Yang Code Review (YCR)

Yang Code Review (YCR) is a AI agent that helps you review code changes in your GitHub repositories.

---

📝 Review Process Overview

Yang Code Review classifies code context and applies OWASP-standardized checks for multiple domains:

• OWASP Web Top 10
• OWASP Mobile Top 10
• OWASP API Security Top 10
• OWASP Machine Learning Security Top 10
• OWASP IoT Top 10
• OWASP Top 10 for LLM Applications
• OWASP MCP Top 10
• OWASP IaC Security Cheat Sheet
• OWASP Secure Code Review Checklist

Usage

1. Create an API key with one of the supported AI providers.
2. Save it as a GitHub Actions repository secret.
3. Configure PROVIDER, API_KEY, and MODEL_NAME in the action step.

YCR calls the selected provider directly. No Yang API account, token, or proxy is used.

🤖 Providers Supported

Provider base URLs are hardcoded in the action:

Provider	Base URL	Models
openai	https://api.openai.com/v1	Models
anthropic	https://api.anthropic.com/v1	Models
google	https://generativelanguage.googleapis.com/v1beta	Models
nvidia	https://integrate.api.nvidia.com/v1	Models
openrouter	https://openrouter.ai/api/v1	Models

🔐 Required Secrets

• API_KEY — key for the selected provider
• GITHUB_TOKEN — GitHub token used to read changes and post PR comments

⚙️ Inputs

Name	Required	Description
PROVIDER	yes	openai, anthropic, google, nvidia, or openrouter
API_KEY	yes	Provider API key
MODEL_NAME	yes	Provider model identifier
MODEL_TEMPERATURE	no	Temperature from 0 to 1; omitted by default for model compatibility
MAX_TOKENS	no	Maximum output tokens; default 4096
GITHUB_TOKEN	yes	GitHub token for PR comments

🚀 Usage Example

name: YangYang Code Review (YCR)

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  code-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
      - name: yang-code-review
        uses: YangYang-Research/yang-code-review@<version>
        with:
          PROVIDER: openai
          API_KEY: ${{ secrets.OPENAI_API_KEY }}
          MODEL_NAME: gpt-5.4
          MODEL_TEMPERATURE: 0.2
          GITHUB_TOKEN: ${{ github.token }}

Provider examples

Anthropic:

with:
  PROVIDER: anthropic
  API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  MODEL_NAME: claude-sonnet-4-5
  GITHUB_TOKEN: ${{ github.token }}

Google Gemini:

with:
  PROVIDER: google
  API_KEY: ${{ secrets.GEMINI_API_KEY }}
  MODEL_NAME: gemini-2.5-pro
  GITHUB_TOKEN: ${{ github.token }}

NVIDIA NIM:

with:
  PROVIDER: nvidia
  API_KEY: ${{ secrets.NVIDIA_API_KEY }}
  MODEL_NAME: meta/llama
  GITHUB_TOKEN: ${{ github.token }}

OpenRouter:

with:
  PROVIDER: openrouter
  API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
  MODEL_NAME: openai/gpt-5.2
  GITHUB_TOKEN: ${{ github.token }}

Report Template

# Yang Code Review (YCR) Report

## Scope and Classification
- Reviewed target: [repo/module/change-set]
- Detected domain(s): [Web/API/Mobile/ML/IoT/LLM/MCP/IaC]
- OWASP edition(s) applied: [e.g., Web 2025, API 2023, LLM 2025]

## Executive Summary
- Total findings: [count]
- Critical: [count]
- High: [count]
- Medium: [count]
- Low: [count]
- Info: [count]
- Top risks:
  1. [...]
  2. [...]
  3. [...]

## Detailed Findings

### YCR-001
- Severity: [Critical|High|Medium|Low|Info]
- OWASP Mapping: [category + edition]
- Location: [file:line]
- Description: [...]
- Impact: [...]
- Evidence: [...]
- Remediation: [...]
- Secure code example (optional): [...]

## Checklist
- [ ] Domain-specific OWASP checks completed
- [ ] OWASP Secure Code Review Checklist core areas covered
- [ ] IaC Security Cheat Sheet controls applied (if IaC in scope)

## Residual Risk and Verification Gaps
- Not fully verified: [...]
- Recommended follow-up tests: [...]

### Report Generated by Yang Code Review (YCR) - YangYang Organization

🛡 Security

• API_KEY and GITHUB_TOKEN are masked automatically in GitHub Actions logs.
• Keep provider keys in GitHub Secrets only; never print or commit them.
• The code diff is sent directly to the selected provider. Review that provider's data retention policy before enabling the action on private code.

🏷 Marketplace

This action is marketplace-ready:

• Bundled with @vercel/ncc
• Branded icon & color
• Semantic versioning recommended (v1, v1.1.0)

🏗 Build (Required) - For Developers

This action uses @vercel/ncc to bundle all dependencies into a single file.

npm install
npm run build

This will generate dist/index.js which must be committed.

📝 License

This project is licensed under the MIT License - see the LICENSE.md file for details.

🤝 Contributing

Contributions are welcome! Please feel free to submit a pull request.