# AI Code Review Assistant — AI Workflow export
# https://invitationbuddy.com/workflows/ai-code-review-assistant
schema_version: "1.0"
exported_at: "2026-08-16T11:22:05+00:00"
source: "https://invitationbuddy.com/workflows/ai-code-review-assistant"
workflow:
  name: AI Code Review Assistant
  slug: "ai-code-review-assistant"
  version: "1.0.0"
  tagline: "A first-pass reviewer that reads the diff in repository context"
  summary: "Runs on every pull request: reads the diff with surrounding repository context, flags correctness, security and convention issues, and posts inline comments a human reviewer triages."
  description: |-
    Human review time is the scarce resource. This assistant does the first pass — the mechanical checks, the convention violations, the obvious correctness and security problems — so the human reviewer spends their attention on design and intent.
    
    It posts comments; it does not approve or block. Merge authority stays with people.
  category: Development
  type: Agentic Workflow
  difficulty: advanced
  automation_level: mostly_automated
  pricing: freemium
  language: en
  trigger:
    type: github_event
    detail: Pull request opened
  input_types:
    - code
    - api
    - json
  output_types:
    - code
    - summary
    - report
  author: null
  company: null
  last_updated: "2026-07-17"
overview:
  purpose: |-
    Human review time is the scarce resource. This assistant does the first pass — the mechanical checks, the convention violations, the obvious correctness and security problems — so the human reviewer spends their attention on design and intent.
    
    It posts comments; it does not approve or block. Merge authority stays with people.
  business_value: Shortens review cycles and catches routine issues before a human spends attention on them.
  expected_outcome: "Every pull request receives a first-pass review with inline comments within minutes of opening."
  problems_solved:
    - Review queues block delivery
    - Convention violations consume reviewer attention
    - Security issues slip through under time pressure
    - Review depth varies with reviewer workload
  ideal_users:
    - Engineering teams with meaningful PR volume
    - "Open-source maintainers triaging contributions"
    - Teams enforcing consistent conventions
  benefits:
    - "First-pass review arrives in minutes, not hours"
    - Consistent standard regardless of who is on rota
    - Security patterns checked on every change
    - Human reviewers start from a triaged list
  limitations:
    - Produces false positives — the human triage step is essential
    - Weak on architectural judgement and product intent
    - Needs repository retrieval to be useful on a large codebase
    - Must never gate merge on its own
  success_metrics:
    - Time to first review comment
    - Precision of flagged issues (accepted versus dismissed)
    - Defects caught before human review
    - Cycle time from PR open to merge
metrics:
  estimated_minutes: 10
  estimated_cost: 0.45
  cost_currency: USD
  estimated_tokens: 25000
  success_rate: 87
  automation_percent: 80
  human_review_percent: 20
industries:
  - SaaS
  - Gaming
  - Finance
tags:
  - Enterprise Ready
  - "Real-time"
  - Self Hosted
ai_skills:
  - Code Generation
  - Reasoning
tools:
  -
    name: ChatGPT
    role: primary
    required: true
    url: "https://invitationbuddy.com/ai-directory/chatgpt"
  -
    name: Claude
    role: supporting
    required: true
    url: "https://invitationbuddy.com/ai-directory/claude"
  -
    name: GitHub Copilot
    role: supporting
    required: false
    url: "https://invitationbuddy.com/ai-directory/github-copilot"
  -
    name: Cursor
    role: supporting
    required: false
    url: "https://invitationbuddy.com/ai-directory/cursor"
models: []
integrations:
  -
    name: Anthropic
    kind: ai_provider
    auth_type: api_key
    required: true
  -
    name: OpenAI
    kind: ai_provider
    auth_type: api_key
    required: true
  -
    name: GitHub
    kind: developer
    auth_type: oauth
    required: false
  -
    name: Slack
    kind: communication
    auth_type: oauth
    required: false
  -
    name: Webhook
    kind: protocol
    auth_type: webhook
    required: false
prerequisites:
  -
    kind: api_key
    label: LLM API key
    detail: A model with strong code reasoning and a large context window.
    required: true
  -
    kind: account
    label: GitHub or GitLab
    detail: With webhook and PR comment permissions.
    required: true
  -
    kind: permission
    label: Repository access scope
    detail: "Least-privilege token — read the diff and post comments, nothing more."
    required: true
  -
    kind: software
    label: Conventions document
    detail: "Your actual standards, so it flags against yours rather than generic ones."
    required: false
steps:
  -
    number: 1
    title: Pull request opened
    description: "Webhook fires with the diff, changed files and PR description."
    tool: GitHub
    input: PR payload
    output: Review job
    estimated_minutes: 1
    difficulty: advanced
    automation: auto
    manual_review: false
  -
    number: 2
    title: Retrieve repository context
    description: "Fetch the definitions, callers and tests around the changed lines — a diff read without context produces useless review."
    input: Changed files
    output: Context bundle
    estimated_minutes: 2
    difficulty: advanced
    automation: auto
    manual_review: false
    tips:
      - This step is the difference between a useful reviewer and a linter with opinions
  -
    number: 3
    title: Review for correctness
    description: "Look for logic errors, unhandled edge cases, race conditions and broken assumptions."
    model: Claude Sonnet
    prompt: |-
      Review this diff for correctness. You have the surrounding repository context.
      
