Adds a new 'aicore' LLM provider that authenticates directly with SAP AI Core
using OAuth client credentials. This eliminates the need for an external proxy
(hai-aicore or hai) when running review-bot in SAP environments.

Key changes:
- New llm/aicore.go with AICoreClient for OAuth token management and
  deployment discovery
- Thread-safe token caching with automatic refresh before expiry
- Automatic routing to /invoke (Anthropic) or /chat/completions (OpenAI)
  based on model name
- New CLI flags: --aicore-client-id, --aicore-client-secret, --aicore-auth-url,
  --aicore-api-url, --aicore-resource-group
- Updated action.yml with corresponding inputs
- Comprehensive test coverage for AI Core client

Example usage in CI:
  llm-provider: aicore
  llm-model: anthropic--claude-4.6-sonnet
  aicore-client-id: ${{ secrets.AICORE_CLIENT_ID }}
  aicore-client-secret: ${{ secrets.AICORE_CLIENT_SECRET }}
  aicore-auth-url: ${{ secrets.AICORE_AUTH_URL }}
  aicore-api-url: ${{ secrets.AICORE_API_URL }}

Closes #49

@@ -0,0 +70,4 @@
+	if err != nil {
+		return "", err
+	}
+	c.token = token

@@ -0,0 +94,4 @@
+		return "", time.Time{}, fmt.Errorf("token request: %w", err)
+	}
+	defer resp.Body.Close()
+

@@ -0,0 +147,4 @@
+		return "", err
+	}
+
+	if d, ok := c.deployments[model]; ok {

@@ -0,0 +43,4 @@
+func NewAICoreClient(cfg AICoreConfig) *AICoreClient {
+	return &AICoreClient{
+		config:      cfg,
+		http:        &http.Client{Timeout: 30 * time.Second},

@@ -0,0 +242,4 @@
+	}
+
+	reqBody := anthropicRequest{
+		Model:     model,

@@ -0,0 +354,4 @@
+	var openaiResp ChatResponse
+	if err := json.Unmarshal(body, &openaiResp); err != nil {
+		return "", fmt.Errorf("parse response: %w", err)
+	}

@@ -0,0 +1,368 @@
+package llm

@@ -69,7 +69,13 @@ func main() {
 	dryRun := flag.Bool("dry-run", false, "Print review to stdout instead of posting")

@@ -0,0 +154,4 @@
+}
+
+func (c *AICoreClient) fetchDeployments(ctx context.Context, token string) error {
+

@@ -0,0 +347,4 @@
+		return "", fmt.Errorf("read response: %w", err)
+	}
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {

@@ -0,0 +409,4 @@
+
+func TestClient_CompleteAICore(t *testing.T) {
+	var baseURL string
+	mux := http.NewServeMux()

@@ -0,0 +38,4 @@
+	ID  string
+	URL string
+}
+

@@ -0,0 +165,4 @@
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("deployments request: %w", err)

@@ -0,0 +192,4 @@
+					} `json:"backend_details"`
+				} `json:"resources"`
+			} `json:"details"`
+		} `json:"resources"`

@@ -0,0 +258,4 @@
+
+	// AI Core uses /invoke for Anthropic models
+	invokeURL := strings.TrimRight(deployURL, "/") + "/invoke"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, invokeURL, bytes.NewReader(data))

@@ -0,0 +385,4 @@
+	}
+}
+
+func TestClient_WithAICore(t *testing.T) {

@@ -0,0 +387,4 @@
+
+func TestClient_WithAICore(t *testing.T) {
+	client := NewClient("http://example.com", "key", "model")
+	if client.provider != ProviderOpenAI {

@@ -0,0 +42,4 @@
+// NewAICoreClient creates a new AI Core client with the given configuration.
+func NewAICoreClient(cfg AICoreConfig) *AICoreClient {
+	return &AICoreClient{
+		config:      cfg,

@@ -0,0 +75,4 @@
+	return token, nil
+}
+
+func (c *AICoreClient) fetchToken(ctx context.Context) (string, time.Time, error) {

@@ -0,0 +100,4 @@
+		return "", time.Time{}, fmt.Errorf("read token response: %w", err)
+	}
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {

@@ -0,0 +42,4 @@
+// NewAICoreClient creates a new AI Core client with the given configuration.
+func NewAICoreClient(cfg AICoreConfig) *AICoreClient {
+	return &AICoreClient{
+		config:      cfg,

