Security and Compliance Material Review for Code Review and Merge Management: Model Access and Configuration

Data for this category primarily originates from Git repositories, CI pipelines, static scan reports, and defect databases. Core daily documents

What data for this category looks like

Data for this category primarily originates from Git repositories, CI pipelines, static scan reports, and defect databases. Core daily documents include merge requests, code review comments, commit logs, and branch strategy descriptions. Data update frequency is daily or per commit. Each entry includes code change content, review status, linked defect identification numbers, and branch affiliation information. Fields adjust dynamically based on the scale of code changes, with no fixed uniform length.

What constraints do these characteristics impose on model access and configuration

Data sources are scattered and update frequency is high. Model access must adapt to format differences across multiple data sources. Sufficient context capacity must be configured to cover the full merge request context. Code change content has large length fluctuations. Per-call output token count must be limited to avoid task timeouts. This category combines business semantics from manual reviews. Model configuration must balance output consistency and flexibility, and cannot over-rely on random judgments. Data linkage with defect databases requires model call chains to meet security and compliance requirements. Access tokens require separate configuration management.

How to set configurations

Configuration ItemRecommended ValuesRationale
maxContext8000–12000 tokenMerge request code changes typically include multiple commit logs and review comments; total context length must cover the full change context
maxTokens2000–3000 tokenSecurity and compliance review for code reviews requires complete detection conclusion output, so sufficient output space must be reserved
temperature0.2–0.4Security and compliance reviews require consistent output, to avoid random judgments affecting review standards
toolChoiceautoAutomatically call code parsing tools based on review content, to adapt to different types of merge requests
AIPROXY_API_ENDPOINTRoot address of the AI Proxy service, for example http://aiproxy:3000This variable is a required environment variable for the App/Admin server, used to specify the AI Proxy service address. Do not append /v1 or /chat/completions paths, and do not use single-model vendor addresses
AIPROXY_API_TOKENAI Proxy administrator token, consistent with the AI Proxy server configuration and non-emptyThis variable is a required environment variable for the App/Admin server. Do not use application API keys, model vendor keys, or tokens issued per application as a replacement

Three common configuration mistakes

  • Phenomenon: Token mismatch errors occur during invocation when multiple models with the same name but different keys are configured. Cause: Unique identifiers are not set for each instance in the model configuration, so the system cannot distinguish model instances with different keys.
  • Phenomenon: Workflow node output only includes partial context, and does not cover the full review record of the current merge request. Cause: The global context reuse switch is not turned off, so the node calls context data from non-current tasks.
  • Phenomenon: When attempting to connect the FunASR speech recognition model, the interface prompts that this model type is not supported. Cause: The current FastGPT code review module only supports text-based large model access, and no speech recognition model adaptation logic is integrated.

How to confirm configuration is complete

  • Submit a test merge request to trigger a security and compliance review task, check whether the token identifier in the model invocation log matches the configured secret key.
  • Check the loading status of the model vendor icon, confirm that the network connection is normal and the configured vendor information matches the built-in icon library of FastGPT v4.17.0.
  • Trigger a review task, check whether the output only includes linked data for the current merge request, and does not mix context from other tasks.
  • Adjust the temperature parameter to 0.1, trigger the same review task multiple times, confirm that the output remains consistent, and verify that the parameter configuration takes effect.

The values provided are common starting points and should be measured against the reader's own samples.

Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.