Build a Claude code review bot for pull requests

GitHub PR opened/updated
   ↓
GitHub Action triggers
   ↓
Fetch diff via GitHub API
   ↓
Send to Claude Sonnet 4.6 (via codexkey)
   ↓
Parse JSON response
   ↓
Post review comments via GitHub API

You are a senior staff engineer reviewing a pull request. Your job is to
catch bugs, security issues, and design mistakes — NOT to enforce style
(linters do that) and NOT to praise good code.

SCOPE:
- Only comment on lines changed in this diff.
- Do not comment on unchanged context lines.
- Do not request changes you cannot justify with a concrete failure mode.

SEVERITY:
- blocker: will cause production incident, data loss, security breach, or
  obvious correctness bug. Must be fixed before merge.
- warning: real issue but not blocking. Race conditions under unlikely
  load, missing error paths, unclear naming that will bite later.
- nit: minor suggestion. Use sparingly — at most 2 per PR.

OUTPUT:
Call the `post_review` tool with a JSON list of comments. Each comment
must have:
- file: path relative to repo root
- line: line number in the new file (after the change)
- severity: "blocker" | "warning" | "nit"
- comment: 1–3 sentences. Start with the problem, then the fix.
- justification: why this matters. If you can't write this, drop the comment.

If the PR looks good, return an empty list. Do not invent issues.

REPO CONTEXT:
{cached system block: style guide, architecture notes, recent decisions}

DIFF:
{the actual diff}

const postReviewTool = {
  name: "post_review",
  description: "Post review comments on the PR. Pass an empty array if no issues found.",
  input_schema: {
    type: "object",
    properties: {
      comments: {
        type: "array",
        items: {
          type: "object",
          properties: {
            file: { type: "string" },
            line: { type: "integer" },
            severity: {
              type: "string",
              enum: ["blocker", "warning", "nit"]
            },
            comment: { type: "string" },
            justification: { type: "string" }
          },
          required: ["file", "line", "severity", "comment", "justification"]
        }
      }
    },
    required: ["comments"]
  }
};

import Anthropic from "@anthropic-ai/sdk";
import { Octokit } from "@octokit/rest";

const claude = new Anthropic({
  apiKey: process.env.CODEXKEY_API_KEY,
  baseURL: "https://api.codexkey.online/v1",
});

const gh = new Octokit({ auth: process.env.GITHUB_TOKEN });

async function reviewPR(owner: string, repo: string, pull_number: number) {
  // 1. Fetch the diff
  const { data: files } = await gh.pulls.listFiles({
    owner, repo, pull_number, per_page: 100,
  });

  // 2. Chunk by file — parallelize for large PRs
  const reviews = await Promise.all(
    files
      .filter(f => f.patch && f.status !== "removed")
      .map(file => reviewFile(file))
  );

  // 3. Flatten + dedupe by (file, line, severity)
  const all = reviews.flat();
  const seen = new Set<string>();
  const unique = all.filter(c => {
    const k = `${c.file}:${c.line}:${c.severity}`;
    if (seen.has(k)) return false;
    seen.add(k);
    return true;
  });

  // 4. Post as a single review
  await gh.pulls.createReview({
    owner, repo, pull_number,
    event: unique.some(c => c.severity === "blocker")
      ? "REQUEST_CHANGES"
      : "COMMENT",
    comments: unique.map(c => ({
      path: c.file,
      line: c.line,
      body: `**[${c.severity}]** ${c.comment}\n\n_${c.justification}_`,
    })),
  });
}

async function reviewFile(file: any) {
  const response = await claude.messages.create({
    model: "claude-sonnet-5",
    max_tokens: 4096,
    system: [
      {
        type: "text",
        text: REPO_CONTEXT,           // style guide, arch notes
        cache_control: { type: "ephemeral" },
      },
      {
        type: "text",
        text: REVIEW_INSTRUCTIONS,    // the prompt above
      },
    ],
    tools: [postReviewTool],
    tool_choice: { type: "tool", name: "post_review" },
    messages: [
      {
        role: "user",
        content: `File: ${file.filename}\n\nDiff:\n\`\`\`diff\n${file.patch}\n\`\`\``,
      },
    ],
  });

  const toolUse = response.content.find(b => b.type === "tool_use");
  return toolUse ? (toolUse.input as any).comments : [];
}

name: Claude Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - run: npm ci
      - run: npx tsx scripts/review.ts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CODEXKEY_API_KEY: ${{ secrets.CODEXKEY_API_KEY }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}