@@ -0,0 +326,4 @@
+		return "", fmt.Errorf("marshal request: %w", err)
+	}
+
+	// AI Core uses /chat/completions?api-version=2024-12-01-preview for OpenAI models

@@ -0,0 +363,4 @@
+}
+
+// IsAnthropicModel returns true if the model name indicates an Anthropic model.
+func IsAnthropicModel(model string) bool {

@@ -106,6 +119,18 @@ func (c *Client) Complete(ctx context.Context, messages []Message) (string, erro
 	return "", err

@@ -0,0 +54,4 @@
+}
+
+// WithTimeout sets the HTTP request timeout for AI Core calls.
+// This should be called during construction, before concurrent use.

@@ -0,0 +160,4 @@
+	}
+
+	if d, ok := c.deployments[model]; ok {
+		return d.URL, nil

@@ -0,0 +201,4 @@
+							Name string `json:"name"`
+						} `json:"model"`
+					} `json:"backend_details"`
+				} `json:"resources"`

@@ -0,0 +333,4 @@
+	}
+
+	data, err := json.Marshal(reqBody)
+	if err != nil {

@@ -0,0 +103,4 @@
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("token request: %w", err)

@@ -0,0 +108,4 @@
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {

@@ -0,0 +176,4 @@
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("deployments request: %w", err)

@@ -0,0 +181,4 @@
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {

@@ -0,0 +279,4 @@
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("AI Core request: %w", err)

@@ -0,0 +284,4 @@
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {

@@ -0,0 +349,4 @@
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("AI Core request: %w", err)

@@ -0,0 +354,4 @@
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {

@@ -0,0 +149,4 @@
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+

@@ -0,0 +211,4 @@
+
+	for _, r := range deployResp.Resources {
+		if r.Status != "RUNNING" {
+			continue

@@ -0,0 +1,380 @@
+package llm

@@ -0,0 +1,535 @@
+package llm

@@ -91,0 +103,4 @@
+	}
+	if isAICore && (*aicoreClientID == "" || *aicoreClientSecret == "" || *aicoreAuthURL == "" || *aicoreAPIURL == "") {
+		fmt.Fprintf(os.Stderr, "Error: AI Core credentials required for provider=aicore\n\n")
+		fmt.Fprintf(os.Stderr, "Required: --aicore-client-id, --aicore-client-secret, --aicore-auth-url, --aicore-api-url\n")

@@ -0,0 +124,4 @@
+		return "", time.Time{}, fmt.Errorf("parse token response: %w", err)
+	}
+
+	if tokenResp.AccessToken == "" {

@@ -0,0 +153,4 @@
+	// Double-check after acquiring write lock
+	if d, ok := c.deployments[model]; ok {
+		return d.URL, nil
+	}

@@ -0,0 +196,4 @@
+			Status        string `json:"status"`
+			Details       struct {
+				Resources struct {
+					BackendDetails struct {

@@ -0,0 +1,381 @@
+package llm

@@ -0,0 +1,535 @@
+package llm

@@ -0,0 +83,4 @@
+		return "", err
+	}
+	c.token = token
+	c.tokenExpiry = expiry

@@ -0,0 +102,4 @@
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := c.http.Do(req)
+	if err != nil {

@@ -0,0 +229,4 @@
+// CompleteAnthropic sends a request to an Anthropic model via AI Core.
+func (c *AICoreClient) CompleteAnthropic(ctx context.Context, model string, messages []Message, maxTokens int, temperature float64) (string, error) {
+	deployURL, err := c.getDeploymentURL(ctx, model)
+	if err != nil {

@@ -0,0 +155,4 @@
+		return d.URL, nil
+	}
+
+	if err := c.fetchDeployments(ctx, token); err != nil {

@@ -0,0 +284,4 @@
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)

@@ -0,0 +354,4 @@
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)

@@ -0,0 +129,4 @@
+	}
+
+	expiry := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)
+	return tokenResp.AccessToken, expiry, nil

@@ -0,0 +299,4 @@
+	}
+
+	if len(anthropicResp.Content) == 0 {
+		return "", fmt.Errorf("no content in response")

@@ -0,0 +349,4 @@
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {

@@ -0,0 +1,19 @@
+## Self-Review: feat/aicore-provider — 2026-05-09

@@ -0,0 +155,4 @@
+		return d.URL, nil
+	}
+
+	if err := c.fetchDeployments(ctx, token); err != nil {

