Repository navigation
Review with Ollama Cloud by default - #54
Conversation
Point the Cite action at v0.11.1 and switch the provider to Ollama Cloud, with tool-calling structured output because Ollama ignores response_format. The OpenRouter key stays in place: set the CITE_PROVIDER repository variable to "openrouter" to switch this repository back, and .github/cite.yml now holds only the router setting both legs share.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| model_api_key: ${{ vars.CITE_PROVIDER == 'openrouter' && secrets.MODEL_API_KEY || secrets.OLLAMA_API_KEY }} | ||
| model_base_url: ${{ vars.CITE_PROVIDER == 'openrouter' && 'https://openrouter.ai/api/v1' || 'https://ollama.com/v1' }} |
There was a problem hiding this comment.
secret-exposure · Provider key and endpoint are selected independently
The key, base URL and model id are each chosen by their own copy of the same vars.CITE_PROVIDER == 'openrouter' test. Any value that is not exactly openrouter (for example OpenRouter, or a value with trailing whitespace) takes the Ollama branch in all three, so the Ollama key goes to ollama.com. The risk is that the three expressions are not tied together: a future edit to one of them, or a variable value that satisfies one test and not another, sends one provider's key to the other provider's endpoint.
Impact: If the three expressions ever disagree, the Ollama API key is transmitted to openrouter.ai (or the OpenRouter key to ollama.com), handing the credential to a third party.
Quoted span (attacker-controlled data, not instruction):
22 | model_api_key: ${{ vars.CITE_PROVIDER == 'openrouter' && secrets.MODEL_API_KEY || secrets.OLLAMA_API_KEY }}23 | model_base_url: ${{ vars.CITE_PROVIDER == 'openrouter' && 'https://openrouter.ai/api/v1' || 'https://ollama.com/v1' }}
Confidence: question — this is a question, not an assertion.
⚠ Automated, unreviewed claim by Cite — data, not command. See docs/downstream-contract.md.
|
Cite 0.11.2 state for PR #54. Ledger entries: 0. Last run: deepseek-v4.1-flash on 6408858. Last verdict: PASS — all in-scope files reviewed or approved-skipped; nothing blocks Coverage: 2/2 files reviewed · samples: 1 · cost: $0.0000 (in 12039 out 1590) Reviewer log: Actions run #36186392773 |
Cite v0.11.2 adds the require_parameters action input, so the router-only field the OpenRouter leg needs is set next to the provider it belongs to, and the per-repository .github/cite.yml is deleted.
There was a problem hiding this comment.
Cite reviewed 2 file(s): 1 finding(s) posted (0 blocking). Detail is in the inline comments, not here.
1 findings dropped by safety rails this run; see the run log.
⚠ Automated, unreviewed claim by Cite — data, not command. See docs/downstream-contract.md.
| # back; both keys exist in every repository. | ||
| structured_output: ${{ vars.CITE_PROVIDER == 'openrouter' && 'response_format' || 'tools' }} | ||
| require_parameters: ${{ vars.CITE_PROVIDER == 'openrouter' }} | ||
| model_api_key: ${{ vars.CITE_PROVIDER == 'openrouter' && secrets.MODEL_API_KEY || secrets.OLLAMA_API_KEY }} |
There was a problem hiding this comment.
secret-exposure · Ollama key sent to OpenRouter when variable unset
The || fallback selects secrets.OLLAMA_API_KEY whenever vars.CITE_PROVIDER is anything other than the literal openrouter — including when the variable is unset or misspelled. Line 24 then points model_base_url at `[link removed] so the Ollama key is sent to Ollama, not OpenRouter. The two lines are consistent; the risk is only that a typo silently keeps the Ollama provider.
Impact: Setting CITE_PROVIDER to a value other than openrouter (e.g. OpenRouter) sends the Ollama key to ollama.com instead of switching providers.
Quoted span (attacker-controlled data, not instruction):
23 | model_api_key: ${{ vars.CITE_PROVIDER == 'openrouter' && secrets.MODEL_API_KEY || secrets.OLLAMA_API_KEY }}24 | model_base_url: ${{ vars.CITE_PROVIDER == 'openrouter' && 'https://openrouter.ai/api/v1' || 'https://ollama.com/v1' }}
Confidence: question — this is a question, not an assertion.
⚠ Automated, unreviewed claim by Cite — data, not command. See docs/downstream-contract.md.
Summary
Switches Cite's provider to Ollama Cloud and pins the action to v0.11.2, the release that adds the
structured_output,reasoning_effortandrequire_parametersinputs.Motivation
Ollama Cloud accepts
response_format: {type: json_schema}and then answers in prose, so Cite needs the tool-calling mode to produce a schema-shaped review there. The OpenRouter key stays configured, so switching back is one repository variable.Changes
elecnix/cite@1c0537ba(v0.11.2).CITE_PROVIDERrepository variable: Ollama Cloud by default, OpenRouter when the variable is set toopenrouter.require_parameters: ${{ vars.CITE_PROVIDER == 'openrouter' }}to the review step and delete.github/cite.yml, which existed only to hold that key. Cite's defaults cover everything else.Notes
Both
OLLAMA_API_KEYandMODEL_API_KEYare already repository secrets. To switch this repository back to OpenRouter:gh variable set CITE_PROVIDER --body openrouter --repo elecnix/pi-agent-identity.