1
2
3
4
5

PR Created → GitHub Action → Fetch Changes → Claude Analysis → Comment Review → Human Review
     ↓
Auto-checks: Security, Performance, A11y, Style, Logic
     ↓
Intelligent feedback with suggested fixes

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# .github/workflows/ai-code-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened]
  pull_request_review_comment:
    types: [created]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      
      - name: Install dependencies
        run: |
          npm ci
          npm install @anthropic-ai/sdk @octokit/rest diff
      
      - name: Run AI Code Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}
        run: node scripts/ai-review.js

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348

// scripts/ai-review.js
const Anthropic = require('@anthropic-ai/sdk');
const { Octokit } = require('@octokit/rest');
const { execSync } = require('child_process');
const fs = require('fs');

class AICodeReviewer {
  constructor() {
    this.anthropic = new Anthropic({
      apiKey: process.env.ANTHROPIC_API_KEY,
    });
    
    this.github = new Octokit({
      auth: process.env.GITHUB_TOKEN,
    });
    
    this.prNumber = process.env.PR_NUMBER;
    this.repoOwner = process.env.REPO_OWNER;
    this.repoName = process.env.REPO_NAME;
  }

  async reviewPR() {
    try {
      // Get PR details and changed files
      const { data: pr } = await this.github.pulls.get({
        owner: this.repoOwner,
        repo: this.repoName,
        pull_number: this.prNumber,
      });

      const { data: files } = await this.github.pulls.listFiles({
        owner: this.repoOwner,
        repo: this.repoName,
        pull_number: this.prNumber,
      });

      // Filter for code files only
      const codeFiles = files.filter(file => 
        this.isCodeFile(file.filename) && 
        file.status !== 'removed' &&
        file.changes < 500 // Skip very large files
      );

      if (codeFiles.length === 0) {
        console.log('No code files to review');
        return;
      }

      // Review each file
      const reviews = [];
      for (const file of codeFiles.slice(0, 10)) { // Limit to 10 files per PR
        const review = await this.reviewFile(file);
        if (review) {
          reviews.push(review);
        }
      }

      // Generate overall summary
      const summary = await this.generateSummary(reviews, pr);
      
      // Post review comment
      await this.postReview(summary, reviews);

    } catch (error) {
      console.error('Error in AI review:', error);
      // Post error comment for visibility
      await this.postErrorComment(error.message);
    }
  }

  isCodeFile(filename) {
    const codeExtensions = ['.js', '.jsx', '.ts', '.tsx', '.py', '.java', '.go', '.rs', '.php', '.rb'];
    return codeExtensions.some(ext => filename.endsWith(ext));
  }

  async reviewFile(file) {
    try {
      const content = await this.getFileContent(file.filename);
      const patch = file.patch;
      
      if (!patch || !content) return null;

      const prompt = this.buildReviewPrompt(file.filename, content, patch);
      
      const response = await this.anthropic.messages.create({
        model: 'claude-3-5-sonnet-20241022',
        max_tokens: 2000,
        temperature: 0.1,
        messages: [{
          role: 'user',
          content: prompt
        }]
      });

      const reviewText = response.content[0].text;
      
      // Parse the response to extract specific issues
      const issues = this.parseReviewResponse(reviewText);
      
      return {
        filename: file.filename,
        issues: issues,
        rawReview: reviewText
      };

    } catch (error) {
      console.error(`Error reviewing file ${file.filename}:`, error);
      return null;
    }
  }

  buildReviewPrompt(filename, content, patch) {
    return `You are an expert code reviewer. Analyze this code change and provide specific, actionable feedback.

