name: AI Code Review



on:

  pull_request:

    types: [opened, synchronize, reopened]

    # Only run on PRs targeting main/master

    branches:

      - main

      - master



# Limit concurrent runs to avoid API rate limits

concurrency:

  group: ai-review-${{ github.event.pull_request.number }}

  cancel-in-progress: true



jobs:

  ai-review:

    name: Claude Code Review

    runs-on: ubuntu-latest

    # Skip draft PRs

    if: github.event.pull_request.draft == false



    permissions:

      contents: read

      pull-requests: write



    steps:

      - name: Checkout repository

        uses: actions/checkout@v4

        with:

          fetch-depth: 0



      - name: Set up Node.js

        uses: actions/setup-node@v4

        with:

          node-version: '20'

          cache: 'npm'



      - name: Install dependencies

        run: |

          npm install @anthropic-ai/sdk@latest

          npm install @octokit/rest@latest



      - name: Run AI Code Review

        env:

          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

          PR_NUMBER: ${{ github.event.pull_request.number }}

          REPO_OWNER: ${{ github.repository_owner }}

          REPO_NAME: ${{ github.event.repository.name }}

          BASE_SHA: ${{ github.event.pull_request.base.sha }}

          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

        run: node .github/scripts/ai-review.js



      - name: Upload review artifacts

        if: always()

        uses: actions/upload-artifact@v4

        with:

          name: ai-review-${{ github.event.pull_request.number }}

          path: /tmp/ai-review-*.json

          retention-days: 7

import Anthropic from '@anthropic-ai/sdk';

import { Octokit } from '@octokit/rest';

import { execSync } from 'child_process';

import fs from 'fs';



// Configuration

const MAX_DIFF_LINES = 500;      // Truncate massive diffs

const MAX_FILE_SIZE = 50_000;    // Skip files over 50KB

const REVIEW_COMMENT_TAG = '<!-- AI-CODE-REVIEW -->';



// File extensions to review (skip binary, generated files)

const REVIEWABLE_EXTENSIONS = new Set([

  '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',

  '.py', '.rb', '.go', '.rs', '.java', '.kt',

  '.c', '.cpp', '.h', '.hpp', '.cs',

  '.php', '.swift', '.scala',

  '.sh', '.bash', '.zsh',

  '.yml', '.yaml', '.json', '.toml',

  '.sql', '.graphql',

]);



// Files/patterns to skip

const SKIP_PATTERNS = [

  /node_modules/,

  /\.min\.(js|css)$/,

  /package-lock\.json$/,

  /yarn\.lock$/,

  /pnpm-lock\.yaml$/,

  /dist\//,

  /build\//,

  /\.generated\./,

  /__generated__/,

  /migrations\/\d+/,

];



const anthropic = new Anthropic({

  apiKey: process.env.ANTHROPIC_API_KEY,

});



const octokit = new Octokit({

  auth: process.env.GITHUB_TOKEN,

});



/**

 * Fetch the PR diff using git

 */

async function getPRDiff(baseSha, headSha) {

  try {

    const diff = execSync(

      `git diff ${baseSha}..${headSha} --unified=5 --no-color`,

      { maxBuffer: 10 * 1024 * 1024 } // 10MB buffer

    ).toString();

    return diff;

  } catch (error) {

    console.error('Failed to get diff:', error.message);

    throw error;

  }

}



/**

 * Parse diff into per-file chunks

 */

function parseDiff(rawDiff) {

  const files = [];

  const fileDiffRegex = /^diff --git a\/(.*?) b\/(.*?)$/gm;

  const parts = rawDiff.split(/^diff --git /m).slice(1);



  for (const part of parts) {

    const lines = part.split('\n');

    const headerLine = lines[0]; // "a/path b/path"

    const match = headerLine.match(/a\/(.*?) b\/(.*)/);

    if (!match) continue;



    const filePath = match[2];

    const ext = '.' + filePath.split('.').pop();



    // Skip non-reviewable files

    if (!REVIEWABLE_EXTENSIONS.has(ext)) continue;

    if (SKIP_PATTERNS.some(p => p.test(filePath))) continue;



    const diffContent = 'diff --git ' + part;

    const addedLines = lines.filter(l => l.startsWith('+')).length;

    const removedLines = lines.filter(l => l.startsWith('-')).length;



    files.push({

      path: filePath,

      diff: diffContent,

      addedLines,

      removedLines,

      lineCount: lines.length,

    });

  }



  return files;

}



/**

 * Build the review prompt for Claude

 */

function buildReviewPrompt(files) {

  const fileSection = files.map(f => {

    const truncatedDiff = f.diff.split('\n').slice(0, MAX_DIFF_LINES).join('\n');

    const wasTruncated = f.diff.split('\n').length > MAX_DIFF_LINES;



    return `### File: ${f.path}

${wasTruncated ? `*(diff truncated at ${MAX_DIFF_LINES} lines)*\n` : ''}

\`\`\`diff

${truncatedDiff}

\`\`\``;

  }).join('\n\n');



  return `You are an expert code reviewer performing a thorough analysis of a pull request diff.



Review the following code changes and identify:

1. **Security vulnerabilities** — SQL injection, XSS, CSRF, path traversal, hardcoded credentials, insecure dependencies

2. **Logic bugs** — off-by-one errors, null/undefined dereferences, race conditions, incorrect conditionals

3. **Error handling gaps** — unhandled promise rejections, missing try/catch, unchecked return values

4. **Performance issues** — N+1 queries, unnecessary re-renders, missing memoization, memory leaks

5. **Maintainability** — overly complex functions, missing comments on non-obvious logic, magic numbers



For each issue found:

- Specify the **file path** and approximate **line number**

- Give a **severity**: CRITICAL, HIGH, MEDIUM, LOW

- Provide a **clear explanation** of the problem

- Suggest a **concrete fix** with example code when applicable



If the code is well-written with no significant issues, say so clearly.



Format your response as JSON matching this schema:

{

  "summary": "2-3 sentence overall assessment",

  "score": 1-10,

  "issues": [

    {

      "file": "path/to/file.js",

      "line": 42,

      "severity": "HIGH",

      "category": "security|logic|error-handling|performance|style",

      "title": "Short issue title",

      "description": "Detailed explanation",

      "suggestion": "How to fix it",

      "codeExample": "Optional corrected code snippet"

    }

  ],

  "positives": ["List of things done well"],

  "blockers": true/false

}



## Changes to Review



${fileSection}`;

}



/**

 * Call Claude API to review the code

 */

async function reviewWithClaude(prompt) {

  console.log('Sending diff to Claude for review...');



  const message = await anthropic.messages.create({

    model: 'claude-opus-4-5',

    max_tokens: 4096,

    temperature: 0.1, // Low temperature for consistent, precise analysis

    system: `You are a senior software engineer performing code review. You are thorough, precise, and constructive.

You prioritize security and correctness above all else. You always respond with valid JSON.`,

    messages: [

      {

        role: 'user',

        content: prompt,

      },

    ],

  });



  const responseText = message.content[0].text;



  // Extract JSON from response (Claude sometimes wraps in markdown)

  const jsonMatch = responseText.match(/\{[\s\S]*\}/);

  if (!jsonMatch) {

    throw new Error('Claude did not return valid JSON');

  }



  return JSON.parse(jsonMatch[0]);

}



/**

 * Format review results as a markdown comment

 */

function formatReviewComment(review, filesReviewed) {

  const severityEmoji = {

    CRITICAL: '🚨',

    HIGH: '⚠️',

    MEDIUM: '💡',

    LOW: '📝',

  };



  const scoreEmoji = review.score >= 8 ? '✅' : review.score >= 6 ? '🟡' : '🔴';



  let comment = `${REVIEW_COMMENT_TAG}

## 🤖 AI Code Review



${scoreEmoji} **Score: ${review.score}/10** | **Files reviewed: ${filesReviewed}** | **Blockers: ${review.blockers ? 'YES ⛔' : 'None ✅'}**



### Summary

${review.summary}



`;



  if (review.issues && review.issues.length > 0) {

    // Group by severity

    const bySeverity = { CRITICAL: [], HIGH: [], MEDIUM: [], LOW: [] };

    for (const issue of review.issues) {

      bySeverity[issue.severity]?.push(issue);

