Hodor Bot

Reusable Forgejo Actions workflow for AI-powered code reviews via Hodor, routed through a LiteLLM proxy.

Quick Start

Add this to your repository's .forgejo/workflows/hodor.yml:

name: Hodor Review

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  hodor-review:
    uses: simcop2387/hodor-bot/.forgejo/workflows/review.yml@0.2.0
    with:
      pr-url: "https://forgejo.simcop2387.info/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}"
    secrets: inherit

Prerequisites

Your repository needs these secrets configured:

Secret	Description
HODOR_LLM_API_KEY	API key for the LiteLLM proxy
HODOR_FORGEJO_TOKEN	Token for the HodorBot user (with PR comment permissions)

Configure these in your repository settings at Settings > Actions > Secrets.

Available Profiles

Profile	Description
default	General bug-finding (default)
security	Security-focused review
performance	Performance-focused review

Configuration

Basic Usage

jobs:
  hodor-review:
    uses: simcop2387/hodor-bot/.forgejo/workflows/review.yml@0.2.0
    with:
      pr-url: "https://forgejo.simcop2387.info/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}"
    secrets: inherit

With Profile Selection

jobs:
  hodor-review:
    uses: simcop2387/hodor-bot/.forgejo/workflows/review.yml@0.2.0
    with:
      profile: security
    secrets: inherit

With Additional Instructions

jobs:
  hodor-review:
    uses: simcop2387/hodor-bot/.forgejo/workflows/review.yml@0.2.0
    with:
      profile: default
      additional-instructions: "Focus on authentication changes"
    secrets: inherit

Full Configuration

jobs:
  hodor-review:
    uses: simcop2387/hodor-bot/.forgejo/workflows/review.yml@0.2.0
    with:
      pr-url: "https://forgejo.simcop2387.info/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}"
      profile: security
      additional-instructions: "Focus on auth changes"
      model: openai/Qwen3.6-27B-single:medium
      reasoning-effort: high
      review-style: hybrid
      fail-on-priority: P1
      verbose: 'false'
    secrets: inherit

Input Reference

Input	Default	Description
profile	default	Review profile: default, security, performance
additional-instructions	''	Extra instructions appended to the profile
model	openai/Qwen3.6-27B-single:medium	LLM model to use
reasoning-effort	''	Reasoning effort: low, medium, high, xhigh
review-style	hybrid	Posting style: summary, inline, hybrid
fail-on-priority	''	Fail pipeline on findings at or above: P0, P1, P2, P3
verbose	false	Enable verbose logging
pr-url	''	Full PR URL (required, see Quick Start)

Versioning

The Hodor image is versioned with semver tags. Consuming repos should pin to a specific version:

uses: simcop2387/hodor-bot/.forgejo/workflows/review.yml@0.2.0

Available tags:

• 0.2.0 — full semver
• 0.2 — minor version
• 0 — major version
• latest — latest build (not recommended for production)
• main — latest main branch build
• run-<number> — specific build run

Creating Custom Profiles

Profiles are Markdown files stored in the profiles/ directory. To add a new profile:

1. Create profiles/myprofile.md with your review instructions
2. Rebuild the container image
3. Push the new image tag
4. Reference it in your workflow: profile: myprofile

Profile structure:

# Review Judgment Profile

## Mission
What this profile is looking for.

## Evidence Standard
What qualifies as a finding.

## Comment Quality
How findings should be written.

## Lenses
Specific areas to focus on.

See profiles/default.md, profiles/security.md, and profiles/performance.md for examples.

Architecture

• Container Image: Custom Docker image based on upstream Hodor with LiteLLM support
• Registry: forgejo.simcop2387.info/simcop2387/hodor
• LLM Proxy: LiteLLM at litellm.ai.simcop2387.info
• Forgejo Instance: forgejo.simcop2387.info

Building the Container

The container builds automatically on push to main or when a v* tag is pushed. Manual builds:

# Trigger via workflow dispatch
forgejo actions workflow-dispatch simcop2387/hodor-bot build-container

Release Tagging

Create a new semver tag via the release-tag workflow:

# Trigger via workflow dispatch
forgejo actions workflow-dispatch simcop2387/hodor-bot release-tag

Choose patch, minor, or major bump, or specify an explicit version.

Troubleshooting

No API key found

Set HODOR_LLM_API_KEY in your repository secrets.

Authentication failed

Set HODOR_FORGEJO_TOKEN in your repository secrets with PR comment permissions.

Profile not found

Check the profile name matches one of: default, security, performance.

Review is too slow

• Avoid running on draft PRs
• Skip docs-only changes in your workflow rules
• Use --reasoning-effort low for routine changes