@@ -36,3 +38,3 @@
     required: true
   llm-provider:
-    description: 'LLM API provider: openai or anthropic (default openai)'
+    description: 'LLM API provider: openai, anthropic, or aicore (default openai)'

@@ -0,0 +287,4 @@
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("read response: %w", err)
+	}

@@ -0,0 +340,4 @@
+
+	// AI Core uses /chat/completions?api-version=<version> for OpenAI models
+	chatURL := strings.TrimRight(deployURL, "/") + "/chat/completions?api-version=" + AICoreOpenAIAPIVersion
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, chatURL, bytes.NewReader(data))

@@ -89,1 +93,4 @@
+	// For aicore provider, llm-base-url and llm-api-key are not required
+	isAICore := llm.Provider(*llmProvider) == llm.ProviderAICore
+	if *giteaURL == "" || *repo == "" || *prNum == "" || *reviewerToken == "" || *llmModel == "" {
 		fmt.Fprintf(os.Stderr, "Error: missing required flags or environment variables\n\n")

@@ -0,0 +109,4 @@
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("read token response: %w", err)

@@ -0,0 +168,4 @@
+func (c *AICoreClient) fetchDeployments(ctx context.Context, token string) error {
+	deployURL := strings.TrimRight(c.config.APIURL, "/") + "/v2/lm/deployments"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, deployURL, nil)
+	if err != nil {

@@ -0,0 +265,4 @@
+
+	data, err := json.Marshal(reqBody)
+	if err != nil {
+		return "", fmt.Errorf("marshal request: %w", err)

@@ -0,0 +335,4 @@
+
+	data, err := json.Marshal(reqBody)
+	if err != nil {
+		return "", fmt.Errorf("marshal request: %w", err)

@@ -0,0 +356,4 @@
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("read response: %w", err)

@@ -91,0 +101,4 @@
+		fmt.Fprintf(os.Stderr, "Error: --llm-base-url and --llm-api-key are required for provider=%s\n", *llmProvider)
+		os.Exit(1)
+	}
+	if isAICore && (*aicoreClientID == "" || *aicoreClientSecret == "" || *aicoreAuthURL == "" || *aicoreAPIURL == "") {

@@ -0,0 +113,4 @@
+	}
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", time.Time{}, fmt.Errorf("token request failed (status %d): %s", resp.StatusCode, string(body))

@@ -0,0 +203,4 @@
+					} `json:"backend_details"`
+				} `json:"resources"`
+			} `json:"details"`
+		} `json:"resources"`

@@ -0,0 +285,4 @@
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {

@@ -0,0 +296,4 @@
+	var anthropicResp anthropicResponse
+	if err := json.Unmarshal(body, &anthropicResp); err != nil {
+		return "", fmt.Errorf("parse response: %w", err)
+	}

@@ -0,0 +355,4 @@
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {

@@ -0,0 +1,381 @@
+package llm

@@ -0,0 +1,535 @@
+package llm

@@ -0,0 +1,19 @@
+## Self-Review: feat/aicore-provider — 2026-05-09

@@ -0,0 +31,4 @@
+type AICoreClient struct {
+	config AICoreConfig
+	http   *http.Client
+

@@ -0,0 +50,4 @@
+		config:      cfg,
+		http:        &http.Client{Timeout: 5 * time.Minute},
+		deployments: make(map[string]deployment),
+	}

@@ -0,0 +159,4 @@
+		return "", err
+	}
+
+	if d, ok := c.deployments[model]; ok {

@@ -0,0 +194,4 @@
+			ID            string `json:"id"`
+			DeploymentURL string `json:"deploymentUrl"`
+			Status        string `json:"status"`
+			Details       struct {

@@ -0,0 +277,4 @@
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("AI-Resource-Group", c.config.ResourceGroup)
+	req.Header.Set("Content-Type", "application/json")
+

@@ -0,0 +189,4 @@
+						"resources": map[string]interface{}{
+							"backend_details": map[string]interface{}{
+								"model": map[string]interface{}{
+									"name": "anthropic--claude-4.6-sonnet",

@@ -0,0 +145,4 @@
+	token, err := c.getToken(ctx)
+	if err != nil {
+		return "", fmt.Errorf("get token for deployments: %w", err)
+	}

@@ -0,0 +150,4 @@
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	// Double-check after acquiring write lock

@@ -0,0 +279,4 @@
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {