How to Do Code Review with AI
AI can read a diff and spot missing tests, rough edges and obvious bugs. It cannot replace a human who knows the product. Use it as a first pass, then review yourself.
In short: feed the diff (not secrets), ask for risks + missing tests + style issues, treat findings as questions, and never auto-merge because the bot said LGTM.
Why use AI in review
Humans get tired on large PRs. AI is steady at scanning for null checks, SQL string building, and missing assertions. Humans still judge product intent, security context and “should we build this at all?”.
What to give the reviewer AI
- The diff: git diff main...HEAD or the PR patch — not the whole history.
- Intent: one sentence: “adds GST helper used by checkout”.
- Constraints: language version, “no new deps”, security rules.
- Ask list: bugs, missing tests, secrets, performance only if relevant.
How AI-assisted review flows
Review this diff for: (1) correctness bugs, (2) missing tests, (3) security (secrets, injection), (4) accidental scope creep. Repo rules: Python 3.12, pytest required for new logic. Reply as a checklist. Do not rewrite the whole PR.
How to review step by step
- Run the tests and linters locally or in CI before asking the AI.
- Paste or attach only the diff (or use Copilot / Cursor PR helpers that already see the change).
- Ask for a checklist, not a full rewrite.
- Verify each finding against the code. Discard false positives politely.
- Leave human comments on the PR — you are responsible for what you approve.
| AI is good at | You must still check |
|---|---|
| Missing edge-case tests | Does this match the product need? |
| Obvious null / error handling gaps | Auth, privacy, and company policy |
| Accidental debug prints / TODOs | Architecture and long-term ownership |
| Inconsistent naming in the diff | Whether the feature should ship |
Tools (real products)
- GitHub Copilot on GitHub.com can help with PR summaries and coding questions (features depend on your plan — check GitHub’s current docs).
- Claude / ChatGPT / Cursor: paste a redacted
git diffand the review prompt above. - IDE agent: “review the uncommitted diff; list risks only.”
- Settings: store the review checklist in CONTRIBUTING.md or project rules so every PR gets the same bar.
Quick quiz
1. Can AI alone approve a PR?
No. A human who understands the product must own the approve.
2. What should you paste?
The diff and intent — never secrets or full production data.
3. What is a useful AI output format?
A short checklist of risks, missing tests and scope creep.
4. What do you do with each finding?
Verify it in the code; discard false positives.
Save tokens and money
Review the diff, not five historical commits. One structured pass beats three vague “any bugs?” chats.