):

• issue_comment — Issue & PR comments (distinguished by issue.pull_request)
• pull_request_review_comment — line-level review comments
• issues — issue lifecycle events
• pull_request — PR lifecycle events
• schedule — scheduled repository automation
• workflow_dispatch — manually triggered repository automation

Comment triggers read /opencorvus or /oc from the GitHub comment. issues, schedule, and workflow_dispatch require the prompt input because their payloads do not include a comment body.

Inputs

Parameter	Required	Default	Description
model	✓	—	provider/model, e.g. alibaba-coding-plan-cn/qwen3.5-plus
share	—	true (public repos)	Share at opencorvus.ai/s/<id>
prompt	—	—	Custom prompt overriding default
mentions	—	/opencorvus,/oc	Comma-separated trigger phrases
variant	—	—	Provider reasoning variant (high, max, minimal)
oidc_base_url	—	https://api.opencorvus.ai	OIDC exchange URL for custom App installs

(github/action.yml)

Outputs

No declared outputs:. Runtime artifacts:

• Comment: [Working...](<run-url>) placeholder immediately, replaced with the AI reply on completion
• Git commit: auto-commit + push when the tree is dirty; author opencorvus-agent[bot], co-author = triggering user
• PR: on Issue triggers with code changes, new branch + PR; title = AI summary (≤40 chars); body includes Closes #<issue>
• Share link (optional): opencorvus.ai/s/<shareId> appended

(packages/opencorvus/src/cli/cmd/github.ts)

Secrets

OpenCorvus GitHub App

Requires id-token: write. OIDC exchange runs automatically; do not wire a repository token manually.

env:
  ALIBABA_CODING_PLAN_API_KEY: ${{ secrets.ALIBABA_CODING_PLAN_API_KEY }}

Workflow permissions

Default App/OIDC installs keep the repository token read-only. Write access comes from the App token after OIDC exchange:

permissions:
  id-token: write # OIDC
  contents: read
  pull-requests: read
  issues: read

This repo’s own .github/workflows/opencorvus.yml declares read-only repository permissions because write capability is carried by the App token.

Permission check

When a user posts /oc, collaboration permission must be admin or write; otherwise rejected.

Workflow examples

Comment triggers

name: opencorvus
on:
  issue_comment: { types: [created] }
  pull_request_review_comment: { types: [created] }
jobs:
  opencorvus:
    if: |
      contains(github.event.comment.body, ' /oc') ||
      startsWith(github.event.comment.body, '/oc') ||
      contains(github.event.comment.body, ' /opencorvus') ||
      startsWith(github.event.comment.body, '/opencorvus')
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: read
      issues: read
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: yangheng95/opencorvus/github@latest
        env:
          ALIBABA_CODING_PLAN_API_KEY: ${{ secrets.ALIBABA_CODING_PLAN_API_KEY }}
          OPENCORVUS_CONFIG_CONTENT: '{"permission_mode":"full_access"}'
        with:
          model: alibaba-coding-plan-cn/qwen3.5-plus

Repository events

name: opencorvus-repository
on:
  issues: { types: [opened, reopened] }
  pull_request: { types: [opened, synchronize, reopened, ready_for_review] }
  schedule:
    - cron: "0 9 * * 1"
  workflow_dispatch: {}
jobs:
  opencorvus:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: read
      issues: read
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: yangheng95/opencorvus/github@latest
        env:
          ALIBABA_CODING_PLAN_API_KEY: ${{ secrets.ALIBABA_CODING_PLAN_API_KEY }}
          OPENCORVUS_CONFIG_CONTENT: '{"permission_mode":"full_access"}'
        with:
          model: alibaba-coding-plan-cn/qwen3.5-plus
          prompt: Maintain this repository from the triggering issue, pull request, schedule, or manual dispatch.

Comment triggers

Comment	Effect
/opencorvus explain this issue	Reads thread and replies
/opencorvus fix this	New branch, implementation, PR
/oc (on PR)	Reviews the PR
/oc add error handling here (line review)	Edits at specified line, commits

Code flow

issue_comment / pull_request_review_comment / issues / pull_request / schedule / workflow_dispatch
  ├─ isPullRequest()
  │  ├─ same-repo PR → checkoutLocalBranch → chat → pushToLocalBranch
  │  └─ fork PR     → checkoutForkBranch  → chat → pushToForkBranch
  ├─ Issue → checkoutNewBranch → chat → pushToNewBranch → createPR
  └─ Repository automation → checkoutNewBranch → chat → pushToNewBranch

(packages/opencorvus/src/cli/cmd/github.ts)

Local testing

bun test packages/opencorvus/test/cli/github-action-run.test.ts

Repository tests mock event payloads and still exercise the same OIDC App-token exchange path as the published Action.