Practical AI Code Review with GitHub Actions

# Practical AI Code Review with GitHub Actions ## Article Summary AI code review should be more than a generated pull-request summary. A production workflow must control triggers, permissions, context, costs, duplicate comments, secrets, and false positives while combining static analysis, tests, and model-based review. --- ## 1. The real objective Review pull-request changes in a structured way without granting the model repository write access, and surface high-confidence findings with traceability. Projects usually fail not because the model is completely incapable, but because input, execution, validation, human responsibility, and feedback are not connected into a controlled loop. ## 2. Target architecture 1. **Pull-request triggers and path filters**: define inputs, outputs, ownership, and failure handling. 2. **Checkout with minimal history**: define inputs, outputs, ownership, and failure handling. 3. **Linting, tests, and dependency scanning**: define inputs, outputs, ownership, and failure handling. 4. **Diff and context extraction**: define inputs, outputs, ownership, and failure handling. 5. **Redaction before model review**: define inputs, outputs, ownership, and failure handling. 6. **Severity classification and deduplication**: define inputs, outputs, ownership, and failure handling. 7. **Publishing through a restricted token**: define inputs, outputs, ownership, and failure handling. 8. **Storing prompt, model, and cost metadata**: define inputs, outputs, ownership, and failure handling. ## 3. Implementation steps ### Step 1: Trigger only on opened, synchronize, and reopened events Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ### Step 2: Exclude lockfiles, generated files, and large binaries Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ### Step 3: Run deterministic lint, tests, sast, and dependency checks first Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ### Step 4: Split diffs by file and function with minimal context Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ### Step 5: Require findings in a strict json schema Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ### Step 6: Keep low-confidence suggestions in reports instead of comments Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ### Step 7: Fingerprint findings to avoid duplicate comments Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ### Step 8: Require humans to decide and merge fixes Retain execution records and critical parameters. Before launch, test normal, abnormal, boundary, and unauthorized paths rather than only the happy path. ## 4. Quality and operating metrics - **High-severity recall**: define a baseline, target, and alert threshold. - **False-positive and dismissal rate**: define a baseline, target, and alert threshold. - **Duplicate-comment rate**: define a baseline, target, and alert threshold. - **Model cost per pull request**: define a baseline, target, and alert threshold. - **P95 feedback latency**: define a baseline, target, and alert threshold. - **Accepted suggestion rate**: define a baseline, target, and alert threshold. - **Overlap with deterministic tools**: define a baseline, target, and alert threshold. ## 5. Common failure modes - Sending the complete repository and history to the model. - Using a high-privilege personal token. - Duplicating deterministic tool findings. - Treating style preferences as defects. - Failing to version prompts, rules, and models. ## 6. Implementation recommendations - Start with report-only mode. - Promote only high-confidence findings to inline comments. - Put every automated fix on a separate branch for human review. ## 7. Launch checklist - Are input data, permissions, and retention defined? - Are model, prompt, tool, and rule versions recorded? - Are deterministic checks and human review points present? - Can the workflow retry and roll back without duplicate execution? - Can quality, cost, latency, and business outcomes be measured? - Are alerting, disablement, and incident procedures available? ## Conclusion The correct approach is not to maximize one isolated capability. Build evaluation criteria, permission boundaries, and a continuous improvement loop around real work. Validate on a narrow production-like scope before expanding. For more practical AI product comparisons and production engineering guidance, visit **Zyentor Picks**: https://www.zyentorpicks.com/.