Recap — Using AI as a Reviewer Pre-PR

# Using AI as a Reviewer Pre-PR Before opening a PR, have AI review your changes. Catches a class of issues that would otherwise burn human reviewer time. ## Why AI pre-review Human reviewers are expensive (time + attention). Save them for things only humans catch (design, business logic, team norms). AI catches before human review: - Obvious bugs (off-by-one, typos in identifiers). - Style inconsistencies. - Missing error handling. - Security smells (string concatenation in SQL, etc.). - Test coverage gaps. - Documentation that's out of sync. Then humans focus on what's important. ## The basic prompt ``` git diff main..HEAD | (or: AI reads the diff) ``` Then: > "Review this diff. Focus on: > 1. Correctness (logic bugs, edge cases missed). > 2. Security (input validation, auth, secrets). > 3. Code quality (clarity, naming, complexity). > 4. Style (matches our conventions). > 5. Tests (cover the change adequately). > > Tag issues as [must-fix] (must change), [suggest] (consider), [nit] (minor)." AI produces structured review. ## In Claude Code / Cursor These tools have the diff in context. Direct: > "Review the changes on this branch. Same categories as before." AI reads diff via git, comments. ## Iterating with AI review Read AI's feedback: - Some valid → fix. - Some wrong → ignore (AI hallucinations). - Some debatable → think about it. Don't blindly apply. Use as a first pass; you decide. ## Categories worth specific prompts ### Security review > "Security review only. Look for: SQL injection (string concat in queries), XSS (unsanitized output to HTML), CSRF (state-changing GETs), auth bypass (missing checks), secrets in code or logs, weak crypto, insecure file handling." Specific security checklist; AI applies systematically. ### Performance review > "Performance review. Look for: N+1 queries, missing indexes, unbounded loops, expensive operations in hot paths, allocating in inner loops, sync I/O in async functions." Performance specific. ### Test review > "Are the tests adequate for this change? Check: happy path covered; edge cases (empty, None, max); error cases; assertions are meaningful (not just exercising lines)." Test-coverage specific. ## When AI catches things you'd miss Especially valuable areas: - **Old patterns**: AI knows the modern way; suggests Pydantic v2 over v1, etc. - **Boundary conditions**: AI thinks through edge cases systematically. - **Cross-file consistency**: notices when new code drifts from existing style. - **Common security pitfalls**: SQL injection, etc. — AI's pattern-matching helps. ## When AI misses things humans catch - **Business logic correctness**: AI doesn't know your business; can't verify a specific calculation is right. - **Team conventions**: unwritten rules in your team. - **Long-context architectural fit**: how this PR relates to the broader codebase. - **Naming aesthetics**: AI accepts mediocre names. - **Subtle UX issues** in API design. Human reviewers remain essential. AI complements, doesn't replace. ## Adversarial review Prompt: > "Be a harsh reviewer. Try to find any issue you can. Suggest improvements aggressively." AI provides more critical feedback. Sometimes too pedantic, but catches more. ## Confidence calibration Ask AI for its confidence: > "Rate each comment 1-5 for confidence. 5 = definitely an issue; 1 = stylistic preference." Helps prioritize your response. ## Limitations AI reviews: - Are sometimes wrong (flag fake issues). - Sometimes miss real issues. - Are biased toward generic concerns. - Can be over-pedantic. Don't treat AI review as authoritative. It's a first pass; human review is the second. ## CI integration Some tools auto-review PRs: - GitHub Copilot for PRs (AI summary, comments). - Cursor's PR review. - Aider workflows. Caution: bot comments add noise if not well-tuned. Configure carefully. ## Self-review before AI review Before asking AI: - Read your own diff carefully. - Catch the obvious things yourself. - Then ask AI for additional perspective. Otherwise: you might miss your own bugs because AI flagged easier ones; you fix those; ship. ## Patterns by stage ### Pre-commit > "Quick review. Anything obviously wrong before I commit?" Fast check; minor issues. ### Pre-PR > "Full review. Treat this like a senior engineer's review." Thorough; categories. ### Pre-merge (after human review) > "Anything addressed in review comments that you'd flag again? Anything we missed?" Last-pass sanity check. ## Common AI-review mistakes 1. **Accepting all AI feedback blindly**: some is wrong. 2. **Skipping AI review because "obvious code"**: AI still catches things. 3. **Asking too vague**: "review this" → generic; specific categories help. 4. **Not iterating**: first AI pass is rarely the last useful one. 5. **Treating AI review as final**: human review remains essential. ## Workflow with AI review built in ``` 1. Make changes. 2. Self-review your diff. 3. AI pre-review (general + securi