ENGINEERING

AI code review in GitHub Actions, answered by your own gateway

August 2026 · 4 min read

Just activated iSol API? Your key lives in the customer portal, isollm.ai/account → API keys (the portal shows the raw sk-… value; store it in your secret manager). The endpoint for every guide on this blog is https://tokens.4clouders.com/v1, and per-key spend updates live on the same portal page. That is all you need to follow along.

Why review in CI, and why through your gateway

A reviewer in CI never gets tired and never skips a diff. But piping every diff to a vendor API means your unreleased code leaves the building on every push. Run the same review through a gateway you control and the diff terminates on your infrastructure, with per-key budgets and one audit log, like every other tool in this series.

Everything on this page is public and real: the repo is github.com/TiagoMCF/isol-gateway-demos and the run shown below is run 32306286574, click through and check.

Step 1: Add the secret

gh secret set ISOL_API_KEY -R your-org/your-repo -b "sk-your-gateway-key"

One secret. The vendor credential never exists in the repo, the gateway holds the upstream keys.

Step 2: The workflow (complete, 30 lines)

name: AI review (sovereign gateway)
on:
  push: { branches: [main] }
  workflow_dispatch:

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 2 }
      - name: Ask the gateway to review the change
        env: { ISOL_API_KEY: ${{ secrets.ISOL_API_KEY }} }
        run: |
          DIFF=$(git show HEAD | head -120)
          BODY=$(jq -n --arg diff "$DIFF" '{
            model: "isol-4.9",
            messages: [
              {role:"system", content:"You are a strict code reviewer. Reply in GitHub-flavored markdown: 2-4 bullet findings, then a one-line verdict."},
              {role:"user", content:("Review this change:\n```diff\n" + $diff + "\n```")}
            ]}')
          REVIEW=$(curl -s https://tokens.4clouders.com/v1/chat/completions \
            -H "Authorization: Bearer $ISOL_API_KEY" \
            -H "Content-Type: application/json" \
            -d "$BODY" | jq -r '.choices[0].message.content')
          echo "## 🤖 AI review" >> "$GITHUB_STEP_SUMMARY"
          echo "$REVIEW" >> "$GITHUB_STEP_SUMMARY"

Step 3: Push and read the review

The run below reviewed the exact commit that added an echo to the workflow, and the model called out that very change as unnecessary and mildly risky. A reviewer with opinions, on your infrastructure:

Real GitHub Actions run: isol-4.9 reviewing the pushed diff through the sovereign gateway — Real run, captured 2026-08-19: verify it on GitHub. Key masked by Actions itself.

Vídeo real navegando no repositório público: o workflow completo, a aba Actions com os runs e o run que revisou o próprio commit. Nada aqui é mock, você pode abrir o repo e conferir os mesmos números.

Gotchas we hit running this for real

Apostrophes in run: blocks. Our first run failed on a quote inside an echo. Keep shell strings boring.
Push tokens need the workflow scope to add workflow files over HTTPS, an SSH deploy key sidesteps it.
Cap the diff (head -120), a giant vendored-file commit does not need a poem written about it, and your per-key budget will thank you.

Repo, workflow and run on this page are public, created and executed against the live iSol gateway on 2026-08-19.