🤖 PR Review Agent

AI-powered, GitHub-native pull request review automation.
Review your PRs automatically. Get actionable feedback directly where the code changed.

PR → Diff → AI Review → Findings → GitHub Comments

---

✨ What Is This?

PR Review Agent is an automated AI code-review system that runs inside GitHub Actions whenever a pull request is opened or updated.

Instead of manually inspecting every changed file first, the agent handles the repetitive review workflow:

Important: The current M1–M5 implementation is a reviewer, not an autonomous code editor. It identifies problems and comments on them; the developer remains responsible for changing the code.

---

🏃 Quick Start

1️⃣ Run the installer

From the root of your GitHub repository:

npx @debangsu__/create-pr-review-agent

You don't need to manually clone the reviewer implementation first; the package can be fetched by npx.

---

2️⃣ Choose your AI provider

The installer asks which model provider should perform reviews:

== AI PR Review Agent - installer ==

Installed:
  .github/workflows/pr-review.yml
  scripts/*.js

Which LLM will the agent use to review PRs?
  1) Anthropic (Claude)
  2) OpenAI (GPT)

Choose 1 or 2:

Choose the provider for which you have an API key.

---

3️⃣ Configure the API key 🔑

The API key should be stored as a GitHub Actions repository secret.

Go to:

GitHub Repository
   ↓
Settings
   ↓
Secrets and variables
   ↓
Actions
   ↓
New repository secret

For Anthropic:

ANTHROPIC_API_KEY

For OpenAI:

OPENAI_API_KEY

🔒 Never commit an API key into source code, .env files, workflow YAML, README files, or PR comments.

The intended secret flow is:

🔐 GitHub Secret
      │
      ▼
⚙️ GitHub Actions
      │
      ▼
🧩 Provider Adapter
      │
      ▼
🧠 Claude / GPT

---

4️⃣ Commit and push

git add .
git commit -m "Add AI PR review agent"
git push

---

5️⃣ Open a pull request 🎉

Create a normal PR on GitHub.

That's it.

The workflow takes over automatically.

---

👀 What Happens After I Open a PR?

Here is the complete runtime workflow:

flowchart TD
    A["👨‍💻 Developer opens / updates PR"] --> B["🐙 GitHub PR event"]
    B --> C["⚙️ GitHub Actions"]
    C --> D["📥 Fetch PR diff"]
    D --> E["✂️ Chunk diff by file"]
    E --> F["🧩 Build review context"]
    F --> G["🧠 Claude / GPT"]
    G --> H["📦 Structured findings"]
    H --> I["🎚️ Apply severity threshold"]
    I --> J{"📍 Exact line available?"}
    J -->|Yes| K["💬 Inline PR comment"]
    J -->|No| L["📝 Summary / fallback comment"]
    K --> M["👨‍💻 Human validates finding"]
    L --> M
    M --> N["✍️ Human fixes code"]
    N --> O["📤 Push new commit"]
    O --> B

Loading

---

🧠 How the Review Works

The reviewer does more than blindly send the entire pull request to an LLM.

Step 1 — Fetch

The agent retrieves the pull-request change set through GitHub's API.

PR
 ├── changed file A
 ├── changed file B
 ├── changed file C
 └── ...

---

Step 2 — Chunk

Large PRs are split into focused review units.

                 ┌── File A review
                 │
PR diff ─────────┼── File B review
                 │
                 ├── File C review
                 │
                 └── File N review

This keeps individual review prompts more manageable and focused.

---

Step 3 — Build context

For the current file, the agent builds a focused review context.

Conceptually:

┌───────────────────────────────────┐
│ Current file diff                 │
│                                   │
│ + changed code                    │
│ - removed code                    │
│                                   │
│ Other changed symbols             │
│ • functionA()                     │
│ • validateToken()                 │
│ • UserRepository.findById()       │
│                                   │
│ Review instructions               │
└───────────────────────────────────┘

Why cross-file context?

Suppose:

auth.js
  └── rename validateToken() → verifyToken()

server.js
  └── still calls validateToken()

A purely isolated file review can miss that relationship.

