diff --git a/.github/workflows/reviewer-pr.yaml b/.github/workflows/reviewer-pr.yaml
new file mode 100644
index 00000000..e56b87ca
--- /dev/null
+++ b/.github/workflows/reviewer-pr.yaml
@@ -0,0 +1,43 @@
+# .github/workflows/review-pr.yml
+name: Review PR with ChatGPT (secure)
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  review:
+    if: ${{ !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      # SAFE: checkout the base repo at the base SHA (not attacker code)
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+
+      # Use a pinned release of your action (not ./)
+      - name: Review PR
+        uses: osl-incubator/github-actions-chatgpt-pr-reviewer@1.0.9
+        with:
+          openai_api_key: ${{ secrets.OPENAI_API_KEY }}
+          openai_model: gpt-5
+          openai_temperature: "0.0"
+          openai_max_tokens: "16000"
+          openai_extra_criteria: |
+            verify SOLID principle violations;
+            code should be objective;
+            code should avoid redundancy;
+          github_token: ${{ github.token }}
+          github_pr_id: ${{ github.event.pull_request.number }}
+          exclude_path: |
+            **/*.{png,jpg,jpeg,webp,avif,gif,tif,tiff,ico,bmp,svg,pdf,flac,ogg,wav,mp3,mp4,mov}
+            **/*.{zip,tar,tar.gz,gz,7z,rar,bin,exe,wasm,woff,woff2,ttf,otf,heic,heif}
+            **/*.{pkl,sqlite,sqlite3,db}
+            **/*.{lock,lockb}
+            package-lock.json, yarn.lock, pnpm-lock.yaml, Pipfile.lock, Cargo.lock, Gemfile.lock
+            **/*.ipynb