Automating Code Reviews with AI & GitHub Actions: Boost Quality & Ship Faster

Introduction & The Problem

The Solution Concept & Architecture

Step-by-Step Implementation

# .github/actions/ai-review/action.yml
name: 'AI Code Reviewer'
description: 'Performs an AI-powered code review on a Pull Request.'
inputs:
  github-token:
    description: 'GitHub token for API access (e.g., ${{ secrets.GITHUB_TOKEN }})'
    required: true
  ai-api-key:
    description: 'API key for the AI service (e.g., OpenAI, Claude)'
    required: true
  ai-api-url:
    description: 'Optional: Custom URL for the AI API endpoint'
    required: false
    default: 'https://api.openai.com/v1/chat/completions' # Default for OpenAI
runs:
  using: 'node16' # Or 'node20', depending on your environment
  main: 'index.js'

// .github/actions/ai-review/index.js
const core = require('@actions/core');
const github = require('@actions/github');
const fetch = require('node-fetch'); // You might need to 'npm install node-fetch' if not available globally

async function run() {
    try {
        // 1. Get input parameters from the GitHub Action workflow
        const githubToken = core.getInput('github-token', { required: true });
        const aiApiKey = core.getInput('ai-api-key', { required: true });
        const aiApiUrl = core.getInput('ai-api-url', { required: false }) || 'https://api.openai.com/v1/chat/completions';

        // Initialize Octokit for GitHub API interactions
        const octokit = github.getOctokit(githubToken);
        const { owner, repo } = github.context.repo;
        const prNumber = github.context.payload.pull_request.number;

        if (!prNumber) {
            core.setFailed('Could not get Pull Request number from context. This action only runs on PRs.');
            return;
        }

        core.info(`Processing PR #${prNumber} for ${owner}/${repo}`);

        // 2. Fetch the diff for the Pull Request
        // The `mediaType.format: 'diff'` header requests the raw diff content.
        const { data: diffContent } = await octokit.rest.pulls.get({
            owner,
            repo,
            pull_number: prNumber,
            mediaType: {
                format: 'diff'
            }
        });

        if (!diffContent || diffContent.trim() === '') {
            core.info('No diff content found for AI review. Skipping.');
            return;
        }

        core.info('Diff content fetched. Sending to AI for review...');

        // 3. Construct AI prompt and call the AI service
        const prompt = `You are a world-class senior software engineer tasked with reviewing a Pull Request.
Review the following code diff for potential bugs, security vulnerabilities, performance issues, and adherence to best practices.
Provide concise, constructive feedback, suggest clear improvements, and explain your reasoning.
Focus on critical issues first. Format your response using Markdown, highlighting code snippets.

Code Diff:
\
${diffContent}
\
`;

        let aiReviewResponse;
        try {
            const response = await fetch(aiApiUrl, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'Authorization': `Bearer ${aiApiKey}`
                },
                body: JSON.stringify({
                    model: 'gpt-4o', // Adjust model as needed (e.g., 'claude-3-5-sonnet-20240620')
                    messages: [{ role: 'user', content: prompt }],
                    temperature: 0.7,
                    max_tokens: 1500
                })
            });

            if (!response.ok) {
                const errorData = await response.json();
                throw new Error(`AI API error: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
            }

            const data = await response.json();
            aiReviewResponse = data.choices[0].message.content;

        } catch (apiError) {
            core.warning(`Failed to call AI API: ${apiError.message}. Proceeding without AI review.`);
            aiReviewResponse = 'AI review encountered an error. Please review manually.';
        }

        if (!aiReviewResponse || aiReviewResponse.trim() === '') {
            core.info('AI review did not return any suggestions. Skipping comment.');
            return;
        }

        core.info('AI review complete. Posting comments...');

        // 4. Post AI suggestions as a comment on the Pull Request
        const commentBody = `## AI Code Review Suggestions

${aiReviewResponse}

---
*This review was generated by an AI assistant. Please use your best judgment and human review for final decisions.*`;

        await octokit.rest.issues.createComment({
            owner,
            repo,
            issue_number: prNumber,
            body: commentBody
        });

        core.info('AI code review posted successfully.');

    } catch (error) {
        core.setFailed(error.message);
    }
}

run();

# .github/workflows/ai-code-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened] # Trigger on new PRs, updates, and reopens

jobs:
  ai_review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write # Grant write permission to post comments on PRs

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Important: Fetches the entire history to get a full diff

      - name: Install dependencies (if your custom action has any)
        run: npm install # Necessary if your index.js uses packages like 'node-fetch'
        working-directory: ./.github/actions/ai-review

      - name: Run AI Code Review Action
        uses: ./.github/actions/ai-review # Path to your custom action
        id: ai_review_step
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }} # Provided by GitHub automatically
          ai-api-key: ${{ secrets.OPENAI_API_KEY }} # Store your AI API key as a GitHub Secret
          # ai-api-url: 'https://api.your-custom-ai.com/v1/chat/completions' # Uncomment if using a custom endpoint

Optimization & Best Practices

Business Impact & ROI

Conclusion