{
    "schema_version": "1.0",
    "exported_at": "2026-08-16T12:24:47+00:00",
    "source": "https://invitationbuddy.com/workflows/ai-code-review-assistant",
    "workflow": {
        "name": "AI Code Review Assistant",
        "slug": "ai-code-review-assistant",
        "version": "1.0.0",
        "tagline": "A first-pass reviewer that reads the diff in repository context",
        "summary": "Runs on every pull request: reads the diff with surrounding repository context, flags correctness, security and convention issues, and posts inline comments a human reviewer triages.",
        "description": "Human review time is the scarce resource. This assistant does the first pass — the mechanical checks, the convention violations, the obvious correctness and security problems — so the human reviewer spends their attention on design and intent.\n\nIt posts comments; it does not approve or block. Merge authority stays with people.",
        "category": "Development",
        "type": "Agentic Workflow",
        "difficulty": "advanced",
        "automation_level": "mostly_automated",
        "pricing": "freemium",
        "language": "en",
        "trigger": {
            "type": "github_event",
            "detail": "Pull request opened"
        },
        "input_types": [
            "code",
            "api",
            "json"
        ],
        "output_types": [
            "code",
            "summary",
            "report"
        ],
        "author": null,
        "company": null,
        "last_updated": "2026-07-17"
    },
    "overview": {
        "purpose": "Human review time is the scarce resource. This assistant does the first pass — the mechanical checks, the convention violations, the obvious correctness and security problems — so the human reviewer spends their attention on design and intent.\n\nIt posts comments; it does not approve or block. Merge authority stays with people.",
        "business_value": "Shortens review cycles and catches routine issues before a human spends attention on them.",
        "expected_outcome": "Every pull request receives a first-pass review with inline comments within minutes of opening.",
        "problems_solved": [
            "Review queues block delivery",
            "Convention violations consume reviewer attention",
            "Security issues slip through under time pressure",
            "Review depth varies with reviewer workload"
        ],
        "ideal_users": [
            "Engineering teams with meaningful PR volume",
            "Open-source maintainers triaging contributions",
            "Teams enforcing consistent conventions"
        ],
        "benefits": [
            "First-pass review arrives in minutes, not hours",
            "Consistent standard regardless of who is on rota",
            "Security patterns checked on every change",
            "Human reviewers start from a triaged list"
        ],
        "limitations": [
            "Produces false positives — the human triage step is essential",
            "Weak on architectural judgement and product intent",
            "Needs repository retrieval to be useful on a large codebase",
            "Must never gate merge on its own"
        ],
        "success_metrics": [
            "Time to first review comment",
            "Precision of flagged issues (accepted versus dismissed)",
            "Defects caught before human review",
            "Cycle time from PR open to merge"
        ]
    },
    "metrics": {
        "estimated_minutes": 10,
        "estimated_cost": 0.45,
        "cost_currency": "USD",
        "estimated_tokens": 25000,
        "success_rate": 87,
        "automation_percent": 80,
        "human_review_percent": 20
    },
    "industries": [
        "SaaS",
        "Gaming",
        "Finance"
    ],
    "tags": [
        "Enterprise Ready",
        "Real-time",
        "Self Hosted"
    ],
    "ai_skills": [
        "Code Generation",
        "Reasoning"
    ],
    "tools": [
        {
            "name": "ChatGPT",
            "role": "primary",
            "required": true,
            "url": "https://invitationbuddy.com/ai-directory/chatgpt"
        },
        {
            "name": "Claude",
            "role": "supporting",
            "required": true,
            "url": "https://invitationbuddy.com/ai-directory/claude"
        },
        {
            "name": "GitHub Copilot",
            "role": "supporting",
            "required": false,
            "url": "https://invitationbuddy.com/ai-directory/github-copilot"
        },
        {
            "name": "Cursor",
            "role": "supporting",
            "required": false,
            "url": "https://invitationbuddy.com/ai-directory/cursor"
        }
    ],
    "models": [],
    "integrations": [
        {
            "name": "Anthropic",
            "kind": "ai_provider",
            "auth_type": "api_key",
            "required": true
        },
        {
            "name": "OpenAI",
            "kind": "ai_provider",
            "auth_type": "api_key",
            "required": true
        },
        {
            "name": "GitHub",
            "kind": "developer",
            "auth_type": "oauth",
            "required": false
        },
        {
            "name": "Slack",
            "kind": "communication",
            "auth_type": "oauth",
            "required": false
        },
        {
            "name": "Webhook",
            "kind": "protocol",
            "auth_type": "webhook",
            "required": false
        }
    ],
    "prerequisites": [
        {
            "kind": "api_key",
            "label": "LLM API key",
            "detail": "A model with strong code reasoning and a large context window.",
            "required": true
        },
        {
            "kind": "account",
            "label": "GitHub or GitLab",
            "detail": "With webhook and PR comment permissions.",
            "required": true
        },
        {
            "kind": "permission",
            "label": "Repository access scope",
            "detail": "Least-privilege token — read the diff and post comments, nothing more.",
            "required": true
        },
        {
            "kind": "software",
            "label": "Conventions document",
            "detail": "Your actual standards, so it flags against yours rather than generic ones.",
            "required": false
        }
    ],
    "steps": [
        {
            "number": 1,
            "title": "Pull request opened",
