PRBot — AI Code Reviewer for GitHub

PRBot is a free, open-source GitHub Action that automatically reviews pull requests using the OpenAI API. It reads changed files, filters irrelevant content, chunks diffs safely within token limits, asks OpenAI for structured findings, and posts inline review comments plus a summary on your PRs — all without any server or subscription required.

Open Source · No servers required · Works with any OpenAI-compatible model

---

✨ Features

• 🤖 AI-powered inline comments — posts review comments directly on the changed lines
• 📋 PR summary comment — gives an overview of total issues, severity breakdown, and files reviewed
• 🔁 Idempotent reviews — skips re-reviewing if the commit SHA hasn't changed
• 🧹 Smart filtering — excludes lock files, generated files, build artifacts, and custom patterns
• 🔢 Token-aware chunking — safely splits large diffs across multiple OpenAI requests
• 🎯 Configurable focus — target bugs, security, performance, style, docs, or tests
• ⚙️ .prbot.yml config — per-repo configuration file for fine-grained control
• 💬 Slash commands — /prbot review, /prbot ignore, /prbot status, /prbot help
• 🚦 Auto-approve / request changes — optional automated review decisions
• 🌐 Multi-language support — TypeScript, JavaScript, Python, Go, Rust, Java, Ruby, PHP, C#, C++, Swift, Kotlin, Shell, SQL, and more

---

🚀 Quick Start

Add a workflow file to your repository:

# .github/workflows/prbot.yml
name: PRBot
on:
  pull_request:
    types: [opened, synchronize, reopened]
  issue_comment:
    types: [created]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: SameerAdhikari-ML/prbot@v1
        with:
          openai_api_key: ${{ secrets.OPENAI_API_KEY }}

Then add your OpenAI API key as a repository secret named OPENAI_API_KEY.

That's it! PRBot will automatically review every new pull request. 🎉

---

⚙️ Configuration

Action Inputs

Input	Type	Default	Description
openai_api_key	string	required	OpenAI API key stored as a secret.
model	string	gpt-4o-mini	OpenAI model used for review.
focus	string list	bugs,security,performance	Review areas: bugs, security, performance, style, documentation, tests.
exclude_patterns	glob list	**/*.lock,**/*.min.js,**/dist/**,**/*.generated.*,**/node_modules/**,**/*.snap	Micromatch patterns excluded from review.
severity_threshold	enum	warning	Minimum severity to post: info, warning, or error.
max_files	number	30	Skips the review when a PR changes more files than this.
max_tokens_per_chunk	number	3500	Maximum estimated tokens per OpenAI chunk (with 10% safety margin).
post_summary	boolean	true	Creates or updates the PR summary comment.
auto_approve	boolean	false	Approves the PR when no issues are found above threshold.
auto_request_changes	boolean	false	Requests changes when error-severity findings are present.
language_hints	string list	empty	Extra language or framework context (e.g. typescript,react,postgres).
custom_instructions	string	empty	Project-specific review guidance appended to the system prompt.
github_token	string	${{ github.token }}	Token used to post review comments and summary.

Action Outputs

Output	Description
issues_found	Total number of issues found
files_reviewed	Number of files reviewed
review_url	URL of the posted GitHub review

---

📄 .prbot.yml Config File

Place a .prbot.yml file in your repository root to override defaults on a per-repo basis:

model: gpt-4o
focus:
  - bugs
  - security
  - performance
exclude_patterns:
  - '**/*.test.ts'
  - '**/migrations/**'
severity_threshold: warning
max_files: 30
max_tokens_per_chunk: 3500
post_summary: true
auto_approve: false
auto_request_changes: true
language_hints:
  - typescript
  - react
  - postgres
custom_instructions: |
  This codebase uses Prisma for database access.
  Never suggest raw SQL queries.
  We follow the Airbnb TypeScript style guide.

Values in .prbot.yml override action input defaults when explicitly set.

---

💬 Slash Commands

You can control PRBot directly from PR comments:

Command	Description
/prbot review	Triggers a fresh review of the pull request.
/prbot review --focus=security,bugs	Runs a review with a temporary focus override.
/prbot ignore <issue_id>	Marks an existing PRBot issue comment as dismissed.
/prbot status	Posts the latest PRBot summary comment.
/prbot help	Shows command usage.

Note: The issue_comment event must be enabled in your workflow for slash commands to work.

---

🌐 Supported Languages

TypeScript, JavaScript, Python, Go, Rust, Java, Ruby, PHP, C#, C++, C, Swift, Kotlin, Shell, SQL, YAML, JSON, Markdown, HTML, CSS/SCSS, Dockerfile.

---

🚦 Severity Levels

Severity	Emoji	Meaning
error	🔴	Bugs, security vulnerabilities, data loss risks.
warning	🟡	Performance issues, poor practices, missing error handling.
info	🔵	Suggestions, style improvements, and minor improvements.

---

🤝 Contributing

Contributions are welcome! Here's how to get started:

# Clone the repository
git clone https://github.com/SameerAdhikari-ML/prbot.git
cd prbot

# Install dependencies
npm install

# Run type checking
npm run typecheck

# Run linter
npm run lint

# Run tests
npm test

# Build the action
npm run build

See CONTRIBUTING.md for pull request expectations and why dist/ is committed to the repository.

---

🗺️ How It Works

1. Load config — Reads action inputs and merges with .prbot.yml overrides.
2. Fetch diff — Fetches changed files from the GitHub API with pagination.
3. Filter — Removes binary files, pure deletions, generated files, lock files, build artifacts, and custom exclusions.
4. Parse diff — Parses unified diffs and tracks added line numbers for inline comment validation.
5. Chunk — Splits diffs into token-safe chunks using js-tiktoken with a 10% safety margin.
6. Review — Sends each chunk to OpenAI with a structured JSON-only prompt, with automatic retries on rate limits.
7. Validate — Parses AI responses, drops comments on non-added lines, deduplicates, and applies the severity threshold.
8. Post — Posts a GitHub review with inline comments and upserts a signed summary comment with the last reviewed commit SHA.

---

📋 Requirements

• A GitHub repository with Actions enabled
• An OpenAI API key
• Node.js 20+ (handled automatically by the action)

---

📝 License

MIT © Sameer Adhikari. See LICENSE for details.