PR Review Bot

An intelligent, language-aware GitHub Action that automatically reviews pull requests. It detects code quality issues, security vulnerabilities, missing tests, and provides actionable feedback through inline comments.

Features

• 🔍 Multi-Language Support: Automatically detects and analyzes Python, JavaScript, TypeScript, Java, Go, and more
• 🛡️ Security Scanning: Identifies hardcoded secrets, SQL injection risks, and dangerous API usage
• 🧪 Test Coverage Enforcement: Ensures new code changes include corresponding tests
• 🤖 AI-Powered Analysis: Optional LLM integration for deep code reasoning
• 📊 Repository Learning: Adapts to your codebase's conventions and patterns
• 💬 Smart Comments: Posts inline feedback at exact line numbers with actionable suggestions
• ⚡ Zero Configuration: Works out-of-the-box with sensible defaults

Quick Start

1. Create .github/workflows/pr-review.yml in your repository:

name: PR Review Bot
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Install PR Review Bot
      run: |
        pip install -r scripts/requirements.txt

    - name: Run PR Review
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}  # Optional
      run: python scripts/entrypoint.py

2. That's it! The bot will automatically review all new pull requests.

Configuration

While the bot works without configuration, you can customize its behavior by creating .pr-review.yml:

# Maximum number of inline comments per PR
max_inline_comments: 50

# Minimum severity to report (info, warning, or error)
severity_threshold: info

# Paths to skip during review
skip_paths:
  - "docs/**"
  - "*.md"
  - "vendor/**"
  - "node_modules/**"

# Custom linter configurations
linters:
  python: "flake8 --max-line-length=100"
  javascript: "eslint --no-fix"
  go: "golangci-lint run"

# LLM provider configuration (optional)
llm_provider:
  name: "openai"  # or "anthropic", "self-hosted"
  model: "gpt-4o-mini"
  api_key_env: "OPENAI_API_KEY"
  # For self-hosted:
  # endpoint: "https://your-llm-api.com/v1/chat/completions"

# Patterns to ignore warnings on specific lines
ignore_patterns:
  - "# pr-review-ignore"
  - "// pr-review-ignore"

How It Works

1. Diff Analysis: Fetches PR changes using GitHub's GraphQL API
2. Language Detection: Identifies programming languages and file types
3. Pattern Learning: Analyzes your repository to understand coding conventions
4. Multi-Source Analysis:
   • Runs language-specific linters
   • Performs security heuristics scanning
   • Checks for missing test coverage
   • (Optional) LLM analysis for deeper insights
5. Smart Filtering: Deduplicates findings and respects ignore directives
6. Comment Posting: Places inline comments at exact diff positions

Review Sources

Linters

• Python: pyflakes, flake8, mypy, black --check
• JavaScript/TypeScript: eslint, tsc --noEmit
• Go: go vet, golangci-lint
• Java: javac -Xlint
• Ruby: rubocop
• Rust: cargo clippy

Security Heuristics

• Hardcoded credentials and API keys
• SQL injection vulnerabilities
• Command injection risks
• Unsafe deserialization
• Path traversal vulnerabilities
• Weak cryptography usage

Test Coverage

• Detects source files without corresponding test changes
• Higher severity for bug fixes missing tests
• Respects repository test patterns

AI Analysis (Optional)

• Code quality and maintainability issues
• Performance concerns
• Architectural violations
• Best practice recommendations

Ignore Directives

To suppress warnings on specific lines, add a comment:

password = "temporary123"  # pr-review-ignore

eval(userInput);  // pr-review-ignore

Summary Report

The bot posts a summary comment with:

• Total issues by severity
• Security issue count
• Files with most issues
• Languages analyzed
• Analysis runtime

Examples

Security Issue Detection

# Bad: Hardcoded secret
api_key = "sk-1234567890abcdef"  # 🛑 Hardcoded API key detected

# Good: Environment variable
api_key = os.getenv("API_KEY")

Missing Test Detection

🚨 No test changes found for src/auth.py (45 lines added)
💡 Suggestion: Add unit tests to verify the new functionality

Code Quality Feedback

// ⚠️ Unused variable 'data'
// 💡 Suggestion: Remove unused variable or use it
const data = fetchData();

Environment Variables

Variable	Required	Description
GITHUB_TOKEN	Yes	Automatically provided by GitHub Actions
GITHUB_REPOSITORY	Yes	Automatically provided (format: owner/repo)
OPENAI_API_KEY	No	For AI-powered code analysis
LOG_LEVEL	No	Set to DEBUG for verbose logging

Development

Project Structure

.github/workflows/
  pr-review.yml         # GitHub Action workflow
scripts/
  entrypoint.py         # Main orchestrator
  diff_fetcher.py       # GitHub API integration
  fingerprint.py        # Repository pattern learning
  linter_runner.py      # Static analysis runner
  heuristics_scan.py    # Security scanning
  llm_reasoner.py       # AI integration
  planner.py            # Finding aggregation
  commentator.py        # GitHub comment posting
  utils.py              # Shared utilities
tests/
  test_*.py             # Comprehensive test suite

Running Tests

cd scripts
python -m pytest tests/ -v

Local Development

export GITHUB_TOKEN="your-token"
export GITHUB_REPOSITORY="owner/repo"
export GITHUB_EVENT_PR_NUMBER="123"
python scripts/entrypoint.py --dry-run

Troubleshooting

No comments posted

• Check GitHub Actions logs for errors
• Ensure the workflow has pull-requests: write permission
• Verify changes are in files not matching skip_paths

Rate limiting

• The bot implements exponential backoff and respects GitHub rate limits
• For large PRs, consider increasing max_inline_comments

Missing language support

• Add custom linter configuration in .pr-review.yml
• File an issue for built-in support

Security

• Never commits or logs sensitive information
• Redacts secrets before sending to LLM providers
• All findings are advisory - developers maintain full control

Contributing

Contributions are welcome! Please read our contributing guidelines and submit pull requests to the main repository.

License

This project is licensed under the MIT License - see the LICENSE file for details.# CCGithubBot