Skitflow
Code Review

Self-hosted Code Review setup

Configure Code Review workers, GitHub Apps, GitLab and Gitea/Forgejo on a self-hosted Skitflow installation.

Self-hosted Code Review uses the web service for provider callbacks and webhooks, and a dedicated worker for review and Code Intelligence jobs. Both services must share the main database, Redis, and the Code Review credentials.

Enable the worker

For a new script-based installation, run install.sh with SKITFLOW_CODE_REVIEW_ENABLED=1. This deploys the dedicated skitflow-code-review-worker service but does not configure provider credentials or enable organization feature flags.

Set SKITFLOW_CODE_REVIEW_WORKER_ENABLED=true on the worker. If it is missing or has any other value, requests can be queued but no review jobs run. Keep SKITFLOW_QUEUE_PREFIX stable; it defaults to skitflow.

Set a stable public HTTPS origin in BETTER_AUTH_URL (with SITE_URL as the fallback), and make sure provider webhooks can reach it. Restart the web and worker services after changing credentials.

PAT provider network policy

GitLab and Gitea/Forgejo use operator-supplied base URLs and access tokens. These deployment-wide variables control their outbound requests:

VariableSelf-hosted defaultBehavior
GIT_PROVIDER_OUTBOUND_POLICYoffoff allows private, loopback, link-local, and special-use targets. strict blocks those ranges. Unknown values silently fall back to the deployment default (off self-hosted, strict on cloud).
GIT_PROVIDER_REQUIRE_HTTPSfalseSet to true to reject http:// base URLs.

The GitLab and Gitea connection dialogs always warn for http://, because the token is sent unencrypted on every request. Plain HTTP is still accepted when the deployment permits it. Provider response bodies are kept out of client-facing errors; inspect the server logs for remote-host details.

Keep the self-hosted defaults only when private provider URLs are intentional. Prefer HTTPS and strict for installations whose users must not reach the control plane's private network.

GitHub App

Use a separate GitHub App for Code Review. Do not reuse the OAuth application used for deployment sources.

  1. Create a GitHub App with homepage set to your Skitflow origin, setup URL <SKITFLOW_ORIGIN>/api/code-review/github/callback, and webhook URL <SKITFLOW_ORIGIN>/api/code-review/github/webhook.
  2. Grant read-only Metadata and Contents, plus read/write Pull requests and Issues permissions. Also grant read/write Checks — Skitflow creates and updates a skitflow-review check run on each pull request; without it the check run is skipped and reviews still complete.
  3. Subscribe to Pull request, Installation, Installation repositories, Push, Issue comment, and Pull request review comment events. Push events drive Code Intelligence re-indexing on the default branch; the two comment events drive in-PR bot commands (for example re-running or explaining a review from a comment).
  4. Configure these values on both the web and worker services:
SKITFLOW_CODE_REVIEW_GITHUB_APP_ID="123456"
SKITFLOW_CODE_REVIEW_GITHUB_APP_SLUG="my-skitflow-code-review"
SKITFLOW_CODE_REVIEW_GITHUB_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\\n...\\n-----END RSA PRIVATE KEY-----"
SKITFLOW_CODE_REVIEW_GITHUB_BOT_LOGIN="my-skitflow-code-review[bot]"
SKITFLOW_CODE_REVIEW_GITHUB_WEBHOOK_SECRET="<dedicated-random-secret>"
SKITFLOW_CODE_REVIEW_GITHUB_STATE_SECRET="<different-random-secret>"
SKITFLOW_CODE_REVIEW_WORKER_ENABLED=true

Use independent high-entropy webhook and state secrets. After restarting, enable code_review.enabled and code_review.github under Dashboard → Settings → Code Review → Feature availability. Install the App, synchronize repositories, link one to the project, and run a review on a non-draft pull request.

GitLab

  1. Create a dedicated bot account PAT with the api scope.
  2. Enable code_review.enabled and code_review.gitlab.
  3. Choose Connect GitLab on the project's Code Review page and enter the instance URL, PAT, and optional group path.
  4. Use Skip TLS verification only for an exceptional self-signed instance where you cannot configure a trusted CA.
  5. Synchronize repositories and enable Code Review for the intended projects.

Skitflow creates a group webhook for a group-scoped connection or per-project webhooks for membership-scoped connections. Do not connect overlapping group and membership installations for the same instance. GitLab does not send a ready_for_review action: changing a merge request from draft to ready does not start a review until you run one manually or push another commit.

Gitea and Forgejo

Create a dedicated bot token with repository and organization read/write scopes. Enable code_review.enabled and code_review.gitea, then choose Connect Gitea, enter the base URL, token, and optional organization, and synchronize the repositories. The same HTTP warning, TLS exception, outbound policy, and client-error redaction rules described above apply.

Verify the installation

Open or update a non-draft pull request, or select Run review. Confirm the run leaves the queued state and the provider receives the summary or inline comments. If it stays queued, verify that the worker switch is exactly true and that the worker can reach Redis. For connection failures, inspect the server logs; remote error bodies are intentionally not shown in the browser.

For concurrency, queue migration, metrics, budgets, retention, and artifact storage, continue to Code Review scaling and limits.

Code Intelligence

The Code Review context layer that indexes a repository's default branch and searches it semantically to give reviews codebase-aware context.

Code Review scaling and limits

Scale self-hosted Code Review workers and configure concurrency, budgets, metrics, retention, and encrypted artifact storage.

On this page

Enable the workerPAT provider network policyGitHub AppGitLabGitea and ForgejoVerify the installation