AI-Powered Code Review: How to Set Up Automated PR Reviews

The Code Review Bottleneck

Code review is essential but expensive. Senior engineers spend 4-8 hours per week reviewing PRs. Junior engineers wait hours or days for feedback. Critical bugs slip through when reviewers are fatigued or rushed.

AI-powered code review does not replace human reviewers. It augments them by catching the mechanical issues — style violations, potential bugs, security flaws, performance anti-patterns — so humans can focus on architecture, design, and business logic.

Approaches to AI Code Review

There are three tiers of AI code review, each with different trade-offs:

Tier 1: Cloud API (Easiest)

Use OpenAI, Anthropic, or Google APIs to analyze diffs. Fast to set up, but code leaves your network.

Tier 2: Self-Hosted Model (Private)

Run a code-specialized model like CodeLlama or DeepSeek Coder locally. Code stays internal but requires GPU hardware.

Tier 3: Fine-Tuned Model (Best Quality)

Fine-tune a model on your codebase and past review comments. Best results but requires ML expertise.

Building a GitHub Actions AI Reviewer

Here is a complete GitHub Actions workflow that reviews every PR:

name: AI Code Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get diff
        id: diff
        run: |
          git diff origin/${{ github.base_ref }}...HEAD > /tmp/pr.diff
          echo "diff_size=$(wc -c < /tmp/pr.diff)" >> $GITHUB_OUTPUT

      - name: AI Review
        if: steps.diff.outputs.diff_size < 100000
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          DIFF=$(cat /tmp/pr.diff)
          REVIEW=$(curl -s https://api.anthropic.com/v1/messages \
            -H "x-api-key: $ANTHROPIC_API_KEY" \
            -H "anthropic-version: 2023-06-01" \
            -H "content-type: application/json" \
            -d "{
              \"model\": \"claude-sonnet-4-20250514\",
              \"max_tokens\": 4096,
              \"messages\": [{
                \"role\": \"user\",
                \"content\": \"Review this code diff. Focus on bugs, security issues, performance problems, and style. Be concise. Format as markdown.\n\nDiff:\n$DIFF\"
              }]
            }" | jq -r '.content[0].text')

          gh pr comment ${{ github.event.number }} \
            --body "## AI Code Review\n\n$REVIEW\n\n---\n*Automated review by AI. Human review still required.*"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Self-Hosted Alternative with Ollama

For teams that cannot send code to external APIs, use Ollama in your CI pipeline:

# In your Gitea Actions or self-hosted runner
- name: AI Review (Self-Hosted)
  run: |
    DIFF=$(git diff origin/main...HEAD)
    REVIEW=$(curl -s http://ollama.internal:11434/api/generate \
      -d "{
        \"model\": \"deepseek-coder:6.7b\",
        \"prompt\": \"Review this diff for bugs and issues:\n$DIFF\",
        \"stream\": false
      }" | jq -r '.response')
    echo "$REVIEW" > review.md

This is exactly how we handle it at TechSaaS — our Gitea Actions runner calls a local Ollama instance, keeping all code on our infrastructure.

What Good AI Reviews Catch

Based on our experience running AI reviews on hundreds of PRs:

Consistently catches:

• Null pointer / undefined access risks
• SQL injection and XSS vulnerabilities
• Missing error handling
• Hardcoded secrets and credentials
• Obvious performance issues (N+1 queries, unnecessary re-renders)
• Style inconsistencies and naming convention violations

Sometimes catches:

• Race conditions
• Logic errors in complex business rules
• Memory leaks

Rarely catches:

• Architectural problems
• Missing requirements
• Edge cases specific to your domain

Reducing False Positives

AI reviewers are noisy by default. Reduce false positives with:

1. Custom system prompts: Tell the model your tech stack, conventions, and what to ignore
2. File filtering: Skip generated files, lock files, and vendor directories
3. Severity levels: Only comment on medium+ severity issues
4. Diff size limits: Skip massive PRs (AI context windows struggle with 5000+ line diffs)

# Example: Filter files before sending to AI
EXCLUDE_PATTERNS = [
    "*.lock", "*.min.js", "*.generated.*",
    "vendor/*", "node_modules/*", "__pycache__/*",
    "*.pb.go", "*.swagger.json"
]

Measuring Impact

Track these metrics before and after enabling AI review:

• Time to first review: Should decrease by 60-80%
• Bugs caught in review vs production: Should shift left
• Review comment resolution time: Should decrease
• Developer satisfaction: Survey quarterly

The Human-AI Review Workflow

The ideal workflow combines both:

1. PR is opened
2. AI reviews immediately (< 2 minutes)
3. Developer addresses AI feedback
4. Human reviewer focuses on design and logic
5. Approval and merge

This cuts total review cycle time by 40-60% while improving quality. At TechSaaS, we set up this pipeline as part of our DevOps consulting. Reach out at [email protected].