CONTEXT:
- File: ${filename}
- This is a Pull Request diff, focus on the changed lines

FILE CONTENT:
\`\`\`
${content}
\`\`\`

CHANGES (diff):
\`\`\`diff
${patch}
\`\`\`

REVIEW CRITERIA:
1. Security vulnerabilities (XSS, injection, auth issues)
2. Performance problems (memory leaks, inefficient algorithms)
3. Accessibility issues (missing alt text, keyboard navigation)
4. Code quality (complexity, readability, maintainability)
5. Best practices for the specific language/framework
6. Potential bugs or edge cases

RESPONSE FORMAT:
For each issue found, provide:
- SEVERITY: Critical/High/Medium/Low
- CATEGORY: Security/Performance/Accessibility/Quality/Bug
- LINE: Approximate line number
- ISSUE: Clear description
- FIX: Specific solution with code example if applicable

If no issues found, respond with: "LGTM - No issues detected"

Be specific and actionable. Focus on real problems, not stylistic preferences.`;
  }

  parseReviewResponse(reviewText) {
    if (reviewText.includes('LGTM - No issues detected')) {
      return [];
    }

    const issues = [];
    const sections = reviewText.split(/SEVERITY:|CATEGORY:|LINE:|ISSUE:|FIX:/).filter(s => s.trim());
    
    for (let i = 0; i < sections.length; i += 5) {
      if (i + 4 < sections.length) {
        issues.push({
          severity: sections[i].trim(),
          category: sections[i + 1].trim(),
          line: sections[i + 2].trim(),
          issue: sections[i + 3].trim(),
          fix: sections[i + 4].trim()
        });
      }
    }

    return issues;
  }

  async getFileContent(filename) {
    try {
      const { data } = await this.github.repos.getContent({
        owner: this.repoOwner,
        repo: this.repoName,
        path: filename,
        ref: `refs/pull/${this.prNumber}/head`
      });
      
      return Buffer.from(data.content, 'base64').toString('utf-8');
    } catch (error) {
      console.error(`Error fetching file content for ${filename}:`, error);
      return null;
    }
  }

  async generateSummary(reviews, pr) {
    const totalIssues = reviews.reduce((sum, review) => sum + review.issues.length, 0);
    
    if (totalIssues === 0) {
      return {
        overall: 'positive',
        message: 'Great work! AI review found no significant issues.',
        stats: { critical: 0, high: 0, medium: 0, low: 0 }
      };
    }

    const stats = {
      critical: 0,
      high: 0,
      medium: 0,
      low: 0
    };

    reviews.forEach(review => {
      review.issues.forEach(issue => {
        const severity = issue.severity.toLowerCase();
        if (stats[severity] !== undefined) {
          stats[severity]++;
        }
      });
    });

    const overall = stats.critical > 0 ? 'critical' : stats.high > 0 ? 'needs_work' : 'minor_issues';
    
    return {
      overall,
      message: this.generateSummaryMessage(stats),
      stats
    };
  }

  generateSummaryMessage(stats) {
    const total = Object.values(stats).reduce((sum, count) => sum + count, 0);
    
    if (stats.critical > 0) {
      return `Found ${total} issues including ${stats.critical} critical security/performance problems that need immediate attention.`;
    }
    
    if (stats.high > 0) {
      return `Found ${total} issues including ${stats.high} important problems that should be addressed before merging.`;
    }
    
    return `Found ${total} minor issues that could be improved but don't block the PR.`;
  }

  async postReview(summary, reviews) {
    const reviewComment = this.formatReviewComment(summary, reviews);
    
    await this.github.issues.createComment({
      owner: this.repoOwner,
      repo: this.repoName,
      issue_number: this.prNumber,
      body: reviewComment
    });

    // Also post individual file comments for critical/high issues
    for (const review of reviews) {
      const criticalIssues = review.issues.filter(issue => 
        ['critical', 'high'].includes(issue.severity.toLowerCase())
      );
      
      if (criticalIssues.length > 0) {
        await this.postFileComment(review.filename, criticalIssues);
      }
    }
  }

  formatReviewComment(summary, reviews) {
    let comment = `## AI Code Review Summary\n\n`;
    
    // Overall status
    const statusEmoji = {
      positive: '✅',
      minor_issues: '⚠️',
      needs_work: '🔄',
      critical: '❌'
    };
    
    comment += `${statusEmoji[summary.overall]} **Status:** ${summary.message}\n\n`;
    
