ai-pr-review-prompts

Español | English

Automated AI-powered pull request reviews. Add a GitHub Action to your repo and get structured code review feedback on every PR — no setup beyond a workflow file and an API key.

Works with Anthropic (Claude), OpenAI (GPT), and Google (Gemini).

How It Works

PR opened → GitHub Action triggers → AI reviews the diff → Review posted as PR comment

Quick Start

Add this workflow to your repo at .github/workflows/pr-review.yml:

name: AI PR Review

on:
  pull_request:
    types: [opened, synchronize]

permissions:
  contents: read
  pull-requests: write

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: keba2503/ai-pr-review-prompts@v2
        with:
          provider: "anthropic"
          api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          review-type: "full"

Then add your API key as a repository secret (Settings → Secrets → Actions).

That's it. Every PR gets an AI review automatically.

Configuration

Input	Required	Default	Description
provider	Yes	—	AI provider: anthropic, openai, or google
api-key	Yes	—	API key for the selected provider
review-type	No	full	Which review prompt to use (see table below)
model	No	Provider default	Override the model (e.g., gpt-4o, claude-sonnet-4-20250514)
max-diff-size	No	60000	Max diff characters before truncation
post-as	No	comment	comment (PR comment) or review (GitHub review)

Provider Defaults

Provider	Default Model
anthropic	claude-sonnet-4-20250514
openai	gpt-4o
google	gemini-2.0-flash

Review Types

Combos

Type	What It Reviews
full	Type safety + security + performance + architecture + testing
frontend	TypeScript + React performance + accessibility
backend	Security + database performance + API design

Code Quality

Type	Focus	Best For
typescript	Type safety, any detection, unsound casts	TypeScript, React, Next.js
python	Type hints, idioms, mutable defaults	Python 3.10+
go	Error handling, goroutine leaks, context propagation	Go
rust	Unsafe blocks, ownership, unwrap in non-test code	Rust
general	Dead code, duplication, naming, magic numbers	Any language

Security

Type	Focus	Best For
security	Secrets, injection, CVEs, hardcoded credentials	Any stack
security-auth	Auth bypasses, broken access control, JWT/session issues	Backend
security-api	Input validation, CORS, rate limiting, data exposure	REST, GraphQL

Performance

Type	Focus	Best For
performance	N+1 queries, sync bottlenecks, resource leaks	Any stack
performance-react	Re-renders, memoization, bundle size, lazy loading	React, Next.js
performance-database	Query optimization, indexes, unbounded selects	SQL, ORMs
performance-api	Latency, caching, pagination, over-fetching	REST, GraphQL, gRPC

Architecture

Type	Focus	Best For
architecture	SOLID violations	OOP codebases
architecture-patterns	Anti-patterns, missing patterns, leaky abstractions	Any codebase
architecture-complexity	Cyclomatic complexity, coupling, cognitive load	Any codebase

Testing

Type	Focus	Best For
testing	Missing tests, untested paths, edge cases	Any test suite
testing-quality	Flaky tests, weak assertions, implementation coupling	Any test suite

Other

Type	Focus	Best For
accessibility	ARIA, semantic HTML, keyboard nav, contrast	Frontend
naming	Ambiguous names, inconsistent conventions	Any codebase
documentation	Missing docs, stale references, undocumented APIs	Libraries, APIs

Examples

Multiple review types on the same PR

jobs:
  review:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        review-type: [security, performance, typescript]
    steps:
      - uses: keba2503/ai-pr-review-prompts@v2
        with:
          provider: "openai"
          api-key: ${{ secrets.OPENAI_API_KEY }}
          review-type: ${{ matrix.review-type }}

Different providers per review

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: keba2503/ai-pr-review-prompts@v2
        with:
          provider: "anthropic"
          api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          review-type: "security"

  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: keba2503/ai-pr-review-prompts@v2
        with:
          provider: "google"
          api-key: ${{ secrets.GOOGLE_AI_API_KEY }}
          review-type: "full"

Manual Use

Don't want the Action? You can still copy-paste the prompts manually into any AI assistant.

Browse the prompts/ directory or the combos/ for multi-concern reviews. See examples/ for sample AI outputs.

Example Output

See what the AI produces:

• TypeScript review — 5 type safety issues in a Next.js PR
• Security review — 4 vulnerabilities in an Express API
• Full review — Multi-concern combo on a feature PR

Project Structure

src/                   GitHub Action source (TypeScript)
dist/                  Compiled action (auto-generated)
prompts/               Individual review prompts (Markdown)
  code-quality/        Language-specific type safety and idioms
  security/            Vulnerability detection and secure coding
  performance/         Latency, throughput, resource optimization
  architecture/        SOLID, patterns, complexity, coupling
  testing/             Test coverage and test quality
  accessibility/       WCAG, semantic HTML, screen readers
  dx/                  Naming, readability, documentation
combos/                Multi-concern review prompts
examples/              Real output samples

Contributing

New prompts and improvements welcome. See CONTRIBUTING.md for the template and guidelines.

License

MIT

---

Created by Karen Borrero · @karenborrerodev