Robin

Free AI code reviews for every pull request. You bring an API key; Robin reviews show up like a teammate left comments.

# .github/robin.yml on the PR base branch
agent-mode: off

• A review when you open a pull request (or when someone comments /robin)
• A short summary plus inline comments on changed lines, with one-click suggested fixes when the model can pin one down
• Reviews with repository tools by default, so tool-capable models can check callers, types and tests; explicit agent-mode: off keeps diff-only reviews
• Your choice of AI provider — including free options

When there's nothing worth flagging, Robin reports No issues found.

You are not signing up for a separate review bot service. The workflow runs in your repo and calls the AI URL you configure.

Using Cursor, Copilot, Claude Code, or similar? Copy this prompt after secrets are set:

Add Robin to this repository.
- Workflow file: .github/workflows/robin.yml
- Reusable workflow: antongulin/robin/.github/workflows/review.yml@main
- Action ref if needed: antongulin/robin@main
- Secrets: LLM_API_KEY, LLM_BASE_URL, LLM_MODEL
- Do NOT use @v0 or any v0 tag
- Do NOT use pull_request_target
Read AGENTS.md in the robin repo for full rules.

From the target repository, run either:

npx robin-review

or, without Node.js:

curl -fsSL https://robinreview.dev/install.sh | bash

Either one keeps a single canonical .github/workflows/robin.yml and installs or updates the companion chat skill in your coding agents. If it finds an older Robin or Universal Code Reviewer workflow under another name, it moves that file to .github/robin-workflow-archive/ (where GitHub cannot trigger it) before creating the canonical workflow. Inspect the archived copy, then remove it after confirming the migration. An unrelated file already using the canonical path is never overwritten. Run an installer separately in every repository that should use Robin. Re-running it is safe and idempotent — your workflow ref and any with: overrides (for example llm-temperature) are preserved. You still need to add the three secrets — do Steps 1 and 2 below, then commit and push. You can skip Step 3: the installer already did it.

Auto-updates: the generated workflow references antongulin/robin/.github/workflows/review.yml@main and follows changes on main. ROBIN_REF=v2 npx robin-review selects the floating v2 workflow ref. That workflow still calls the action at @main; see Version pins to pin the action implementation or keep diff-only mode across updates.

Prefer to do it by hand, or read the installer first? It's bin/robin-review.js (npm) / scripts/install.sh (curl) — or follow the manual 3 steps instead.

The easiest free setup uses OpenRouter:

1. Create an account at openrouter.ai.
2. Create an API key in the dashboard.
3. Use these values for your GitHub secrets:

Other providers (OpenAI, Groq, Ollama, etc.) work too. See Supported providers or docs/ADVANCED.md.

1. Open your repository on GitHub (not this one).
2. Go to Settings → Secrets and variables → Actions.
3. Click New repository secret and add each name from the table above.

Create a new file in your repo:

Path: .github/workflows/robin.yml

Contents: copy this exactly:

name: Robin

on:
  pull_request:
    types: [opened, reopened, ready_for_review]
  issue_comment:
    types: [created]

permissions:
  actions: read
  contents: read
  pull-requests: write

jobs:
  review:
    uses: antongulin/robin/.github/workflows/review.yml@main
    secrets:
      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
      LLM_MODEL: ${{ secrets.LLM_MODEL }}

Commit and push, then open a pull request. Follow the run in Actions; review timing varies with the workload and provider.

By default Robin reviews when the PR opens (and on /review), not on every push. To also review each push, add synchronize to the pull_request types: and set review-on-synchronize: true in the job's with: block.

Open the LLM usage section of the Actions job summary to see provider-reported prompt, completion, cached-input and reasoning tokens across the invocation. Robin counts physical requests, including retries, compaction and diff-only fallback. Missing or interrupted usage stays unknown; known sums can be partial.

The reusable workflow exposes compact JSON as usage-report; dependent jobs read needs.<your-review-job>.outputs.usage-report. Direct action steps also expose usage-report-path, a full sanitized ledger for later steps in that same job. The local file is not a downloadable artifact. See report fields and retention.

These observations do not establish billed dollars, plan percentages or a token budget. Robin adds no model requests or usage-request parameters for reporting.

By default, the reusable workflow runs on GitHub's hosted ubuntu-latest runner:

with:
  runner: '"ubuntu-latest"'

To run reviews on your own machine, Mac mini, home server, local Linux box, or Coolify runner, pass runner as valid JSON. Use a JSON string for one label or a JSON array for multiple labels.