    }



    comment += `### Issues Found (${review.issues.length})\n\n`;



    for (const [severity, issues] of Object.entries(bySeverity)) {

      if (issues.length === 0) continue;

      comment += `#### ${severityEmoji[severity]} ${severity} (${issues.length})\n\n`;



      for (const issue of issues) {

        comment += `**${issue.title}** — \`${issue.file}:${issue.line}\`\n`;

        comment += `${issue.description}\n\n`;

        if (issue.suggestion) {

          comment += `> **Fix:** ${issue.suggestion}\n\n`;

        }

        if (issue.codeExample) {

          comment += `\`\`\`\n${issue.codeExample}\n\`\`\`\n\n`;

        }

      }

    }

  } else {

    comment += `### ✅ No Issues Found\n\nThis change looks good! No significant issues detected.\n\n`;

  }



  if (review.positives && review.positives.length > 0) {

    comment += `### 👍 What's Good\n`;

    for (const positive of review.positives) {

      comment += `- ${positive}\n`;

    }

    comment += '\n';

  }



  comment += `---\n*Reviewed by Claude claude-opus-4-5 · [Report an issue](https://github.com/anthropics/anthropic-sdk-python/issues)*`;



  return comment;

}



/**

 * Post or update the review comment on the PR

 */

async function postReviewComment(owner, repo, prNumber, commentBody) {

  // Find existing AI review comment to update

  const { data: comments } = await octokit.rest.issues.listComments({

    owner,

    repo,

    issue_number: prNumber,

  });



  const existingComment = comments.find(c => c.body.includes(REVIEW_COMMENT_TAG));



  if (existingComment) {

    console.log(`Updating existing review comment ${existingComment.id}`);

    await octokit.rest.issues.updateComment({

      owner,

      repo,

      comment_id: existingComment.id,

      body: commentBody,

    });

  } else {

    console.log('Creating new review comment');

    await octokit.rest.issues.createComment({

      owner,

      repo,

      issue_number: prNumber,

      body: commentBody,

    });

  }

}



/**

 * Main execution

 */

async function main() {

  const {

    REPO_OWNER: owner,

    REPO_NAME: repo,

    PR_NUMBER,

    BASE_SHA,

    HEAD_SHA,

  } = process.env;



  const prNumber = parseInt(PR_NUMBER, 10);



  console.log(`\n=== AI Code Review ===`);

  console.log(`Repository: ${owner}/${repo}`);

  console.log(`PR #${prNumber}: ${BASE_SHA}..${HEAD_SHA}\n`);



  try {

    // Step 1: Get the diff

    const rawDiff = await getPRDiff(BASE_SHA, HEAD_SHA);



    if (!rawDiff.trim()) {

      console.log('No diff found — skipping review');

      return;

    }



    // Step 2: Parse into files

    const files = parseDiff(rawDiff);

    console.log(`Found ${files.length} reviewable files`);



    if (files.length === 0) {

      console.log('No reviewable files in this PR (all binary, generated, or lock files)');

      return;

    }



    // Step 3: Build prompt and review

    const prompt = buildReviewPrompt(files);

    const review = await reviewWithClaude(prompt);



    console.log(`Review complete: score=${review.score}, issues=${review.issues?.length ?? 0}`);



    // Step 4: Save artifacts

    const artifactPath = `/tmp/ai-review-${prNumber}.json`;

    fs.writeFileSync(artifactPath, JSON.stringify({ review, files: files.map(f => f.path) }, null, 2));



    // Step 5: Post comment

    const comment = formatReviewComment(review, files.length);

    await postReviewComment(owner, repo, prNumber, comment);



    console.log('Review comment posted successfully');



    // Step 6: Fail the check if there are critical blockers

    if (review.blockers && review.issues?.some(i => i.severity === 'CRITICAL')) {

      console.error('\n❌ Critical issues found — failing the check');

      process.exit(1);

    }



  } catch (error) {

    console.error('Review failed:', error);



    // Post error comment so developers know the bot failed

    try {

      await postReviewComment(owner, repo, prNumber,

        `${REVIEW_COMMENT_TAG}\n## 🤖 AI Code Review\n\n❌ Review failed: ${error.message}\n\nThe AI review bot encountered an error. Please review manually.`

      );

    } catch (commentError) {

      console.error('Failed to post error comment:', commentError.message);

    }



    process.exit(1);

  }

}



main();

# Using GitHub CLI

gh secret set ANTHROPIC_API_KEY --body "sk-ant-..." --repo your-org/your-repo



# Or through the web UI:

# Settings → Secrets and variables → Actions → New repository secret

const securityPrompt = `

Analyze this code for security vulnerabilities.