      Diff:
      {{diff}}
      
      Context:
      {{context}}
      
      For each issue found:
      - file and line
      - what is wrong
      - a concrete failure scenario: specific inputs or state that produce the wrong result
      - suggested fix
      
      Only report issues you can describe a concrete failure for. Do not report style preferences here. If the diff looks correct, say so — a clean review is a valid result.
    input: Diff + context
    output: Correctness findings
    estimated_minutes: 3
    difficulty: advanced
    automation: auto
    manual_review: false
  -
    number: 4
    title: Review for security
    description: "Check for injection, authorisation gaps, unsafe deserialisation, secret exposure and dependency risk."
    model: Claude Sonnet
    input: Diff + context
    output: Security findings
    estimated_minutes: 2
    difficulty: advanced
    automation: auto
    manual_review: false
    warnings:
      - "Anything touching authentication, authorisation, payments or user data should escalate to a named human reviewer regardless of the finding"
  -
    number: 5
    title: Check conventions
    description: "Compare against the repository's own conventions — naming, error handling, test placement, comment density."
    input: Diff + conventions doc
    output: Convention findings
    estimated_minutes: 1
    difficulty: advanced
    automation: auto
    manual_review: false
  -
    number: 6
    title: Post inline comments
    description: "Deduplicate findings, rank by severity and post them inline, capped so the PR stays readable."
    tool: GitHub
    input: All findings
    output: PR comments
    expected_result: A triaged comment set on the PR within minutes.
    estimated_minutes: 1
    difficulty: advanced
    automation: auto
    manual_review: false
    warnings:
      - Cap the comment count — thirty comments on one PR gets the bot muted permanently
  -
    number: 7
    title: Human review and merge
    description: "A human triages the comments, reviews design and intent, and decides on merge."
    input: PR + comments
    output: Merge decision
    expected_result: Merge authority stays with a person.
    estimated_minutes: 5
    difficulty: advanced
    automation: manual
    manual_review: true
prompts:
  -
    title: Review for correctness
    kind: user
    body: |-
      Review this diff for correctness. You have the surrounding repository context.
      
      Diff:
      {{diff}}
      
      Context:
      {{context}}
      
      For each issue found:
      - file and line
      - what is wrong
      - a concrete failure scenario: specific inputs or state that produce the wrong result
      - suggested fix
      
      Only report issues you can describe a concrete failure for. Do not report style preferences here. If the diff looks correct, say so — a clean review is a valid result.
    variables:
      - diff
      - context
    model_hint: Claude Sonnet
use_cases:
  -
    title: "Pre-review triage"
    description: Catch routine issues before a human opens the PR.
    industry: SaaS
    outcome: Shorter review cycles
  -
    title: "Open-source contributions"
    description: "Give first-time contributors immediate, consistent feedback."
    industry: Gaming
    outcome: Faster contributor onboarding
  -
    title: "Security-sensitive repositories"
    description: Run a security pass on every change automatically.
    industry: Finance
    outcome: Consistent security review
faq:
  -
    question: "Should it block merges?"
    answer: "No. Precision is not high enough to gate on, and a bot that blocks merges on false positives gets disabled within a week. Comment-only, human decides."
  -
    question: "How do we stop it being noisy?"
    answer: "Cap comments per PR, require a concrete failure scenario before reporting a correctness issue, and disable the categories your team consistently dismisses."
  -
    question: "Does our code get used for training?"
    answer: That depends on your provider and plan. Business and enterprise tiers usually exclude it contractually — verify in writing before connecting a private repository.