    // Stats breakdown
    if (summary.stats.critical + summary.stats.high + summary.stats.medium + summary.stats.low > 0) {
      comment += `### Issue Breakdown\n`;
      comment += `- 🔴 Critical: ${summary.stats.critical}\n`;
      comment += `- 🟠 High: ${summary.stats.high}\n`;
      comment += `- 🟡 Medium: ${summary.stats.medium}\n`;
      comment += `- 🔵 Low: ${summary.stats.low}\n\n`;
    }

    // File-by-file breakdown
    if (reviews.length > 0) {
      comment += `### Files Reviewed\n`;
      
      reviews.forEach(review => {
        const issueCount = review.issues.length;
        const emoji = issueCount === 0 ? '✅' : issueCount < 3 ? '⚠️' : '❌';
        comment += `${emoji} \`${review.filename}\` - ${issueCount} issues\n`;
      });
      
      comment += `\n`;
    }

    // Top issues
    const allIssues = reviews.flatMap(review => 
      review.issues.map(issue => ({ ...issue, filename: review.filename }))
    );
    
    const criticalIssues = allIssues.filter(issue => 
      ['critical', 'high'].includes(issue.severity.toLowerCase())
    );

    if (criticalIssues.length > 0) {
      comment += `### Priority Issues\n`;
      
      criticalIssues.slice(0, 5).forEach((issue, index) => {
        const severityEmoji = issue.severity.toLowerCase() === 'critical' ? '🔴' : '🟠';
        comment += `${severityEmoji} **${issue.category}** in \`${issue.filename}\`\n`;
        comment += `   ${issue.issue}\n`;
        if (issue.fix) {
          comment += `   💡 **Fix:** ${issue.fix}\n`;
        }
        comment += `\n`;
      });
    }

    comment += `\n---\n`;
    comment += `*This review was generated by AI. Please verify all suggestions before implementing.*`;
    
    return comment;
  }

  async postFileComment(filename, issues) {
    // This would post inline comments on specific lines
    // Implementation depends on your needs for granular feedback
  }

  async postErrorComment(errorMessage) {
    const comment = `## AI Code Review Error\n\n❌ The AI code review encountered an error:\n\n\`\`\`\n${errorMessage}\n\`\`\`\n\nPlease review this PR manually.`;
    
    await this.github.issues.createComment({
      owner: this.repoOwner,
      repo: this.repoName,
      issue_number: this.prNumber,
      body: comment
    });
  }
}

// Main execution
async function main() {
  const reviewer = new AICodeReviewer();
  await reviewer.reviewPR();
}

main().catch(console.error);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// Custom prompts for different file types
const PROMPTS = {
  react: `
Additional React-specific checks:
- useEffect cleanup functions
- Dependency array correctness
- State update patterns
- Component re-render optimization
- Props validation and TypeScript usage
- Accessibility in JSX (ARIA labels, semantic HTML)
`,

  api: `
Additional API-specific checks:
- Input validation and sanitization
- Authentication and authorization
- Rate limiting considerations
- Error handling and logging
- SQL injection prevention
- Sensitive data exposure
`,

  database: `
Additional database-specific checks:
- Query performance and indexing
- N+1 query problems
- Transaction handling
- Data validation
- Migration safety
- Connection pooling
`
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

// .ai-review-config.json
{
  "severity_thresholds": {
    "block_merge": ["critical"],
    "require_review": ["critical", "high"],
    "auto_approve": ["low"]
  },
  "file_patterns": {
    "skip": ["*.test.js", "*.spec.ts", "dist/**"],
    "priority": ["src/auth/**", "src/api/**"],
    "accessibility_required": ["src/components/**"]
  },
  "team_standards": {
    "max_function_length": 50,
    "require_jsdoc": true,
    "enforce_typescript": true,
    "accessibility_level": "AA"
  },
  "integrations": {
    "slack_webhook": "https://hooks.slack.com/...",
    "notify_on": ["critical", "high"]
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

function UserProfile({ userId }) {
  const [data, setData] = useState(null);
  
  useEffect(() => {
    const interval = setInterval(async () => {
      const user = await fetchUser(userId);
      setData(user);
    }, 5000);
  }, [userId]);
  
  return <div>{data?.name}</div>;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

