Private AI PR Reviewer, published by Cody Labs. Effective 3 August 2026.
The unmodified Action has no code path that intentionally sends source code, pull-request data, prompts, model responses, or provider API keys to a Cody Labs-operated service. Use a GitHub-hosted runner or an ephemeral, single-purpose self-hosted runner that you secure and clean between jobs. The Action calls the provider you select.
The workflow runner reads pull-request data through the GitHub API, sends the assembled review request directly to the selected Anthropic or OpenAI API, and writes the response to the pull request through the GitHub API. GitHub and the selected provider process that data under their own privacy policies, logs, retention settings, and account controls. The unmodified Action contains no Cody Labs proxy, model endpoint, analytics collector, or telemetry integration. User-modified workflows and self-hosted runner configuration are outside Cody Labs' control.
Provider keys should be stored as GitHub Actions secrets. The Action process and all installed dependencies necessarily have process-level access to those environment values. The inspected, unmodified release intentionally passes the provider key to the selected provider SDK, does not include it in the review prompt or PR comment, and contains no integration that sends it to Cody Labs. Repository owners remain responsible for reviewing the pinned code and dependencies, secret configuration, workflow permissions, and provider-account security.
The documented workflow uses pull_request_target so the workflow definition comes from the protected base branch. Do not check out or execute pull-request code in a review job that receives secrets. Repository owners control and are responsible for any workflow changes they make.
The unmodified Action has no integration that sends review data to Cody Labs for retention. Review comments and workflow logs are retained by GitHub according to your repository and account settings. Prompts and responses are handled by your selected model provider according to its terms, privacy policy, and account controls.
The Action's source is available for inspection at github.com/codylabs/cody-code-reviewer. Report a suspected vulnerability through the repository's security instructions rather than a public issue.
Questions about this policy: [email protected].