title: "AI Code Review"

AI Code Review uses advanced language models to automatically review your pull requests, catching bugs, security issues, and code quality problems before they reach production.

Supported Providers

OpenCodeHub supports 10+ AI providers. Configure one or more in your .env file:

:::tip[Recommended]
For best results, use GPT-4o or Claude 3.5 Sonnet. For fast/cheap reviews, use Groq or Ollama with a local model.
:::

What AI Review Catches

Security Vulnerabilities

• SQL injection, XSS, CSRF
• Authentication/authorization bypasses
• Exposed secrets or credentials
• Insecure dependencies

Performance Issues

• N+1 database queries
• Inefficient algorithms
• Memory leaks
• Missing indexes

Code Quality

• Best practice violations
• Code smells (long functions, deep nesting)
• Incomplete error handling
• Missing input validation

Potential Bugs

• Null/undefined pointer exceptions
• Race conditions
• Off-by-one errors
• Type mismatches

How It Works

1. Developer opens/updates PR
    ↓
2. OpenCodeHub sends diff to AI provider
    ↓
3. AI analyzes code changes
    ↓
4. AI posts inline comments + summary
    ↓
5. Developer addresses feedback

Privacy note: Code is sent to the configured AI provider. Use Ollama or the external agent for sensitive codebases.

Setup

Step 1: Configure AI Provider

OpenAI:

OPENAI_API_KEY=sk-proj-xxxxxxxxxxxxx

Anthropic:

ANTHROPIC_API_KEY=sk-ant-xxxxxxxxxxxxx

Google Gemini:

GOOGLE_AI_API_KEY=xxxxxxxxxxxxx

Groq (fast, cheap):

GROQ_API_KEY=gsk_xxxxxxxxxxxxx

Ollama (local, private):

# No env var needed — configure in Settings → AI
# Just install Ollama: https://ollama.com
# Pull a model: ollama pull codellama:13b

Multiple providers: Configure all keys. The system picks the best available provider.

Step 2: Enable for Repository

Via Web UI:

1. Go to Repository → Settings → AI Review
2. Toggle Enable AI Code Review
3. Configure trigger, severity threshold, and max files
4. Click Save

Via API:

curl -X PATCH https://git.yourcompany.com/api/repos/OWNER/REPO/settings \
  -H "Authorization: Bearer $TOKEN" \
  -d '{ "aiReview": { "enabled": true } }'

Via CLI:

och repo config ai-review --enable

Using AI Review

Automatic Reviews

When enabled, AI reviews trigger automatically when PRs are opened or updated.

Manual Reviews

Web UI: Open PR page → Click "Request AI Review"

CLI:

och review ai <pr-number>

API:

curl -X POST https://git.yourcompany.com/api/repos/OWNER/REPO/pulls/125/ai-review \
  -H "Authorization: Bearer $TOKEN"

Understanding Review Output

Severity Levels

Summary Comment

AI posts an overall summary with statistics, critical issues, and recommendations.

Custom Rules

Create .opencodehub/ai-review.yml in your repo:

include:
  - "src/**/*.ts"
exclude:
  - "**/*.test.ts"
  - "dist/**"

focus:
  security: 10
  performance: 8
  bugs: 8
  code_quality: 5

custom_rules:
  - name: "No console.log in production"
    pattern: 'console\.log\('
    severity: warning
    message: "Remove console.log before merging"

Or use Settings → AI Review Rules in the web UI.

Cost Considerations

Cost optimization:

• Keep PRs small and focused
• Skip test files in review config
• Use severity threshold to filter info-level comments
• Use Groq or Ollama for routine reviews, GPT-4/Claude for critical code

Troubleshooting

AI review taking too long: Large PR (many files). Split into smaller PRs.

AI review failed: Check API key is valid. Verify provider is configured in Settings → AI.

Too many false positives: Refine rules in Settings → AI Review Rules. Add custom instructions.

Missing obvious bugs: Add custom instructions describing your conventions and patterns.

See Also

• Stacked PRs
• Merge Queue
• CI/CD Actions
• Configuration Reference