Credentials. Store the OpenAI and GitHub keys as CI secrets and avoid echoing them in job logs.
Who it is forA maintainer or DevOps engineer who wants a CI job to read review results from a pull request without parsing Markdown.
The problemA Markdown report is easy for people to read but hard for a pipeline to act on consistently.
The outcomeA review.json file produced by the CLI that a later CI script can parse, while the final decision stays with a human.
What you need first
- Node.js 20 LTS or newer
- A checkout of the vuphongle/oss-pr-reviewer repository
- An OpenAI API key set as OPENAI_API_KEY (required for live reviews)
- A GITHUB_TOKEN is recommended to avoid anonymous GitHub API rate limits
- Network access to GitHub and OpenAI
Steps
- Run
npm installandnpm run buildin the checkout. - Set
GITHUB_TOKENandOPENAI_API_KEYin the CI secret store and export them for the job. - Run
node dist/cli/index.js review --repo owner/repository --pr 123 --output review.json --output-format json. - Have the next CI step read review.json and report the findings, without failing the build on a high or critical finding alone.
Prompt for your agent
In the oss-pr-reviewer checkout, run node dist/cli/index.js review --repo <owner/repository> --pr <number> --output review.json --output-format json. Verify that review.json parses as JSON and summarize the findings by severity. Do not treat a high or critical finding as a merge decision.
Caveat. The README says a high or critical finding does not make the process fail, so your CI step must add its own rule if you want a gate.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for vuphongle/oss-pr-reviewer and "Export review findings as JSON for a CI step"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer