Add native SAP AI Core provider that handles OAuth token management and
deployment discovery automatically. This eliminates the need for the
external LLM proxy when running in SAP environments.

Changes:
- Add AICoreClient with OAuth token caching and deployment URL discovery
- Support both Anthropic and OpenAI models via AI Core deployments
- Update CI to use native AI Core provider
- Update action inputs to accept AI Core credentials
- Update README with AI Core configuration examples

Model names must match AI Core deployment names (e.g. anthropic--claude-4.6-sonnet, gpt-5).

@@ -41,0 +59,4 @@
+  aicore-resource-group:
+    description: 'SAP AI Core resource group (default: default)'
+    required: false
+    default: 'default' 

@@ -0,0 +30,4 @@
+// Thread-safe for concurrent use after construction.
+type AICoreClient struct {
+	config AICoreConfig
+	http   *http.Client

@@ -0,0 +54,4 @@
+}
+
+// WithTimeout sets the HTTP request timeout for AI Core calls.
+// This should be called during construction, before concurrent use.

@@ -0,0 +116,4 @@
+		return "", time.Time{}, fmt.Errorf("token request failed (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	var tokenResp struct {

@@ -0,0 +134,4 @@
+
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+func (c *AICoreClient) getDeploymentURL(ctx context.Context, model string) (string, error) {
+	c.mu.RLock()

@@ -0,0 +161,4 @@
+
+	// Should error on unknown model
+	_, err = client.getDeploymentURL(context.Background(), "unknown-model")
+	if err == nil {

@@ -0,0 +82,4 @@
+	if err != nil {
+		return "", err
+	}
+	c.token = token

@@ -0,0 +115,4 @@
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", time.Time{}, fmt.Errorf("token request failed (status %d): %s", resp.StatusCode, string(body))
+	}
+

@@ -0,0 +201,4 @@
+							Name string `json:"name"`
+						} `json:"model"`
+					} `json:"backend_details"`
+				} `json:"resources"`

@@ -0,0 +320,4 @@
+	deployURL, err := c.getDeploymentURL(ctx, model)
+	if err != nil {
+		return "", err
+	}

@@ -41,3 +62,4 @@
+    default: 'default' 
   conventions-file:
     description: 'Path to conventions file in the repo (e.g. CLAUDE.md)'
     required: false

@@ -0,0 +32,4 @@
+	config AICoreConfig
+	http   *http.Client
+
+	mu          sync.RWMutex

@@ -0,0 +65,4 @@
+	c.mu.RLock()
+	if c.token != "" && time.Now().Add(5*time.Minute).Before(c.tokenExpiry) {
+		token := c.token
+		c.mu.RUnlock()

@@ -0,0 +159,4 @@
+		return "", err
+	}
+
+	if d, ok := c.deployments[model]; ok {

@@ -0,0 +187,4 @@
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("deployments request failed (status %d): %s", resp.StatusCode, string(body))
+	}

@@ -0,0 +221,4 @@
+			ID:  r.ID,
+			URL: r.DeploymentURL,
+		}
+	}

@@ -0,0 +3,4 @@
+import (
+	"context"
+	"encoding/json"
+	"fmt"

@@ -28,33 +29,21 @@ jobs:
         include:

@@ -0,0 +167,4 @@
+
+func (c *AICoreClient) fetchDeployments(ctx context.Context, token string) error {
+	deployURL := strings.TrimRight(c.config.APIURL, "/") + "/v2/lm/deployments"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, deployURL, nil)

@@ -0,0 +283,4 @@
+		return "", fmt.Errorf("AI Core request: %w", err)
+	}
+	defer resp.Body.Close()
+

@@ -0,0 +27,4 @@
+}
+
+// AICoreClient wraps AI Core authentication and deployment discovery.
+// Thread-safe for concurrent use after construction.

@@ -0,0 +34,4 @@
+
+	mu          sync.RWMutex
+	token       string
+	tokenExpiry time.Time

@@ -0,0 +165,4 @@
+	return "", fmt.Errorf("no deployment found for model %q", model)
+}
+
+func (c *AICoreClient) fetchDeployments(ctx context.Context, token string) error {

@@ -0,0 +177,4 @@
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("deployments request: %w", err)
+	}

@@ -0,0 +225,4 @@
+
+	return nil
+}
+

@@ -0,0 +53,4 @@
+	// Second call should use cached token
+	token2, err := client.getToken(context.Background())
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)

@@ -0,0 +84,4 @@
+	}
+	c.token = token
+	c.tokenExpiry = expiry
+	return token, nil

@@ -0,0 +109,4 @@
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("read token response: %w", err)

@@ -0,0 +156,4 @@
+	// Fetch token first (before acquiring write lock to avoid deadlock)
+	token, err := c.getToken(ctx)
+	if err != nil {
+		return "", fmt.Errorf("get token for deployments: %w", err)

@@ -0,0 +181,4 @@
+	deployURL := strings.TrimRight(c.config.APIURL, "/") + "/v2/lm/deployments"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, deployURL, nil)
+	if err != nil {
+		return fmt.Errorf("create deployments request: %w", err)

@@ -0,0 +196,4 @@
+	if err != nil {
+		return fmt.Errorf("read deployments response: %w", err)
+	}
+

@@ -0,0 +244,4 @@
+	token, err := c.getToken(ctx)
+	if err != nil {
+		return "", err
+	}

@@ -0,0 +300,4 @@
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", fmt.Errorf("AI Core API error (status %d): %s", resp.StatusCode, truncateBody(body))
+	}
+

@@ -0,0 +32,4 @@
+		}
+		t.Errorf("unexpected path: %s", r.URL.Path)
+	}))
+	defer server.Close()

@@ -84,10 +90,20 @@ func main() {
 	slog.Info("review-bot starting", "version", version)
 
 	// Validate required fields

@@ -0,0 +17,4 @@
+// Update this when SAP AI Core releases a new stable version.
+const AICoreOpenAIAPIVersion = "2024-12-01-preview"
+
+// maxErrorBodyLen limits the length of response bodies included in error messages

@@ -0,0 +93,4 @@
+	token, expiry, err := c.fetchToken(ctx)
+	if err != nil {
+		return "", err
+	}

@@ -0,0 +142,4 @@
+
+	expiry := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)
+	return tokenResp.AccessToken, expiry, nil
+}

@@ -0,0 +257,4 @@
+				Role:    m.Role,
+				Content: m.Content,
+			})
+		}

@@ -0,0 +44,4 @@
+	token       string
+	tokenExpiry time.Time
+	deployments map[string]string // model name -> deployment URL
+}

@@ -0,0 +187,4 @@
+	req.Header.Set("AI-Resource-Group", c.config.ResourceGroup)
+
+	resp, err := c.http.Do(req)
+	if err != nil {

@@ -0,0 +191,4 @@
+		return fmt.Errorf("deployments request: %w", err)
+	}
+	defer resp.Body.Close()
+

@@ -0,0 +218,4 @@
+	}
+	if err := json.Unmarshal(body, &deployResp); err != nil {
+		return fmt.Errorf("parse deployments response: %w", err)
+	}

@@ -0,0 +277,4 @@
+	}
+
+	// AI Core uses /invoke for Anthropic models
+	invokeURL := strings.TrimRight(deployURL, "/") + "/invoke"

@@ -0,0 +165,4 @@
+		t.Error("expected error for unknown model")
+	}
+}
+

@@ -184,0 +210,4 @@
+	Model       string         `json:"model,omitempty"`
+	MaxTokens   int            `json:"max_tokens"`
+	System      string         `json:"system,omitempty"`
+	Messages    []anthropicMsg `json:"messages"`

