TinkerLab
ARTIFACT // N8N-LOCAL-PR-REVIEWER.JSON (JSON)

n8n + Local Qwen2.5-Coder Git PR Diff Reviewer with Secret Redaction (n8n-local-pr-reviewer.json)

Scrubs accidental API keys/tokens from git diffs before sending code hunks to local Qwen2.5-Coder-14B for bug and security review.

[KEY VERIFIED TAKEAWAY / TL;DR]This reproducible configuration artifact "n8n + Local Qwen2.5-Coder Git PR Diff Reviewer with Secret Redaction" (n8n-local-pr-reviewer.json, JSON) is paired with Tinker AI Lab's hardware-verified guide "n8n-github-pr-security-review-bot". It exposes 2 customizable browser variables (CODER_MODEL=qwen2.5-coder:14b, OLLAMA_HOST_URL=http://host.docker.internal:11434) with loopback-first security defaults.
02 // WORKFLOWNo-Code AI Workflows· Verified: 2026-10-23
Browse All 42 Artifacts →
n8n-local-pr-reviewer.json

n8n + Local Qwen2.5-Coder Git PR Diff Reviewer with Secret Redaction

Scrubs accidental API keys/tokens from git diffs before sending code hunks to local Qwen2.5-Coder-14B for bug and security review.

View Paired Guide →
Customizable Variables (Saved in Browser)
UTF-8 Encoded · Live Client-Side Compilation
{
  "name": "Tinker AI — Local Git Diff Security & Bug Reviewer",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "git-pr-review",
        "responseMode": "lastNode"
      },
      "name": "PR Diff Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [200, 300]
    },
    {
      "parameters": {
        "jsCode": "const rawDiff = String($input.first().json.body?.diff || '').slice(0, 12000);\nconst sanitizedDiff = rawDiff.replace(/(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{20,}|AKIA[0-9A-Z]{16})/g, '[REDACTED_SECRET]');\nreturn [{ json: { sanitizedDiff } }];"
      },
      "name": "Sanitize Secrets & Cap Diff Length",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [440, 300]
    },
    {
      "parameters": {
        "method": "POST",
        "url": "http://host.docker.internal:11434/api/generate",
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({ model: 'qwen2.5-coder:14b', format: 'json', stream: false, options: { temperature: 0.1, num_ctx: 16384 }, prompt: 'Review this git diff for security bugs, race conditions, or unhandled errors. Return JSON {summary, issues: [{severity, lineHint, suggestion}]}: \n' + $json.sanitizedDiff }) }}",
        "options": { "timeout": 60000 }
      },
      "name": "Qwen2.5-Coder Diff Review",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "retryOnFail": true,
      "maxTries": 2,
      "continueOnFail": true,
      "position": [680, 300]
    }
  ],
  "connections": {
    "PR Diff Webhook": {
      "main": [[{ "node": "Sanitize Secrets & Cap Diff Length", "type": "main", "index": 0 }]]
    },
    "Sanitize Secrets & Cap Diff Length": {
      "main": [[{ "node": "Qwen2.5-Coder Diff Review", "type": "main", "index": 0 }]]
    }
  }
}
PARAMETER SPECIFICATION // 参数化变量规范说明表

Customizable Parameter Reference for n8n-local-pr-reviewer.json

This JSON artifact exposes 2 template variables compiled client-side in your browser.

Template TokenParameter DescriptionVerified DefaultExample Format
{{CODER_MODEL}}Local Code Review Modelqwen2.5-coder:14bqwen2.5-coder:14b
{{OLLAMA_HOST_URL}}Ollama Endpointhttp://host.docker.internal:11434http://host.docker.internal:11434
PAIRED HARDWARE MANIFEST // 配套实测环境与边界记录

Verified Environment for "Self-Hosted Git PR Diff Reviewer with n8n & Qwen2.5-Coder: Secret Redaction & Token Caps"

Tested Hardware & OS

Self-hosted n8n + Local Ollama (`qwen2.5-coder:14b` on 16GB+ GPU / 24GB+ Mac)

Pinned Stack & Model Versions
n8n 1.76.xOllama 0.5.7qwen2.5-coder:14b-instruct-q4_K_M
Offline Boundary (100% Local Code Analysis · Scoped Git Webhook)

When paired with self-hosted GitLab/Gitea, the entire PR review loop operates inside your air-gapped intranet.

Known Operational Limits & Failure Modes
  • Raw PR diffs that include `package-lock.json`, `pnpm-lock.yaml`, or minified bundles easily exceed 60K tokens; filter out lockfiles and cap diffs to 12,000 characters per hunk.
  • Developers occasionally commit real `.env` secrets in a PR commit; always run a deterministic regex redaction pass before logging or forwarding diffs.
DEPLOYMENT CHECKLIST // 配置落地核验步骤

3-Step Verification Checklist After Deploying n8n-local-pr-reviewer.json

  1. Verified regex secret redaction runs before the LLM node and n8n execution logging.
  2. Created a fine-grained Git token restricted to `Pull Requests: Read & Write (Comments)` only.
  3. Filtered out lockfiles/build artifacts and capped diff payload to 12,000 characters.