whhe/code-review-bot repository overview

whhe/code-review-bot:claude-code
whhe/code-review-bot:latest
whhe/code-review-bot:opencode

Each target persists its matching ACP_AGENT_TYPE. Both variants leave ACP_COMMAND and ACP_ARGS unset. Built-in presets start Claude through npx -y @agentclientprotocol/claude-agent-acp and OpenCode through opencode acp. Agent-specific Docker stages ensure Claude images do not contain OpenCode-only environment defaults.

:latest and :claude-code are aliases for the same Claude image. OpenCode is published only as :opencode.

⁠OpenCode image configuration

The OpenCode image uses these variables during setup and runtime. For the generated config, the endpoint and API key remain required at runtime because OpenCode resolves their environment placeholders for every agent process. The model and context limit are read only when bootstrap creates the config; the output limit is used during both setup and runtime.

The limit defaults match qwen3.7-max, but OPENCODE_MODEL remains runtime-configurable. When selecting another fixed model, override both limits to match it. The generated model entry declares both limit.context and limit.output; the image also exports the output value through OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX.

Bootstrap writes ~/.config/opencode/opencode.json only when it does not already exist. The generated provider references {env:OPENCODE_UPSTREAM_API_KEY} instead of storing the credential, and the OpenCode setup path does not print the generated configuration. Mount a pre-reviewed configuration at that path to bypass generation. The ACP launcher forwards only the OpenCode endpoint, key, output limit, and npm-registry variables.

The generated config does not override OpenCode's tool permissions, matching the existing Claude image. The shared review prompt explicitly requires a read-only review and forbids file changes, commits, pushes, and comment publication. This is a behavioral instruction, not a container security boundary.

The review workspace checks out the target branch, allowing Claude Code, Codex, OpenCode, and future ACP agents to discover project instructions through their own native rules. The source branch is available only through stable Git refs pinned to the platform's change-request diff version and is inspected with read-only git diff and git show commands. The bot does not enumerate instruction or configuration file names.

⁠Default review skill

The image pre-installs the public code-review skill from whhe/ai-workshop⁠ via npx skills add whhe/ai-workshop --skill code-review --global --yes and sets REVIEW_SKILL=~/.agents/skills/code-review. The skill lands in the appuser home directory; the tilde is expanded at runtime by the bot. Reviews run with a consistent methodology baked into the image and require no network access to the skill source at runtime.

To use a different skill, override REVIEW_SKILL when running the container. The value must be a path accessible inside the container — the pre-installed skill (~/.agents/skills/code-review) is already there, but a custom skill file on the host must be mounted first:

docker run --env-file .env \
  -v /host/path/to/skills:/skills \
  -e REVIEW_SKILL=/skills/my-skill \
  ...

To fall back to the agent's built-in knowledge (no skill), set REVIEW_SKILL=.

⁠Run

docker run --env-file .env -v ./logs:/app/logs whhe/code-review-bot:claude-code --cr-id <change-request-id>

# Write a Markdown report instead of posting to the platform
docker run --env-file .env -v ./logs:/app/logs whhe/code-review-bot:claude-code --cr-id <change-request-id> --debug

⁠Claude Code image environment variables

docker-entrypoint.sh runs bootstrap.py on every container start; bootstrap writes ~/.claude/settings.json from the variables below on first start only. If the file already exists it is left untouched.

All other bot settings (GIT_REPO_URL, GIT_REPO_TOKEN, REVIEW_SKILL, CODE_REVIEW_EXPECTED_SHA, etc.) are read from the same env file — see the configuration reference⁠ in the root README.

⁠CI integration

The bot runs as a plain CLI command inside the container. Pass the platform's merge/pull request ID via --cr-id and expose the required credentials as masked CI/CD variables.

⁠GitLab CI

Add a job to the .gitlab-ci.yml of the repository you want reviewed that runs this image and passes $CI_MERGE_REQUEST_IID as --cr-id:

code-review:
  image: whhe/code-review-bot:claude-code
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    GIT_STRATEGY: none
    GIT_PLATFORM_TYPE: gitlab
    GIT_REPO_URL: "${CI_PROJECT_URL}.git"
    GIT_REPO_TOKEN: $GITLAB_TOKEN
    CODE_REVIEW_EXPECTED_SHA: $CI_MERGE_REQUEST_SOURCE_BRANCH_SHA
    ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY
  script:
    - code-review-bot --cr-id "${CI_MERGE_REQUEST_IID}"

The image ENTRYPOINT runs bootstrap setup then execs the job command. GitLab passes the script via sh -c, so code-review-bot --cr-id … in script works without overriding entrypoint.

GIT_REPO_URL is derived from the GitLab predefined variable $CI_PROJECT_URL. Set GITLAB_TOKEN and ANTHROPIC_API_KEY as masked CI/CD variables in that project's settings. Optionally set ANTHROPIC_MODEL.