# AI Code Review Assistant

> A first-pass reviewer that reads the diff in repository context

| | |
|---|---|
| **Category** | Development |
| **Type** | Agentic Workflow |
| **Difficulty** | Advanced |
| **Automation** | Mostly automated |
| **Runtime** | ~10 min |
| **Est. cost** | $0.45 |
| **Version** | 1.0.0 |

## Purpose

Human review time is the scarce resource. This assistant does the first pass — the mechanical checks, the convention violations, the obvious correctness and security problems — so the human reviewer spends their attention on design and intent.

It posts comments; it does not approve or block. Merge authority stays with people.

## Problems solved

- Review queues block delivery
- Convention violations consume reviewer attention
- Security issues slip through under time pressure
- Review depth varies with reviewer workload

## Benefits

- First-pass review arrives in minutes, not hours
- Consistent standard regardless of who is on rota
- Security patterns checked on every change
- Human reviewers start from a triaged list

## Limitations

- Produces false positives — the human triage step is essential
- Weak on architectural judgement and product intent
- Needs repository retrieval to be useful on a large codebase
- Must never gate merge on its own

## Success metrics

- Time to first review comment
- Precision of flagged issues (accepted versus dismissed)
- Defects caught before human review
- Cycle time from PR open to merge

## Prerequisites

- **Api key** — LLM API key
- **Account** — GitHub or GitLab
- **Permission** — Repository access scope
- **Software** — Conventions document _(optional)_

## AI tools used

- **ChatGPT**
- **Claude**
- **GitHub Copilot**
- **Cursor**

## Steps

### 1. Pull request opened

Webhook fires with the diff, changed files and PR description.

- _Tool:_ GitHub
- _Time:_ 1 min

### 2. Retrieve repository context

Fetch the definitions, callers and tests around the changed lines — a diff read without context produces useless review.

- _Time:_ 2 min

### 3. Review for correctness

Look for logic errors, unhandled edge cases, race conditions and broken assumptions.

- _Model:_ Claude Sonnet
- _Time:_ 3 min

```text
Review this diff for correctness. You have the surrounding repository context.

Diff:
{{diff}}

Context:
{{context}}

For each issue found:
- file and line
- what is wrong
- a concrete failure scenario: specific inputs or state that produce the wrong result
- suggested fix

Only report issues you can describe a concrete failure for. Do not report style preferences here. If the diff looks correct, say so — a clean review is a valid result.
```

### 4. Review for security

Check for injection, authorisation gaps, unsafe deserialisation, secret exposure and dependency risk.

- _Model:_ Claude Sonnet
- _Time:_ 2 min

> ⚠️ Anything touching authentication, authorisation, payments or user data should escalate to a named human reviewer regardless of the finding

### 5. Check conventions

Compare against the repository's own conventions — naming, error handling, test placement, comment density.

- _Time:_ 1 min

### 6. Post inline comments

Deduplicate findings, rank by severity and post them inline, capped so the PR stays readable.

- _Tool:_ GitHub
- _Time:_ 1 min

> ⚠️ Cap the comment count — thirty comments on one PR gets the bot muted permanently

### 7. Human review and merge

A human triages the comments, reviews design and intent, and decides on merge.

- _Time:_ 5 min

## FAQ

**Should it block merges?**

No. Precision is not high enough to gate on, and a bot that blocks merges on false positives gets disabled within a week. Comment-only, human decides.

**How do we stop it being noisy?**

Cap comments per PR, require a concrete failure scenario before reporting a correctness issue, and disable the categories your team consistently dismisses.

**Does our code get used for training?**

That depends on your provider and plan. Business and enterprise tiers usually exclude it contractually — verify in writing before connecting a private repository.

---

_Exported from AIToolsay — https://invitationbuddy.com/workflows/ai-code-review-assistant_