Home / Guides / Devin

Devin code review in GitHub Actions

Updated July 4, 2026 · applies to pgup-ai/jbot-review-action v0

A Devin seat can moonlight as your PR reviewer. J-Bot Review, an MIT-licensed GitHub Action, drives the Devin CLI backend inside your own CI. The setup has exactly one trap — the secret is a key value copied out of a file, not the file itself — and this guide walks straight through it. J-Bot adds nothing to your Devin bill.

Setup in three steps

1. Copy the key value. Run devin auth login locally, then open ~/.local/share/devin/credentials.toml and copy the windsurf_api_key value (it looks like devin-session-token$…) into the repository secret DEVIN_WINDSURF_API_KEY (Settings → Secrets and variables → Actions). The key value only — not the whole file, unlike the Codex, Cline, Kilo, and Grok Build backends.
2. Commit the workflow. Add the file below as .github/workflows/jbot-review.yml.
3. Open a pull request. Devin reviews the full base…head diff on your runner and posts review comments with a verdict; blocking findings are adversarially verified first, nits demoted.

name: J-Bot Code Review
on:
  pull_request: { types: [opened, reopened, ready_for_review, synchronize] }

concurrency:
  group: jbot-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  issues: write        # PR reactions use the issues API
  checks: read

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - uses: pgup-ai/jbot-review-action@v0
        with:
          provider: devin
          devin-windsurf-api-key: ${{ secrets.DEVIN_WINDSURF_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

What Devin posts back

• Diff-anchored review comments over the whole base…head range, plus a verdict at the end.
• Every blocking finding has to survive a second-session check before it appears. The rest get demoted or dropped rather than dumped on the PR.
• Repo rules shape the review: AGENTS.md, REVIEW.md, .coderabbit.yaml, greptile.json, Cursor rules.
• External API or SDK changes get a Context7 pass against current docs.

Cost & privacy

• Reviews draw on the Devin plan you already pay for, plus CI minutes. A nice pattern: run a cheaper default reviewer and use a one-off /jbot --provider=devin comment as the stronger sign-off pass.
• The diff reaches Devin's backend on your account and no one else's servers.
• The windsurf_api_key is a password-equivalent, so Actions secrets only. Fork PRs never receive it, and your plan's terms on CI use are worth a look.
• Doc-only PRs don't spend a model call.

FAQ

Related