@@ -0,0 +100,4 @@
+}
+
+func (c *AICoreClient) fetchToken(ctx context.Context) (string, time.Time, error) {
+	tokenURL := strings.TrimRight(c.config.AuthURL, "/") + "/oauth/token"

@@ -0,0 +178,4 @@
+}
+
+func (c *AICoreClient) fetchDeployments(ctx context.Context, token string) error {
+	deployURL := strings.TrimRight(c.config.APIURL, "/") + "/v2/lm/deployments"

@@ -0,0 +94,4 @@
+	if err != nil {
+		return "", err
+	}
+	c.token = token

@@ -0,0 +160,4 @@
+		token, err = c.getToken(ctx)
+		if err != nil {
+			return "", "", fmt.Errorf("get token: %w", err)
+		}

@@ -0,0 +185,4 @@
+
+	if u, ok := c.deployments[model]; ok {
+		return u, token, nil
+	}

@@ -0,0 +264,4 @@
+				Role:    m.Role,
+				Content: m.Content,
+			})
+		}

@@ -0,0 +26,4 @@
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"access_token": "test-token-123",
+				"expires_in":   3600,

@@ -0,0 +1,391 @@
+package llm

@@ -0,0 +197,4 @@
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("AI-Resource-Group", c.config.ResourceGroup)
+

@@ -0,0 +167,4 @@
+
+	// Fetch token first (before acquiring write lock to avoid holding lock during I/O)
+	token, err = c.getToken(ctx)
+	if err != nil {

@@ -0,0 +299,4 @@
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)

@@ -0,0 +54,4 @@
+		http:        &http.Client{Timeout: 5 * time.Minute},
+		deployments: make(map[string]string),
+	}
+}

@@ -0,0 +152,4 @@
+// during network I/O. In rare cases where multiple goroutines race and one waits a long
+// time for the write lock, the token could theoretically expire. The 5-minute refresh
+// buffer in getToken makes this extremely unlikely in practice.
+func (c *AICoreClient) getDeploymentURL(ctx context.Context, model string) (deployURL, token string, err error) {

@@ -0,0 +195,4 @@
+	if err != nil {
+		return fmt.Errorf("create deployments request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+token)

@@ -0,0 +280,4 @@
+
+	data, err := json.Marshal(reqBody)
+	if err != nil {
+		return "", fmt.Errorf("marshal request: %w", err)

@@ -0,0 +26,4 @@
+			w.Header().Set("Content-Type", "application/json")
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"access_token": "test-token-123",
+				"expires_in":   3600,

@@ -0,0 +49,4 @@
+// NewAICoreClient creates a new AI Core client with the given configuration.
+// The client uses a default 5-minute timeout; use WithTimeout to customize.
+func NewAICoreClient(cfg AICoreConfig) *AICoreClient {
+	return &AICoreClient{

@@ -0,0 +90,4 @@
+		return c.token, nil
+	}
+
+	token, expiry, err := c.fetchToken(ctx)

@@ -0,0 +141,4 @@
+	}
+
+	expiry := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)
+	return tokenResp.AccessToken, expiry, nil

@@ -0,0 +274,4 @@
+		System:    system,
+		Messages:  userMessages,
+	}
+	if temperature > 0 {

@@ -184,0 +210,4 @@
+	Model       string         `json:"model,omitempty"`
+	MaxTokens   int            `json:"max_tokens"`
+	System      string         `json:"system,omitempty"`
+	Messages    []anthropicMsg `json:"messages"`

@@ -0,0 +167,4 @@
+
+	// Fetch token first (before acquiring write lock to avoid holding lock during I/O)
+	token, err = c.getToken(ctx)
+	if err != nil {

@@ -0,0 +270,4 @@
+	reqBody := anthropicRequest{
+		AnthropicVersion: "bedrock-2023-05-31", // SAP AI Core uses Bedrock format
+		// Model omitted - AI Core deployment already specifies model
+		MaxTokens: maxTokens,

