Yang Code Review (YCR)

Yang Code Review (YCR) is a AI agent that helps you review code changes in your GitHub repositories.

---

📝 Review Process Overview

Yang Code Review classifies code context and applies OWASP-standardized checks for multiple domains:

• OWASP Web Top 10
• OWASP Mobile Top 10
• OWASP API Security Top 10
• OWASP Machine Learning Security Top 10
• OWASP IoT Top 10
• OWASP Top 10 for LLM Applications
• OWASP MCP Top 10
• OWASP IaC Security Cheat Sheet
• OWASP Secure Code Review Checklist

Usage

1. Create an account on https://yyng.icu.
2. Register and activate subscription with Free Plan.
3. In Studio -> Profile -> Personal Access Tokens, create API credentials.
4. Copy the full PAT value and save it as repository secret X_YANG_API_TOKEN.
5. Free plan quota and limits are managed by your active Studio entitlement.

🤖 Models Supported

Model Name	Description
anthropic_claude_sonet_4_5	Claude Sonet 4.5
gpt_oss_120b	GPT-OSS 120B
llama_4_scout_17b_instruct	Llama 4 Scout 17B Instruct

🤖 Agents Supported

Agent Name	Description
yang-code-review	YangYang Code Review

🔐 Required Secrets

• X_YANG_API_TOKEN – Raw API token value (do not prepend Basic; action will send x-yang-api-token: Basic <token>)

⚙️ Inputs

Name	Required	Description
X_YANG_API_TOKEN	yes	Raw token used to build x-yang-api-token: Basic <token> header
MODEL_NAME	yes	Name of the model to use for code review
MODEL_TEMPERATURE	yes	Temperature for the model
GITHUB_TOKEN	yes	GitHub token for PR comments

🚀 Usage Example

name: YangYang Code Review (YCR)

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  code-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
      - name: yang-code-review
        uses: YangYang-Research/yang-code-review@<version>
        with:
          X_YANG_API_TOKEN: ${{ secrets.X_YANG_API_TOKEN }}
          MODEL_NAME: 'anthropic_claude_sonet_4_5'
          MODEL_TEMPERATURE: 0.7
          GITHUB_TOKEN: ${{ github.token }}

Report Template

# Yang Code Review (YCR) Report

## Scope and Classification
- Reviewed target: [repo/module/change-set]
- Detected domain(s): [Web/API/Mobile/ML/IoT/LLM/MCP/IaC]
- OWASP edition(s) applied: [e.g., Web 2025, API 2023, LLM 2025]

## Executive Summary
- Total findings: [count]
- Critical: [count]
- High: [count]
- Medium: [count]
- Low: [count]
- Info: [count]
- Top risks:
  1. [...]
  2. [...]
  3. [...]

## Detailed Findings

### YCR-001
- Severity: [Critical|High|Medium|Low|Info]
- OWASP Mapping: [category + edition]
- Location: [file:line]
- Description: [...]
- Impact: [...]
- Evidence: [...]
- Remediation: [...]
- Secure code example (optional): [...]

## Checklist
- [ ] Domain-specific OWASP checks completed
- [ ] OWASP Secure Code Review Checklist core areas covered
- [ ] IaC Security Cheat Sheet controls applied (if IaC in scope)

## Residual Risk and Verification Gaps
- Not fully verified: [...]
- Recommended follow-up tests: [...]

### Report Generated by Yang Code Review (YCR) - YangYang Organization

🛡 Security

• X_YANG_API_TOKEN, GITHUB_TOKEN are masked automatically in GitHub Actions logs
• Keep X_YANG_API_TOKEN in GitHub Secrets only; never print or commit it.

🏷 Marketplace

This action is marketplace-ready:

• Bundled with @vercel/ncc
• Branded icon & color
• Semantic versioning recommended (v1, v1.1.0)

🏗 Build (Required) - For Developers

This action uses @vercel/ncc to bundle all dependencies into a single file.

npm install
npm run build

This will generate dist/index.js which must be committed.

📝 License

This project is licensed under the MIT License - see the LICENSE.md file for details.

🤝 Contributing

Contributions are welcome! Please feel free to submit a pull request.