vuphongle/oss-pr-reviewer
A CLI that lets OpenAI scan GitHub pull requests and hands maintainers a Markdown risk report
oss-pr-reviewer pulls a pull request's metadata and changed-file patches from GitHub, sends them to OpenAI for structured analysis, then validates and merges the results into a Markdown report flagging bugs, security risks, regressions, and missing tests. It explicitly describes itself as an assistant, not an approval system, leaving the final call to human maintainers. Built in TypeScript, it also ships as an opt-in GitHub Action.
What it does
- Uses Octokit to fetch PR metadata and diffs, skipping binary, patchless, or oversized files with stated reasons in the report.
- Splits large diffs into fixed-size batches (60,000 characters total, 30,000 per file, 8 files per batch) before sending them to OpenAI, then validates the JSON response with Zod and applies deduplication plus deterministic severity filtering.
- Reads an optional .oss-pr-reviewer.yml from the PR's base branch (not the PR branch itself) to set minimum severity, custom review rules, and ignored paths, preventing a PR from silently altering its own review policy.
- Ships a composite GitHub Action for pull_request events that always posts the report to the job summary, and can optionally create or update a single owned PR comment without duplicating it.
- A high or critical finding does not fail the CLI process by itself; only configuration, API, filesystem, or validation errors return a non-zero exit code.
Why it matters
It automates the repetitive context-gathering part of PR review for maintainers who can't manually check every changed file, while treating repository content as untrusted input, which matters for anyone evaluating whether it's safe to plug an AI reviewer into a real workflow.
Terms in this repo
- Octokit · Official library that wraps the GitHub API for easier programmatic access
- Zod · A TypeScript library for validating that data matches an expected shape
- prompt injection · An attack where malicious instructions are hidden inside data fed to an AI to override its original instructions
- severity filtering · Sorting findings into levels like low, medium, high, critical and dropping ones below a chosen threshold
- base branch · The target branch a pull request will merge into, representing the code state before the change
Repository description (English)
AI-powered CLI for reviewing GitHub pull requests, detecting potential bugs, security risks, regressions, and missing tests, with structured Markdown reports for open-source maintainers.
Open on GitHubTrending repos
- vorssaint/vorssaint-utilsOne free menu bar app replaces a dozen paid Mac utilities
- Alishahryar1/free-claude-codeA local proxy that lets coding AI agents run on 49 free or cheap model providers instead of one paid service
- freestylefly/awesome-gpt-image-2A library of 532 reverse-engineered prompts that turn GPT-Image2 into a predictable image-making tool
- block/buzzAn open-source workspace where humans and AI agents chat, code, and review in the same rooms
- NousResearch/hermes-agentNous Research's Hermes is an AI agent that gets smarter the more you use it
- virgiliojr94/book-to-skillA tool that turns technical book PDFs into on-demand reference skills for AI coding agents
- VoltAgent/awesome-agent-skillsA single hub collecting over 1000 'how-to' manuals that make AI coding assistants act like experts
- anthropics/claude-plugins-communityA shared shelf where anyone's Claude add-ons get listed for install