The agent instead supplies a compact list of symbols touched elsewhere in the same PR, allowing the model to reason about relevant cross-file relationships without blindly sending every other diff in full.

---

🧩 Architecture

High-Level System

flowchart LR
    A["🐙 GitHub PR"] --> B["⚙️ GitHub Actions"]
    B --> C["📥 fetch-diff.js"]
    C --> D["✂️ chunk-diff.js"]
    D --> E["🧠 review-chunk.js"]
    E --> F{"LLM Provider"}
    F --> G["Anthropic / Claude"]
    F --> H["OpenAI / GPT"]
    G --> I["📦 Structured results"]
    H --> I
    I --> J["🧮 aggregate.js"]
    J --> K["🎚️ Severity filter"]
    K --> L["💬 post-comment.js"]
    L --> M["🐙 GitHub PR feedback"]

Loading

---

🏗️ Repository Structure

PR-Review-Agent/
│
├── .github/
│   └── workflows/
│       └── pr-review.yml         ⚙️ GitHub Actions entry point
│
├── scripts/
│   ├── fetch-diff.js             📥 PR diff acquisition
│   ├── chunk-diff.js             ✂️ Diff decomposition
│   ├── review-chunk.js           🧠 Review execution
│   ├── aggregate.js              🧮 Result aggregation
│   ├── aggregate-lib.js          🧩 Aggregation utilities
│   ├── post-comment.js           💬 GitHub feedback publishing
│   ├── run-review.js             🎛️ Pipeline orchestration
│   │
│   └── providers/
│       ├── anthropic.js          🧠 Anthropic adapter
│       ├── openai.js             🧠 OpenAI adapter
│       └── prompt.js             📝 Prompt construction
│
├── test/
│   └── fixtures/
│       ├── sample.diff           🧪 Diff fixture
│       └── chunk-results/
│           ├── index.json        🧪 Result fixture
│           └── validate.json     🧪 Validation fixture
│
└── .genesis/                     📚 Project process / development docs

---

⚙️ Optional Configuration

Create this file in your repository root:

.pr-review.yml

Example:

max_files: 15
severity_threshold: warning

max_files

Controls the configured maximum number of files considered by the reviewer.

severity_threshold

Controls the minimum severity surfaced to the developer.

If the file is omitted, documented defaults apply.

---

---

⚠️ Current Limitations

Be precise about what the system can and cannot guarantee.

It is not a human-review replacement

AI can produce:

• false positives
• false negatives
• incorrect reasoning
• incomplete understanding of business requirements

Always validate important findings.

It is not full-repository semantic analysis

Cross-file awareness is intentionally compact.

It does not auto-fix

The current implementation does not:

• edit source files
• create fix commits
• push fixes
• auto-merge

It depends on external LLM providers

The selected provider requires the corresponding API access.

Exact line placement is not guaranteed

Model-generated locations may not always correspond perfectly to a GitHub commentable diff position.

The fallback comment path exists for this reason.

---

🗺️ Future Roadmap

The current architecture naturally supports several extensions.

📝 Suggested changes

Move from:

💬 Finding

toward:

💬 Finding
   +
🧩 Suggested patch
   +
👨‍💻 Human approval

A human should remain the acceptance gate.

---

🧠 Better repository context

Future context could combine:

PR diff
+
relevant symbols
+
dependency relationships
+
repository conventions
+
tests

without blindly sending the entire repository to the model.

---

🧪 Test-aware review

A future reviewer could compare:

Changed implementation
        +
Changed tests
        +
Existing tests

and identify changes that appear to lack corresponding test coverage.

---

♻️ Finding deduplication

Future versions could fingerprint findings using information such as:

file
+
line
+
finding type
+
commit

to avoid noisy repetition.

---

---

🔗 Project Links

GitHub

https://github.com/Sahoo999/PR-Review-Agent

npm installer

npx @debangsu__/create-pr-review-agent

---

🤖 Review faster. 💬 Comment where it matters. 👨‍💻 Keep humans in control.

Built around a simple idea: AI should shorten the feedback loop, not replace engineering judgment.