@@ -0,0 +342,4 @@
+		Temperature: temperature,
+		Messages:    messages,
+	}
+

@@ -0,0 +117,4 @@
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("token request: %w", err)
+	}
+	defer resp.Body.Close()

@@ -0,0 +247,4 @@
+}
+
+// CompleteAnthropic sends a request to an Anthropic model via AI Core.
+func (c *AICoreClient) CompleteAnthropic(ctx context.Context, model string, messages []Message, maxTokens int, temperature float64) (string, error) {

@@ -0,0 +187,4 @@
+		return u, token, nil
+	}
+	return "", "", fmt.Errorf("no deployment found for model %q", model)
+}

@@ -0,0 +257,4 @@
+	var system string
+	var userMessages []anthropicMsg
+	for _, m := range messages {
+		if m.Role == "system" {

@@ -0,0 +407,4 @@
+	})
+
+	// Default timeout is 5 minutes
+	if client.http.Timeout != 5*time.Minute {

@@ -0,0 +54,4 @@
+		http:        &http.Client{Timeout: 5 * time.Minute},
+		deployments: make(map[string]string),
+	}
+}

@@ -0,0 +152,4 @@
+// during network I/O. In rare cases where multiple goroutines race and one waits a long
+// time for the write lock, the token could theoretically expire. The 5-minute refresh
+// buffer in getToken makes this extremely unlikely in practice.
+func (c *AICoreClient) getDeploymentURL(ctx context.Context, model string) (deployURL, token string, err error) {

@@ -0,0 +230,4 @@
+	}
+	if err := json.Unmarshal(body, &deployResp); err != nil {
+		return fmt.Errorf("parse deployments response: %w", err)
+	}

@@ -0,0 +1,535 @@
+package llm

@@ -184,0 +211,4 @@
+	MaxTokens   int            `json:"max_tokens"`
+	System      string         `json:"system,omitempty"`
+	Messages    []anthropicMsg `json:"messages"`
+	Temperature float64        `json:"temperature,omitempty"`

@@ -128,0 +145,4 @@
+		llmClient.WithAICore(llm.AICoreConfig{
+			ClientID:      *aicoreClientID,
+			ClientSecret:  *aicoreClientSecret,
+			AuthURL:       *aicoreAuthURL,

@@ -0,0 +150,4 @@
+//
+// Note: The token is fetched before acquiring the write lock to avoid holding the lock
+// during network I/O. In rare cases where multiple goroutines race and one waits a long
+// time for the write lock, the token could theoretically expire. The 5-minute refresh

@@ -0,0 +175,4 @@
+	defer c.mu.Unlock()
+
+	// Double-check after acquiring write lock
+	if u, ok := c.deployments[model]; ok {

@@ -0,0 +227,4 @@
+				} `json:"resources"`
+			} `json:"details"`
+		} `json:"resources"`
+	}

@@ -0,0 +258,4 @@
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"resources": []map[string]interface{}{
+				{

@@ -0,0 +392,4 @@
+	if token1 == token2 {
+		t.Error("expected different tokens after expiry")
+	}
+	if atomic.LoadInt32(&tokenCalls) != 2 {

@@ -89,2 +95,3 @@
+	if *giteaURL == "" || *repo == "" || *prNum == "" || *reviewerToken == "" || *llmModel == "" {
 		fmt.Fprintf(os.Stderr, "Error: missing required flags or environment variables\n\n")
-		fmt.Fprintf(os.Stderr, "Required: --gitea-url, --repo, --pr, --reviewer-token, --llm-base-url, --llm-api-key, --llm-model\n")
+		fmt.Fprintf(os.Stderr, "Required: --gitea-url, --repo, --pr, --reviewer-token, --llm-model\n")

@@ -0,0 +147,4 @@
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+// Also returns a valid token for use by the caller, avoiding redundant getToken calls.
+//

