GitHub Action

Mel review is a GitHub Action that reviews each pull request and leaves one comment: a short summary and its findings, each at a file:line of the new code. It updates that same comment every time the pull request changes. It only reads the pull request, never runs anything in it, and uses your own model keys.

Not available yet. The Action is not published on GitHub yet, so uses: openmeldev/mel-review-action@v1 does not work today. When it is, it runs on the Mel API plan ($49 a month, 1,000 runs included; see pricing). If the plan isn't listed on pricing, the Action stops with the message api_not_offered and a link to pricing.

Set it up

# .github/workflows/mel-review.yml
name: Mel review
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: write

jobs:
  review:
    if: ${{ !github.event.pull_request.draft }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2
          persist-credentials: false
      - uses: openmeldev/mel-review-action@v1
        env:
          MEL_API_KEY: ${{ secrets.MEL_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

1. Create a Mel API key in your account (see Mel API keys) and store it as the repository secret MEL_API_KEY.
2. Store at least one model key of your own as a repository secret, and pass it in the step's env under the name Mel reads: GROQ_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, DEEPSEEK_API_KEY, MOONSHOT_API_KEY, GLM_API_KEY, X_AI_API, MINIMAX_API, ALIBABA_API_KEY, NVIDIA_API_KEY or MIMO_API_KEY. With model: auto, Mel picks among the models your keys reach.
3. Keep the checkout's default ref and fetch-depth: 2. The default ref is the pull request merged onto its base, which is the code that would land, and depth 2 brings the base so the review compares exactly the pull request's change.

Model calls go out on your keys and spend no Mel credits.

Inputs

Outputs: status (reviewed, skipped, failed), findings, high, medium, low, comment-url, review-json and review-markdown. The review is also written to the job's summary page.

Pull requests from forks

GitHub gives a fork's pull request no secrets under pull_request, so there's no Mel API key to review with. The Action skips, logs why, and exits 0. Dependabot runs read Dependabot secrets, so add MEL_API_KEY there to review its pull requests.

Don't switch to pull_request_target to review forks. That event hands your secrets and a write token to code anyone can submit. The Action refuses to run on it.

What is sent

To Mel's relay, which passes it to the model provider your key selects and stores none of it:

• the pull request's title and description (the first 4,000 characters);
• its diff, up to max-diff-chars (lockfiles and very large files are named with their size instead);
• the list of changed files, and MEL.md from the base branch if there is one;
• the files of the pull request the review chooses to read;
• your model key with each model call.

The relay records the run itself: when it started and ended, and how.

Not sent: your environment, any secret other than the model keys you pass, the job's token, .git, files the review doesn't open, and anything outside the repository.

Safety

• Nothing in the pull request runs. The review has five read-only tools: read a file, list a folder, search contents, find files by name, match a glob.
• It reads a copy. The reviewed commit is exported to a fresh folder with no .git, no symbolic links and no submodules. A path that leaves that folder is refused.
• The pull request is untrusted. Text in it that addresses the reviewer ("ignore your instructions") is reported as a finding, never followed.
• No secret reaches the comment. Keys and tokens are replaced wherever they appear, and the comment can't mention people, embed images or carry raw HTML.
• Least permissions. contents: read and pull-requests: write. The token is used only to list, create and update the review comment, and the Action updates only a comment its own token wrote.

Limitations

• Needs a Linux x64 runner (ubuntu-latest). On a minimal self-hosted runner it may need ALSA's libasound2, and the Action names it if it's missing.
• Needs the Mel API plan; see pricing.

Troubleshooting

The run stopped with api_not_offered. The Mel API plan isn't on sale yet.

The run was skipped. It's a fork's pull request (no secrets), or MEL_API_KEY isn't set. The log says which.