Watchdog Lab
GitHubProducts
GitHub Action · watchdoglab/watchdog-action@v1 ↗

The pack, on every pull request.

Security review in CI. Watchdog comments on risky lines with a fix, then posts one summary. Bring Claude, GPT, Gemini or Codex.

Set up in 2 minutes →View on GitHub ↗
Add user lookup route #41
Opendev-ana wants to merge 1 commit into main
ConversationChecks 1Files changed 1
dev-ana opened this pull request
Some checks haven't completed yetWatchdog PR Review / review (pull_request)
Inline comments with a fix
Claude, GPT, Gemini or Codex
Read-only and fork-safe
Setup

Three steps.

  1. 1

    Add your AI key as a repo secret, e.g. ANTHROPIC_API_KEY (Settings → Secrets and variables → Actions).

  2. 2

    Save the workflow as .github/workflows/watchdog-review.yml.

  3. 3

    Open a PR. Watchdog comments on risky lines and posts a summary.

watchdog-review.yml
name: Watchdog PR Review

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - uses: watchdoglab/watchdog-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          dogs: all          # or web, api, auth, ai-app, secrets, ...
          min_severity: medium
Your AI, your bill

Pick the AI and how you pay.

AIHow you paySet in with:
ClaudeAnthropic API keyanthropic_api_key
ClaudeClaude Pro/Max planclaude_code_oauth_token (from claude setup-token)
ClaudeAmazon Bedrockprovider: bedrock + AWS credentials step
ClaudeGoogle Vertex AIprovider: vertex + Google auth step
GPT, Gemini, Grok, DeepSeek, Qwen…OpenRouter keyprovider: openrouter, openrouter_api_key, model
OpenAI CodexOpenAI API keyengine: codex, openai_api_key
OpenAI CodexChatGPT Plus/Pro (private repos)engine: codex, codex_auth_json
GeminiGemini API keyengine: gemini, gemini_api_key
GeminiVertex AI or Code Assistengine: gemini, gemini_auth + gcp_* inputs

Store every key or token as a repo secret.

Inputs

Tune the review.

engine

claude (default), codex or gemini.

dogs

Which review: all, web, api, auth, ai-app, secrets, …

min_severity

Skip findings below this. Default medium.

model

Model ID for your provider. Empty uses the engine default.

provider

Claude only: anthropic, bedrock, vertex or openrouter.

github_token

Token used to post comments. Defaults to the job token.

Safety

Built for untrusted PRs.

  1. 1

    Runs on pull_request, not pull_request_target, so PRs from forks never see your secrets.

  2. 2

    The reviewer can only read code and post comments. It cannot push or run project code.

  3. 3

    Codex runs in a read-only sandbox and Gemini gets read-only tools.

  4. 4

    PR text is treated as untrusted input, never as instructions.

Want the dogs while you code, too?

Watchdog for Claude Code →Action on GitHub ↗