Think through each of these attack vectors step by step:



1. Input validation: Is user input sanitized before use?

2. Authentication: Are auth checks applied consistently?

3. Authorization: Can a user access another user's data?

4. Injection: Any SQL, command, or template injection possibilities?

5. Secrets: Any hardcoded credentials or API keys?



For each vector, explain your reasoning before concluding.

`;

async function getFileContext(filePath, baseSha) {

  // Get recent git log for this file

  const log = execSync(

    `git log --oneline -10 ${baseSha} -- ${filePath}`

  ).toString();



  return `Recent changes to ${filePath}:\n${log}`;

}



// Inject context into prompt

const contextualPrompt = `

${await getFileContext(file.path, BASE_SHA)}



Given this history, review the following change carefully for

regressions and consistency with the existing codebase:



${file.diff}

`;

function getLanguageGuidelines(ext) {

  const guidelines = {

    '.ts': `

- Check for any 'any' types that should be more specific

- Verify async/await error handling

- Look for missing return types on exported functions

- Check for proper null/undefined handling with optional chaining

    `,

    '.py': `

- Check for mutable default arguments (def foo(x=[]))

- Verify exception types are specific, not bare 'except:'

- Look for string formatting using % instead of f-strings

- Check for proper resource cleanup (context managers)

    `,

    '.go': `

- Verify all errors are explicitly handled, not ignored with _

- Check for goroutine leaks (channels that are never closed)

- Look for race conditions in concurrent code

- Verify defer statements are used correctly

    `,

  };

  return guidelines[ext] || '';

}

const MAX_TOKENS_PER_REQUEST = 100_000; // Claude's context window

const CHARS_PER_TOKEN_ESTIMATE = 4;

const MAX_CHARS = MAX_TOKENS_PER_REQUEST * CHARS_PER_TOKEN_ESTIMATE;



async function reviewLargePR(files) {

  // Sort by priority: security-sensitive files first

  const prioritized = files.sort((a, b) => {

    const securityFiles = /auth|security|crypto|token|password|secret/i;

    const aIsSecurity = securityFiles.test(a.path);

    const bIsSecurity = securityFiles.test(b.path);

    if (aIsSecurity && !bIsSecurity) return -1;

    if (!aIsSecurity && bIsSecurity) return 1;

    return b.addedLines - a.addedLines; // Then by size

  });



  const batches = [];

  let currentBatch = [];

  let currentSize = 0;



  for (const file of prioritized) {

    const fileSize = file.diff.length;

    if (currentSize + fileSize > MAX_CHARS && currentBatch.length > 0) {

      batches.push(currentBatch);

      currentBatch = [file];

      currentSize = fileSize;

    } else {

      currentBatch.push(file);

      currentSize += fileSize;

    }

  }

  if (currentBatch.length > 0) batches.push(currentBatch);



  console.log(`Splitting ${files.length} files into ${batches.length} review batches`);



  // Review each batch

  const reviews = await Promise.all(

    batches.map((batch, i) => {

      console.log(`Reviewing batch ${i + 1}/${batches.length} (${batch.length} files)`);

      return reviewWithClaude(buildReviewPrompt(batch));

    })

  );



  // Merge results

  return mergeReviews(reviews);

}



function mergeReviews(reviews) {

  const allIssues = reviews.flatMap(r => r.issues || []);

  const avgScore = reviews.reduce((sum, r) => sum + r.score, 0) / reviews.length;

  const hasBlockers = reviews.some(r => r.blockers);



  return {

    summary: reviews.map(r => r.summary).join(' '),

    score: Math.round(avgScore),

    issues: allIssues,

    positives: reviews.flatMap(r => r.positives || []),

    blockers: hasBlockers,

  };

