Wachiman is an advisory pull request reviewer that runs in your own GitHub Actions with your own API key. It comments on what it finds and cannot block a merge.
Wachiman—
Fix · bug
If a positive item count is divided by a zero limit, the page count becomes
Infinity, and ordinary JSON serialization turns that into null.
Validate a positive limit before calculating the count.
Illustrative finding, not a recorded review. Severity tells you when to act; topic tells you what the finding is about.
ANTHROPIC_API_KEY in your repository’s Actions secrets. Your Actions
runner runs the engine, and the supplied workflow gives that key to Claude Code to
authenticate calls to Anthropic. The engine holds the GitHub token, keeps it out of the
agent’s environment, and posts the advisory review itself.
Use Wachiman only where you trust everyone who can push: on pull_request, GitHub
runs the caller workflow from the pull request’s own merge commit, so someone who can edit that
workflow can access the job’s API key. Fork pull requests are not reviewed. This is not a
sandbox: the agent runs with hardening flags meant to reduce what the reviewed branch can make
it load or run, but they are only partly tested and none is a guarantee against a malicious
branch.
Read the security model ·
Trust assumptions and verification limits
Create .github/workflows/wachiman.yml with the caller below, replace the operator
login with your GitHub login, and add your Anthropic API key as an Actions secret named
ANTHROPIC_API_KEY. The key must belong to a funded Anthropic account.
The caller’s uses: line points at @v1.4.0. Pin an exact release,
never the floating @v1; for a reference that cannot move, use the release’s commit
SHA instead. To get newer releases as pull requests you read before they run with your key,
configure Dependabot’s GitHub Actions updates in your repository, which is a separate
.github/dependabot.yml file. To roll back, change that same uses:
reference to an earlier release; it does not undo spend from earlier runs.
name: Wachiman
on:
pull_request: { types: [opened, ready_for_review] }
issue_comment: { types: [created] }
permissions: { contents: read, pull-requests: write, issues: read }
jobs:
review:
uses: niway-dev/wachiman/.github/workflows/review.yml@v1.4.0
with:
operator: your-github-login
secrets:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
As the configured operator, comment /wachi review or
/wachiman review to ask for a review; commands start working once the caller
workflow is on your default branch.
This caller reviews a same-repository pull request when it is opened as ready or marked ready.
It does not rerun on each push; after new commits, ask with /wachi review. Drafts,
Dependabot pull requests and branches starting with release-please-- are not
reviewed automatically, and fork pull requests are never reviewed.
After you fix a finding, push and ask again. Once a complete review has recorded a commit, Wachiman reviews only the changes since it and can reply in its unresolved finding threads; an unchanged head returns “Already reviewed”, and rewritten history falls back to the whole pull request. Naming paths asks for a scoped review instead. Replies are advice, and nothing is resolved or approved for you.
Wachiman is free for non-competing use. Competing commercial use requires a license from NIWAY. You pay your model provider for the tokens used, and any GitHub Actions charges that apply to your account; what that comes to depends on your provider and plan.
Files get a path-based risk score. Wachiman groups files into modules, orders the modules by their highest-scored file, and plans batches in that order, with production code ahead of tests and documentation inside each batch. The score is a heuristic, not a guarantee that the riskiest code is read first.
Each model call gets a budget, limited by what remains of the review run’s budget. A batch can be retried once for files left unaccounted for, and that retry is a second call with its own budget. Wachiman tracks the spend the provider reports and stops starting calls when less than $0.05 remains. Each new review run starts a new budget. The defaults are $3 for each review run and $0.75 for each model call; these are budget settings, not typical prices.
When coverage is partial, the review’s first line says so. If a batch’s first call reports that it ran out of budget and no call returns a review, Wachiman posts a notice that nothing was reviewed reliably; other failures can stop the workflow with an error.
👮 Wachiman · ⚠️ Partial review: the agent reviewed 3 of 4 files of the whole pull request, at a1b2c3d. Not reviewed: src/billing/export.ts. Ask /wachi review <paths> for the rest.Illustrative review summary, not a recorded run. Coverage is based on the files the model reports reviewing. Read how the budgets work
Wachiman plays the watchman: it flags concerns and leaves the merge decision to you.
A watchman tells you your car door is open or your gate is unlocked, and leaves your keys with you. This reviewer has the same arrangement: an opinion, sometimes wrong, and no authority to fix or merge anything.