To create a local runner, go to:

Repository Settings -> Actions -> Runners -> New self-hosted runner

Then add labels such as local, linux, mac, or coolify, and reference those labels through the runner input.

A matching self-hosted runner must be online when GitHub starts the review job. It can be a local runner process (./run.sh), a service (./svc.sh start), a Docker container, or a Coolify-managed service. Docker is optional; it is just one way to run the GitHub Actions runner.

If no matching runner is online, GitHub queues the job until one comes online. It will not fall back to ubuntu-latest unless you add a separate fallback job. For reliable PR reviews, keep an always-on runner available, such as a Mac mini, home server, VPS, or Coolify service. A laptop runner only works while the laptop is awake and the runner process or service is running.

Local machine runner:

jobs:
  review:
    uses: antongulin/robin/.github/workflows/review.yml@main
    with:
      runner: '["self-hosted", "local"]'
    secrets:
      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
      LLM_MODEL: ${{ secrets.LLM_MODEL }}

Coolify runner:

jobs:
  review:
    uses: antongulin/robin/.github/workflows/review.yml@main
    with:
      runner: '["self-hosted", "linux", "coolify"]'
    secrets:
      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
      LLM_MODEL: ${{ secrets.LLM_MODEL }}

Robin uses github-actions[bot] by default. Existing workflows and the three-secret setup need no changes. To post as your own GitHub App, create its token and run the direct Robin action in the same job. Reusable-workflow callers can opt in by passing the optional ROBIN_TOKEN secret, for example a fine-grained PAT.

See Custom review identity for complete examples, permissions, PAT limitations, and installer behavior. Custom identity workflows stay intact when you rerun either installer; update their refs manually.

/review still works as an alias for /robin. Only people with write access (or higher) on the repo can run these commands by default.

The bot posts a status comment, then a review with severity counts:

## <img src="https://www.robinreview.dev/brand/favicon-48.png" width="24" height="24" alt="" /> The <a href="https://www.robinreview.dev/">Robin</a> Hood of code review

<!-- :bow_and_arrow: Robin -->

> **Heads up:** this is a point-in-time review. Push fixes freely, then comment `/robin` whenever you want another pass.

🚨 **1 High** | ⚠️ **1 Medium** | 💡 **2 Suggestions**

### Summary
Focused change. Main risk: timeout errors are not handled clearly.

### Findings Not Posted Inline
**1 (`src/example.ts:24`)** — Retries exist but timeout failures lack context.

Robin defaults to agent-mode: auto when neither an input nor base-branch config sets the mode. A tool-capable model can read full files, grep for callers of a changed function, and check types and tests at the PR's head commit before reporting a bug. Findings can come with a one-click GitHub suggested change containing the exact fix.

• Robin downloads a read-only snapshot through the GitHub API; no checkout is needed and Robin never executes PR code.
• Tool rejection or snapshot failure triggers an attempted complete diff-only fallback, subject to max-diff-size. Warnings and the final status show the fallback reason; size or provider failures can still stop the review.
• Set agent-mode: off to skip the snapshot and tools. Use this for weak/local models until you have checked tool behavior, review quality and context capacity. agent-max-turns defaults to 40; extra requests can add time and usage.
• Context compaction works on the investigation history only: a 450k-byte soft target on everything after the system prompt and original diff, mechanical pruning of already-consumed tool results, then at most one model-written summary per new evidence step. A default run can still send a larger accepted request, and the provider's own context limit remains the hard boundary; it cannot guarantee that a small-context model fits or that a review completes. Explicit truncated output fails the review.
• Investigation time is capped at 30 minutes, with part of it reserved for the final no-tools answer; an in-flight request is aborted at its deadline.

Details: Agent mode and migration guidance.

The one-line installer also installs a small companion skill into every coding agent on your machine (Claude Code, Cursor, Copilot, Windsurf, …) via the cross-platform skills CLI — npx -y skills add https://github.com/antongulin/robin --skill robin --agent '*' --global --yes. It ships with Robin; there's nothing separate to sign up for. (Skip it with ROBIN_SKILL=0, or install it by hand with that command.) Once installed, the skill activates for ordinary pull-request work: the agent detects Robin on the base branch, so you do not need to ask for Robin explicitly. Explicit requests still work too:

"create a pull request" · "review this PR with Robin" · "fix the Robin feedback"

The agent drives a bounded review → verify → fix → reply → resolve → re-review loop. It fixes only findings confirmed against the full repository and skips noise with a factual reply. Five completed Robin reviews are approved by default; above five, the agent asks for one additional review at a time unless you explicitly enabled full-auto review for that PR. Merge is a separate permission and remains manual by default. After an authorized merge, the agent verifies base-branch sync and task-branch cleanup. Release preparation is never automatic; when the repository already publishes releases, the final report may offer it as a separate next step. Source: skills/robin/SKILL.md.

