ci: auto code review on PRs via OpenCodeReview (free tier)

[veerareddyvishal144]

Adds .github/workflows/ocr-review.yml: every PR (opened/synchronize/reopened) triggers an Alibaba open-code-review run on GitHub-hosted runners (free for this public repo), plus on-demand re-review via /open-code-review comments.

Cost design mirrors local Lynkr tiers (SIMPLE/MEDIUM/COMPLEX -> free models):

• LLM = OpenRouter :free model (repo Variable OCR_LLM_MODEL, currently nvidia/nemotron-3-nano-30b-a3b:free, $0)
• effort: low + sticky summary to stay in budget and avoid comment spam
• Secrets OCR_LLM_URL / OCR_LLM_AUTH_TOKEN already set; model switchable via Variables with no code change.

Note: pull_request_target runs the workflow from base, so this setup PR itself won't be reviewed until after merge - open any test PR after merging to see it fire.

Greptile Summary

This revision hardens the OpenCodeReview workflow by replacing mutable third-party action references with full commit SHAs and selecting an immutable OpenCodeReview CLI release.

• Pins actions/github-script to the commit annotated as v7.0.1.
• Pins alibaba/open-code-review to the commit annotated as v1.12.0.
• Configures ocr_version as 1.12.0.
• Leaves the previously reported unsupported llm_reasoning_effort setting unchanged.

Confidence Score: 5/5

The latest changes appear safe to merge, although the existing non-blocking warning that llm_reasoning_effort is ignored remains outstanding.

The mutable privileged action references identified previously are now pinned and that thread was resolved. The unresolved previous finding remains valid because llm_reasoning_effort is still supplied even though it is not a declared OpenCodeReview action input, so the intended low-reasoning cost and latency control is not applied.

Files Needing Attention: .github/workflows/ocr-review.yml

Important Files Changed

Filename	Overview
.github/workflows/ocr-review.yml	Pins both workflow actions and the OpenCodeReview CLI version; the unresolved low-reasoning input from the previous review remains unchanged.

_{Reviews (3): Last reviewed commit: "ci: pin ocr action and CLI to immutable ..." | Re-trigger Greptile}

[greptile-apps]

Reasoning Setting Is Ignored

llm_reasoning_effort is not a declared input of alibaba/open-code-review, so GitHub Actions warns and silently ignores it. Reviews therefore use the CLI's default reasoning behavior rather than the documented low-reasoning setting, defeating the intended cost and latency control.