A Claude API Code Review Pipeline: Hook to CI

# staged changes only, generated files excluded
git diff --cached --unified=3 --no-color -- . \
  ':(exclude)*.lock' ':(exclude)package-lock.json' \
  ':(exclude)dist/*' ':(exclude)*.min.js'

{
  "name": "report_findings",
  "description": "Submit code review findings",
  "input_schema": {
    "type": "object",
    "properties": {
      "findings": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "file":       {"type": "string"},
            "line":       {"type": "integer"},
            "severity":   {"type": "string", "enum": ["high", "medium", "low"]},
            "issue":      {"type": "string"},
            "suggestion": {"type": "string"}
          },
          "required": ["file", "line", "severity", "issue", "suggestion"]
        }
      }
    },
    "required": ["findings"]
  }
}

#!/usr/bin/env python3
"""ai-review: review a git diff with the Claude Messages API."""
import argparse, os, subprocess, sys, time
import requests

BASE  = os.environ.get("ZAIMOD_BASE", "https://api.zaimod.com").rstrip("/")
MODEL = os.environ.get("REVIEW_MODEL", "claude-sonnet-5")
KEY   = os.environ["ZAIMOD_API_KEY"]
MAX_CHARS = 60_000
IGNORE = ("*.lock", "package-lock.json", "dist/*", "*.min.js", "*.svg")

RULES = """You are a senior code reviewer. Rules:
1. Comment only on lines added or modified in the diff, never on untouched legacy code.
2. Do not report style preferences (indentation, naming, missing comments, import order).
3. Report exactly six categories: correctness bugs, edge cases, concurrency and transactions,
   security, resource leaks, missing error handling.
4. Every finding must land on a specific line; if you cannot state the concrete consequence, skip it.
5. severity=high only for issues that cause data corruption, production outage or a security hole.
6. Return an empty array when there is nothing to report. Never pad the list.
Known false positives (do not report): log wording, TODO comments, hardcoded values in test files,
placeholder secrets in example code.
Team conventions: every outbound call needs a timeout; every database write needs an explicit
transaction; errors must be re-raised with context."""

TOOL = {
    "name": "report_findings",
    "description": "Submit code review findings",
    "input_schema": {
        "type": "object",
        "properties": {"findings": {"type": "array", "items": {
            "type": "object",
            "properties": {
                "file": {"type": "string"}, "line": {"type": "integer"},
                "severity": {"type": "string", "enum": ["high", "medium", "low"]},
                "issue": {"type": "string"}, "suggestion": {"type": "string"}},
            "required": ["file", "line", "severity", "issue", "suggestion"]}}},
        "required": ["findings"]},
}

def collect_diff(staged=False, path=None):
    if path:
        with open(path, encoding="utf-8", errors="replace") as fh:
            return fh.read()
    cmd = ["git", "diff", "--unified=3", "--no-color"]
    if staged:
        cmd.append("--cached")
    cmd += ["--", "."] + [f":(exclude){p}" for p in IGNORE]
    return subprocess.run(cmd, capture_output=True, text=True, check=True).stdout

def review(diff_text):
    if not diff_text.strip():
        return []
    body = {
        "model": MODEL, "max_tokens": 2048, "temperature": 0,
        "system": [{"type": "text", "text": RULES,
                    "cache_control": {"type": "ephemeral"}}],
        "tools": [TOOL],
        "tool_choice": {"type": "tool", "name": "report_findings"},
        "messages": [{"role": "user",
                      "content": "Review this diff:\n\n```diff\n"
                                 + diff_text[:MAX_CHARS] + "\n```"}],
    }
    for attempt in range(3):
        r = requests.post(f"{BASE}/v1/messages",
            headers={"x-api-key": KEY, "anthropic-version": "2023-06-01",
                     "content-type": "application/json"},
            json=body, timeout=120)
        if r.status_code in (429, 500, 502, 503, 504):
            time.sleep(2 ** attempt)
            continue
        r.raise_for_status()
        for block in r.json().get("content", []):
            if block.get("type") == "tool_use":
                return block["input"].get("findings", [])
        return []
    raise SystemExit("review failed: retries exhausted")

def to_markdown(findings):
    if not findings:
        return "### AI review\n\nNothing that needs action."
    out = [f"### AI review: {len(findings)} finding(s)", ""]
    for f in findings:
        out.append(f"- **{f['severity']}** `{f['file']}:{f['line']}` — {f['issue']}")
        out.append(f"  - Suggestion: {f['suggestion']}")
    return "\n".join(out)

if __name__ == "__main__":
    ap = argparse.ArgumentParser()
    ap.add_argument("--staged", action="store_true")
    ap.add_argument("--file")
    ap.add_argument("--fail-on", default="high", choices=["high", "medium", "none"])
    ap.add_argument("--markdown-out")
    a = ap.parse_args()

    findings = review(collect_diff(a.staged, a.file))
    for f in findings:
        print(f"{f['severity'].upper():6} {f['file']}:{f['line']}  {f['issue']}")
        print(f"       -> {f['suggestion']}")
    print(f"\n{len(findings)} finding(s)")
    if a.markdown_out:
        with open(a.markdown_out, "w", encoding="utf-8") as fh:
            fh.write(to_markdown(findings))
    if a.fail_on == "high" and any(f["severity"] == "high" for f in findings):
        sys.exit(1)

#!/usr/bin/env bash
# .git/hooks/pre-commit
set -euo pipefail
[ "${SKIP_AI_REVIEW:-0}" = "1" ] && exit 0
command -v python3 >/dev/null || exit 0
python3 scripts/review.py --staged || {
  echo ""
  echo "AI review found high-severity issues; commit blocked."
  echo "Override with: SKIP_AI_REVIEW=1 git commit ..."
  exit 1
}

name: ai-review
on:
  pull_request:
    types: [opened, synchronize, reopened]
concurrency:
  group: ai-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install requests
      - name: Build diff
        run: |
          git diff "origin/${{ github.base_ref }}...HEAD" \
            --unified=3 --no-color -- . > /tmp/pr.diff
          wc -c /tmp/pr.diff
      - name: Review
        env:
          ZAIMOD_API_KEY: ${{ secrets.ZAIMOD_API_KEY }}
        run: python scripts/review.py --file /tmp/pr.diff --markdown-out review.md --fail-on none
      - name: Comment
        if: always()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh pr comment "${{ github.event.pull_request.number }}" --body-file review.md