Anthropic works through its OpenAI-compatible endpoint with your regular Anthropic API key; pasting https://api.anthropic.com without /v1 is fine too. Keep your existing OpenCode Go LLM_API_KEY and provider settings; Robin supplies the required User-Agent and a stable session ID automatically when the official Go endpoint is configured. For OpenCode Go with deepseek-v4.1-flash, set reasoning-effort: max in .github/robin.yml to send top-level reasoning_effort: "max". Go rejections surface as errors; Robin keeps the configured effort on retries. OpenAI reasoning models (o1/o3/o4-mini, gpt-5*, codex-*) are sent without temperature and with max_completion_tokens automatically. See Provider notes.

GitHub’s servers cannot reach localhost on your laptop. For Ollama at home, use a public server, a tunnel, or a self-hosted runner.

Copy .github/robin.yml.example to .github/robin.yml to tune estimated-request-token-budget, max-diff-size and agent-max-diff-size together, skip extra paths, and more. The same file is the normal place to change reasoning-effort for providers that expose reasoning controls; when it is unset Robin sends no reasoning control and the provider/model decides, and off is an explicit way to send nothing. Details: docs/ADVANCED.md and Reasoning effort.

Existing installations keep their current behavior without adding settings. Set workflow inputs in the caller workflow's with: block (or the direct action's with: block). Set repository config on the PR base branch in .github/robin.yml; use config-file for another path. See the complete input reference and config precedence for validation and exceptions.

Triggers, authors, and permissions:

The bot author filter applies only to automatic PR reviews. Authorized /review commands can review excluded bot PRs. Blank bot inputs defer to base config; bot-allowlist: '[]' clears that list in workflow inputs. Use bot-allowlist: [] in repo config to clear it there. Choose none to exclude all bots.

Review scope, results, and instructions:

Model requests and repository context:

Blank inputs for request-changes, reasoning-effort, use-json-response-mode, max-diff-size, estimated-request-token-budget and the three agent-* settings defer to repo config, then to these defaults. Omit the boolean request-changes input on reusable-workflow callers to defer to repo config. The required model and endpoint remain LLM_MODEL and LLM_BASE_URL secrets (direct action inputs model and llm-base-url).

Add .github/code-reviewer.md in your repo:

# Reviewer rules

- Focus on bugs and security, not formatting.
- Ask for tests when business logic changes.

More fixes: docs/ADVANCED.md#troubleshooting

For a direct action step (uses: antongulin/robin@…):

For a reusable workflow, the ref selects the workflow file. The verified workflow files at main, v2 and v2.12.4 call antongulin/robin@main inside the job. Even an exact tag or SHA of those workflow files does not freeze the nested action. Those callers receive action changes from main independently of the outer workflow's release.

uses: antongulin/robin/.github/workflows/review.yml@v2

This example follows the v2 workflow while its nested action follows main. To keep diff-only mode, set explicit off. To pin the implementation, use a direct action step at an exact release or full SHA with the required permissions and credentials; see the direct action example.

Releases and notes are published automatically from CHANGELOG.md when changes land on main. See CONTRIBUTING.md for commit message format.

• docs/ADVANCED.md — all settings, strict mode, manual-only reviews, security notes
• CONTRIBUTING.md — run tests and send pull requests
• CHANGELOG.md — release history

Robin is free and open source (MIT). If it saves you money on code review, you can help keep it maintained:

• ⭐ Star the repo — it's the cheapest way to help others find it.
• 💛 Sponsor the project to support ongoing work.
• 🐛 Open an issue for bugs or ideas.

Built by Anton Gulin, AI Architect building AI systems, agent workflows, and software automation. Need a custom AI agent, code-review pipeline, or QA automation? Visit Anton.QA.

git clone https://github.com/antongulin/robin.git
cd robin
npm ci
npm run lint
npm test
npm run build

Runtime code lives in dist/index.js; run npm run build before releasing. A full build removes intermediate files under dist/ after bundling so only index.js remains locally (same file CI checks against).

If you ran tsc alone and see extra files under dist/, run npm run clean.