SEVERITY: High
CATEGORY: Performance
LINE: 4-8
ISSUE: Memory leak - setInterval is not cleaned up when component unmounts
FIX: Add cleanup function:

useEffect(() => {
  const interval = setInterval(async () => {
    const user = await fetchUser(userId);
    setData(user);
  }, 5000);
  
  return () => clearInterval(interval);
}, [userId]);

1
2
3
4
5
6

app.get('/user/:id', (req, res) => {
  const query = `SELECT * FROM users WHERE id = ${req.params.id}`;
  db.query(query, (err, results) => {
    res.json(results);
  });
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

SEVERITY: Critical
CATEGORY: Security
LINE: 2
ISSUE: SQL injection vulnerability - user input directly interpolated into query
FIX: Use parameterized queries:

const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [req.params.id], (err, results) => {
  res.json(results);
});

1
2
3

<button onClick={handleSubmit}>
  <img src="/submit-icon.png" />
</button>

1
2
3
4
5
6
7
8
9

SEVERITY: Medium
CATEGORY: Accessibility
LINE: 1-3
ISSUE: Button has no accessible text for screen readers
FIX: Add alt text or aria-label:

<button onClick={handleSubmit} aria-label="Submit form">
  <img src="/submit-icon.png" alt="" />
</button>

1
2
3
4

- Claude API usage (avg 2M tokens): $8.50
- GitHub Actions compute: $0 (free tier)
- Development/maintenance: 2 hours/month
- Total: ~$8.50/month

1
2
3
4

- Code review time reduced: 2 hours/day → 45 minutes/day
- Time saved per day: 1.25 hours
- Monthly savings: 25+ hours
- Value (at $100/hour): $2,500/month

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// Track when humans override AI suggestions
async function trackFeedback(reviewId, humanOverride) {
  await db.feedback.create({
    review_id: reviewId,
    ai_suggestion: aiSuggestion,
    human_decision: humanOverride,
    outcome: 'accepted' | 'rejected'
  });
  
  // Use this data to improve prompts
}

1
2
3
4
5
6
7
8
9

async function notifySlack(severity, prUrl, issues) {
  if (['critical', 'high'].includes(severity)) {
    await slack.chat.postMessage({
      channel: '#code-review',
      text: `🚨 ${severity.toUpperCase()} issues found in PR: ${prUrl}`,
      attachments: formatIssuesForSlack(issues)
    });
  }
}

1
2
3
4
5
6
7
8
9

// Monitor API usage and costs
async function trackUsage(tokens, cost, reviewTime) {
  await metrics.record({
    tokens_used: tokens,
    cost: cost,
    review_duration: reviewTime,
    timestamp: new Date()
  });
}

1
2
3
4
5
6
7

// Split large PRs into chunks
if (totalChanges > 1000) {
  return await this.postComment(`
    This PR is too large for AI review (${totalChanges} changes).
    Consider splitting into smaller PRs for better review quality.
  `);
}

1
2
3

// Allow developers to mark false positives
// @ai-review: ignore-next-line security
const userInput = req.body.trustedContent;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

// Implement exponential backoff
async function callClaudeWithRetry(prompt, retries = 3) {
  try {
    return await this.anthropic.messages.create({...});
  } catch (error) {
    if (error.status === 429 && retries > 0) {
      await sleep(Math.pow(2, 4 - retries) * 1000);
      return this.callClaudeWithRetry(prompt, retries - 1);
    }
    throw error;
  }
}

1
2
3
4
5
6
7
8

// A/B test different prompt variations
const prompts = {
  strict: "Flag any potential issue, even minor ones",
  balanced: "Focus on significant issues that impact functionality or security",
  critical: "Only flag critical security and performance issues"
};

// Track which prompts give best human-accepted ratio

1
2
3
4
5
6
7
8
9

// Pass repository context to Claude
const context = `
This is a ${projectType} project using ${framework}.
Common patterns in this codebase:
- Authentication: JWT with refresh tokens
- State management: Redux Toolkit
- Styling: Tailwind CSS
- Testing: Jest + React Testing Library
`;