            "description": "Webhook fires with the diff, changed files and PR description.",
            "tool": "GitHub",
            "input": "PR payload",
            "output": "Review job",
            "estimated_minutes": 1,
            "difficulty": "advanced",
            "automation": "auto",
            "manual_review": false
        },
        {
            "number": 2,
            "title": "Retrieve repository context",
            "description": "Fetch the definitions, callers and tests around the changed lines — a diff read without context produces useless review.",
            "input": "Changed files",
            "output": "Context bundle",
            "estimated_minutes": 2,
            "difficulty": "advanced",
            "automation": "auto",
            "manual_review": false,
            "tips": [
                "This step is the difference between a useful reviewer and a linter with opinions"
            ]
        },
        {
            "number": 3,
            "title": "Review for correctness",
            "description": "Look for logic errors, unhandled edge cases, race conditions and broken assumptions.",
            "model": "Claude Sonnet",
            "prompt": "Review this diff for correctness. You have the surrounding repository context.\n\nDiff:\n{{diff}}\n\nContext:\n{{context}}\n\nFor each issue found:\n- file and line\n- what is wrong\n- a concrete failure scenario: specific inputs or state that produce the wrong result\n- suggested fix\n\nOnly report issues you can describe a concrete failure for. Do not report style preferences here. If the diff looks correct, say so — a clean review is a valid result.",
            "input": "Diff + context",
            "output": "Correctness findings",
            "estimated_minutes": 3,
            "difficulty": "advanced",
            "automation": "auto",
            "manual_review": false
        },
        {
            "number": 4,
            "title": "Review for security",
            "description": "Check for injection, authorisation gaps, unsafe deserialisation, secret exposure and dependency risk.",
            "model": "Claude Sonnet",
            "input": "Diff + context",
            "output": "Security findings",
            "estimated_minutes": 2,
            "difficulty": "advanced",
            "automation": "auto",
            "manual_review": false,
            "warnings": [
                "Anything touching authentication, authorisation, payments or user data should escalate to a named human reviewer regardless of the finding"
            ]
        },
        {
            "number": 5,
            "title": "Check conventions",
            "description": "Compare against the repository's own conventions — naming, error handling, test placement, comment density.",
            "input": "Diff + conventions doc",
            "output": "Convention findings",
            "estimated_minutes": 1,
            "difficulty": "advanced",
            "automation": "auto",
            "manual_review": false
        },
        {
            "number": 6,
            "title": "Post inline comments",
            "description": "Deduplicate findings, rank by severity and post them inline, capped so the PR stays readable.",
            "tool": "GitHub",
            "input": "All findings",
            "output": "PR comments",
            "expected_result": "A triaged comment set on the PR within minutes.",
            "estimated_minutes": 1,
            "difficulty": "advanced",
            "automation": "auto",
            "manual_review": false,
            "warnings": [
                "Cap the comment count — thirty comments on one PR gets the bot muted permanently"
            ]
        },
        {
            "number": 7,
            "title": "Human review and merge",
            "description": "A human triages the comments, reviews design and intent, and decides on merge.",
            "input": "PR + comments",
            "output": "Merge decision",
            "expected_result": "Merge authority stays with a person.",
            "estimated_minutes": 5,
            "difficulty": "advanced",
            "automation": "manual",
            "manual_review": true
        }
    ],
    "prompts": [
        {
            "title": "Review for correctness",
            "kind": "user",
            "body": "Review this diff for correctness. You have the surrounding repository context.\n\nDiff:\n{{diff}}\n\nContext:\n{{context}}\n\nFor each issue found:\n- file and line\n- what is wrong\n- a concrete failure scenario: specific inputs or state that produce the wrong result\n- suggested fix\n\nOnly report issues you can describe a concrete failure for. Do not report style preferences here. If the diff looks correct, say so — a clean review is a valid result.",
            "variables": [
                "diff",
                "context"
            ],
            "model_hint": "Claude Sonnet"
        }
    ],
    "use_cases": [
        {
            "title": "Pre-review triage",
            "description": "Catch routine issues before a human opens the PR.",
            "industry": "SaaS",
            "outcome": "Shorter review cycles"
        },
        {
            "title": "Open-source contributions",
            "description": "Give first-time contributors immediate, consistent feedback.",
            "industry": "Gaming",
            "outcome": "Faster contributor onboarding"
        },
        {
            "title": "Security-sensitive repositories",
            "description": "Run a security pass on every change automatically.",
            "industry": "Finance",
            "outcome": "Consistent security review"
        }
    ],
    "faq": [
        {
            "question": "Should it block merges?",
            "answer": "No. Precision is not high enough to gate on, and a bot that blocks merges on false positives gets disabled within a week. Comment-only, human decides."
        },
        {
            "question": "How do we stop it being noisy?",
            "answer": "Cap comments per PR, require a concrete failure scenario before reporting a correctness issue, and disable the categories your team consistently dismisses."
        },
        {
            "question": "Does our code get used for training?",
            "answer": "That depends on your provider and plan. Business and enterprise tiers usually exclude it contractually — verify in writing before connecting a private repository."
        }
    ]
}