Forge reviewers: GitHub, GitLab, Bitbucket and Azure DevOps

CI review with the downloaded CLI

Copy examples/github-workflow.yml into .github/workflows/codejackrabbit-review.yml:

name: CodeJackRabbit Review
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
permissions:
  contents: read
  pull-requests: write
  issues: write
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install CodeJackRabbit CLI
        shell: bash
        run: |
          manifest="$(curl -fsSL https://cli.codejackrabbit.com/releases/latest.json)"
          url="$(MANIFEST="$manifest" python3 -c 'import json, os; data=json.loads(os.environ["MANIFEST"]); print(next(a["url"] for a in data["assets"] if a["platform"] == "linux-x64"))')"
          curl -fsSL "$url" -o /usr/local/bin/cjr
          chmod +x /usr/local/bin/cjr
      - name: Review pull request changes
        shell: bash
        run: cjr review --local --committed --base "origin/${{ github.base_ref }}" --fail-on none

The workflow downloads the Linux CLI from the private R2 release channel and writes findings to the job log. It needs no access to CodeJackRabbit source. For one updated walkthrough comment, inline findings and checks in the pull request itself, use the GitHub App webhook below. Server mode in CI takes a repository secret for the API key.

An internal composite action also exists for repositories inside the operator's own organization; it is not the public installation path.

GitHub App webhook

Your server exposes POST /github/webhook, verifies X-Hub-Signature-256, resolves repository configuration, then reviews supported pull-request events.

Create a GitHub App with webhook https://api.codejackrabbit.com/github/webhook or your public host. Repository permissions: Contents read, Pull requests read/write, Issues read/write, Checks read/write and Metadata read. Subscribe to Pull request, Issue comment, Pull request review comment, Issues and Merge group. Store these only on the server:

The server signs a short-lived RS256 app JWT and exchanges it for a cached installation token per webhook installation. A static fine-grained CJR_GITHUB_TOKEN remains a fallback for simple setups.

Behaviors include check runs with commit-status fallback, inline comments anchored to real diff lines, high-level summary/title placeholders, CODEOWNERS reviewer suggestions or assignment, labels, auto-review filters, incremental reuse, merge groups and post-merge tasks. Inline approval happens only when reviews.requestChangesWorkflow is enabled.

GitHub browser login can be configured separately with an OAuth app: CJR_GITHUB_OAUTH_CLIENT_ID, CJR_GITHUB_OAUTH_CLIENT_SECRET and CJR_PUBLIC_URL; the authorized callback is /auth/github/callback.

GitLab

Create a project or group webhook to /gitlab/webhook for merge request and note events, with the same secret as CJR_GITLAB_WEBHOOK_SECRET. Set CJR_GITLAB_TOKEN; set CJR_GITLAB_API only for a self-managed API base. Draft merge requests are skipped. New or updated merge requests are reviewed from their diff and raw head-branch files; the result is posted as one note. @codejackrabbit review notes trigger a fresh review.

Bitbucket Cloud

Create a repository webhook to /bitbucket/webhook for pull request created/updated and comment-created events. Configure its secret and one credential pair on the server: CJR_BITBUCKET_TOKEN, or CJR_BITBUCKET_USERNAME plus CJR_BITBUCKET_APP_PASSWORD. If no HMAC header is sent, the endpoint also accepts the secret as the secret query parameter in the webhook URL. Reviews fetch the pull-request diff and raw source files, then publish one comment.

Azure DevOps

Create a Service Hooks subscription for pull-request created, updated, merged and comment events pointing to /azure/webhook, protected by the configured Basic credentials. Set CJR_AZURE_DEVOPS_TOKEN to a PAT with Code read and Pull Request Threads write access. The server reads the latest pull-request iteration, its changes and raw file contents, reviews them, and posts a new active PR thread. Comment text containing @codejackrabbit review triggers the same path.

Slack and Discord