}

async function postInlineComments(owner, repo, prNumber, commitSha, issues) {

  // Create a review with inline comments

  const reviewComments = issues

    .filter(issue => issue.file && issue.line)

    .map(issue => ({

      path: issue.file,

      line: issue.line,

      side: 'RIGHT',

      body: `**${issue.severity}: ${issue.title}**\n\n${issue.description}\n\n${

        issue.suggestion ? `**Fix:** ${issue.suggestion}` : ''

      }`,

    }));



  if (reviewComments.length === 0) return;



  await octokit.rest.pulls.createReview({

    owner,

    repo,

    pull_number: prNumber,

    commit_id: commitSha,

    event: 'COMMENT', // 'APPROVE' or 'REQUEST_CHANGES' for stronger feedback

    comments: reviewComments,

  });

}

// Estimate tokens before sending

function estimateTokens(text) {

  // Rough estimate: 1 token ≈ 4 characters

  return Math.ceil(text.length / 4);

}



// Cost per 1M tokens (claude-opus-4-5 as of 2024)

const COST_PER_1M_INPUT = 15.00;

const COST_PER_1M_OUTPUT = 75.00;



function estimateCost(inputTokens, outputTokens = 2000) {

  const inputCost = (inputTokens / 1_000_000) * COST_PER_1M_INPUT;

  const outputCost = (outputTokens / 1_000_000) * COST_PER_1M_OUTPUT;

  return (inputCost + outputCost).toFixed(4);

}



// Skip review if diff is too large (likely auto-generated)

const MAX_REVIEW_COST_USD = 0.50;



async function shouldReview(files) {

  const totalChars = files.reduce((sum, f) => sum + f.diff.length, 0);

  const estimatedTokens = Math.ceil(totalChars / 4);

  const estimatedCost = parseFloat(estimateCost(estimatedTokens));



  if (estimatedCost > MAX_REVIEW_COST_USD) {

    console.warn(`Estimated cost $${estimatedCost} exceeds limit $${MAX_REVIEW_COST_USD}`);

    console.warn('Skipping full review — will review only changed files over 10 lines');

    return false;

  }



  console.log(`Estimated review cost: $${estimatedCost}`);

  return true;

}

import crypto from 'crypto';



function hashDiff(diff) {

  return crypto.createHash('sha256').update(diff).digest('hex').slice(0, 16);

}



// Store in GitHub Actions cache or external store

const reviewCache = new Map();



async function getCachedOrReview(file) {

  const cacheKey = hashDiff(file.diff);



  if (reviewCache.has(cacheKey)) {

    console.log(`Cache hit for ${file.path}`);

    return reviewCache.get(cacheKey);

  }



  const review = await reviewWithClaude(buildReviewPrompt([file]));

  reviewCache.set(cacheKey, review);

  return review;

}

PR Opened/Updated

      ↓

GitHub Actions Triggers

      ↓

Checkout Code + Install deps

      ↓

git diff baseSha..headSha

      ↓

Parse diff → Filter files (skip binaries, lock files, generated)

      ↓

Prioritize files (security-sensitive first)

      ↓

Batch if too large → Send to Claude API

      ↓

Parse JSON response

      ↓

Format markdown comment

      ↓

Post/Update PR comment via GitHub API

      ↓

Fail check if CRITICAL blockers found

const SYSTEM_PROMPT = `You are a senior software engineer with 15 years of experience.

You have deep expertise in security, performance, and system design.

You are thorough but not pedantic — you focus on issues that actually matter.

You always provide actionable feedback with concrete examples.

You respond only with valid JSON, never markdown prose outside the JSON.`;



const diffPrompt = (files) => `

Review the following code changes for a production system serving millions of users.



Critical areas to check:

- Any change to authentication or authorization logic

- Database queries (especially with user-supplied data)

- File system operations

- External API calls and their error handling

- Cryptographic operations

- Race conditions in async code



${buildFileSection(files)}



Remember: A false negative (missing a real bug) is far worse than a false positive.

When in doubt, flag it.

`;