09. Code Review Automation

Required Checks

• All public functions have type hints
• No print statements in production code
• Error handling uses specific exception types
• Database queries use parameterized queries
• Sensitive config values come from environment variables

Naming Conventions

• Functions: snake_case
• Classes: PascalCase
• Constants: UPPER_SNAKE_CASE
• Tables: plural snake_case

Security Requirements

• Input validation on all API endpoints
• Authentication required for mutation operations
• Rate limiting on public endpoints

Reference these rules in your review prompt:

```json
{
  "commands": [
    {
      "name": "Review Against Rules",
      "prompt": "Review the following changes against our project rules:\n\nRules from .review-rules.md:\n{{{{ file:.review-rules.md }}}}\n\nChanges to review:\n{{{ clipboard }}}\n\nReport any violations with file, line, and suggested fix."
    }
  ]
}

The {{{{ file:path }}} syntax embeds file contents into the prompt.

Automated review scaling strategies:

1. Split large diffs: Review files in batches to avoid context overflow
2. Prioritize by risk: Review security-sensitive modules first
3. Track recurring issues: Build a database of patterns to catch in future reviews
4. CI integration: Run review on every PR automatically

CI integration example using a shell script:

#!/bin/bash
# .github/scripts/ai-review.sh

git diff --cached > /tmp/changes.diff
CONTENT=$(cat /tmp/changes.diff)

curl -X POST http://localhost:1234/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "deepseek-coder:33b",
    "messages": [
      {"role": "system", "content": "You review code for security issues."},
      {"role": "user", "content": "Review these changes:\n'"$CONTENT"'"}
    ]
  }' > /tmp/review.md

cat /tmp/review.md | jq -r '.choices[0].message.content' > "$GITHUB_STEP_SUMMARY"

This script runs as a GitHub Actions step, posting review results to the PR summary.