06. Build an AI Code Reviewer

flowchart TD
    subgraph TRIGGER["Trigger"]
        GH["GitHub Webhook\nPR opened/updated"]
        CLI["CLI\nManual trigger"]
        API["API\nProgrammatic"]
    end
    subgraph ANALYSIS["Analysis Pipeline"]
        DIFF["Diff Parser\nParse changes"]
        AST["AST Analysis\nTree-sitter"]
        STATIC["Static Analysis\nSemgrep + Bandit"]
        LLM["LLM Review\nGPT-4o"]
    end
    subgraph REVIEW["Review Generation"]
        BUGS["Bug Detection"]
        SEC["Security Issues"]
        PERF["Performance Review"]
        STYLE["Style Feedback"]
        ARCH["Architecture Review"]
    end
    subgraph OUTPUT["Output"]
        COMMENTS["PR Comments\nInline"]
        SUMMARY["Summary Report"]
        DASH["Dashboard\nReview history"]
    end

    TRIGGER --> DIFF
    DIFF --> AST
    AST --> STATIC
    STATIC --> LLM
    LLM --> REVIEW
    REVIEW --> OUTPUT

    style TRIGGER fill:#f59e0b,color:#fff
    style ANALYSIS fill:#3b82f6,color:#fff
    style REVIEW fill:#8b5cf6,color:#fff
    style OUTPUT fill:#22c55e,color:#fff

sequenceDiagram
    participant Dev as Developer
    participant GH as GitHub
    participant RV as Reviewer Service
    participant Static as Static Analysis
    participant LLM as LLM
    participant Store as Database

    Dev->>GH: Push code, open PR
    GH->>RV: Webhook: PR opened
    RV->>GH: Fetch PR diff
    RV->>Static: Run static analysis

    Static->>Static: Semgrep rules (100+)
    Static->>Static: Built-in checks (secrets, types)
    Static-->>RV: Findings list

    RV->>LLM: Send diff + static findings
    LLM->>LLM: Analyze code changes
    LLM->>LLM: Find bugs, perf issues, architecture concerns
    LLM-->>RV: Review comments

    RV->>RV: De-duplicate, prioritize comments
    RV->>GH: Post inline comments
    RV->>Store: Save review results

    GH-->>Dev: See review comments

mindmap
  root((Code Review))
    Bug Detection
      Null pointer risks
      Race conditions
      Off-by-one errors
      Unhandled edge cases
    Security
      SQL injection
      XSS vulnerabilities
      Hardcoded secrets
      Unsafe deserialization
    Performance
      N+1 queries
      Unnecessary allocations
      Memory leaks
      Suboptimal algorithms
    Style & Best Practices
      Naming conventions
      Code duplication
      Dead code
      Error handling patterns
    Architecture
      Circular dependencies
      Layer violations
      Missing abstractions
      Test coverage gaps