@@ -0,0 +207,4 @@
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("read deployments response: %w", err)
+	}

@@ -0,0 +337,4 @@
+		return "", err
+	}
+
+	reqBody := ChatRequest{

@@ -0,0 +442,4 @@
+
+func TestClient_WithTimeout_PropagatestoAICore(t *testing.T) {
+	client := NewClient("http://example.com", "key", "model").
+		WithAICore(AICoreConfig{

@@ -0,0 +90,4 @@
+		return c.token, nil
+	}
+
+	token, expiry, err := c.fetchToken(ctx)

@@ -0,0 +114,4 @@
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := c.http.Do(req)
+	if err != nil {

@@ -0,0 +173,4 @@
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+

@@ -0,0 +31,4 @@
+}
+
+// AICoreClient wraps AI Core authentication and deployment discovery.
+// Thread-safe for concurrent use after construction.

@@ -0,0 +145,4 @@
+}
+
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.

@@ -0,0 +172,4 @@
+	}
+
+	c.mu.Lock()
+	defer c.mu.Unlock()

@@ -0,0 +262,4 @@
+		} else {
+			userMessages = append(userMessages, anthropicMsg{
+				Role:    m.Role,
+				Content: m.Content,

@@ -0,0 +387,4 @@
+	token2, err := client.getToken(context.Background())
+	if err != nil {
+		t.Fatalf("second getToken: %v", err)
+	}

@@ -181,3 +209,1 @@
-	System      string            `json:"system,omitempty"`
-	Messages    []anthropicMsg    `json:"messages"`
-	Temperature float64           `json:"temperature,omitempty"`
+	AnthropicVersion string         `json:"anthropic_version,omitempty"`

@@ -0,0 +113,4 @@
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := c.http.Do(req)

@@ -0,0 +147,4 @@
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+// Also returns a valid token for use by the caller, avoiding redundant getToken calls.
+//

@@ -0,0 +1,391 @@
+package llm

@@ -0,0 +159,4 @@
+		// Still need a token for the caller
+		token, err = c.getToken(ctx)
+		if err != nil {
+			return "", "", fmt.Errorf("get token: %w", err)

@@ -0,0 +262,4 @@
+		} else {
+			userMessages = append(userMessages, anthropicMsg{
+				Role:    m.Role,
+				Content: m.Content,

@@ -176,11 +206,12 @@ func (c *Client) completeOpenAI(ctx context.Context, messages []Message) (string
 // --- Anthropic Messages API implementation ---

@@ -75,0 +76,4 @@
+	aicoreClientID := flag.String("aicore-client-id", envOrDefault("AICORE_CLIENT_ID", ""), "SAP AI Core client ID (for provider=aicore)")
+	aicoreClientSecret := flag.String("aicore-client-secret", envOrDefault("AICORE_CLIENT_SECRET", ""), "SAP AI Core client secret (for provider=aicore)")
+	aicoreAuthURL := flag.String("aicore-auth-url", envOrDefault("AICORE_AUTH_URL", ""), "SAP AI Core auth URL (for provider=aicore)")
+	aicoreAPIURL := flag.String("aicore-api-url", envOrDefault("AICORE_API_URL", ""), "SAP AI Core API URL (for provider=aicore)")

@@ -0,0 +147,4 @@
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+// getDeploymentURL returns the deployment URL for a model, fetching deployments if needed.
+// Also returns a valid token for use by the caller, avoiding redundant getToken calls.
+//

@@ -0,0 +93,4 @@
+	token, expiry, err := c.fetchToken(ctx)
+	if err != nil {
+		return "", err
+	}

@@ -0,0 +112,4 @@
+		return "", time.Time{}, fmt.Errorf("create token request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+

@@ -0,0 +195,4 @@
+	if err != nil {
+		return fmt.Errorf("create deployments request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+token)