AI Code Review Workflows: How to Automate Reviews That Actually Improve Code Quality

# .ai-review/standards.md
# AI Code Review Standards

## Critical Issues (Block Merge)
- Security vulnerabilities in authentication/authorization
- SQL injection or XSS vulnerabilities 
- Memory leaks in React components (missing cleanup in useEffect)
- Breaking changes to public APIs without version bump
- Database migrations without rollback scripts
- Hard-coded credentials or API keys
- Race conditions in async operations

## Architecture Violations (Request Changes)
- Direct database access from React components (use service layer)
- Circular dependencies between modules
- Missing error handling for external API calls
- Violations of our established patterns:
  * React: Hooks must start with 'use', functional components only
  * API: All mutations must include audit logging
  * State: Global state only in Zustand stores, never in Context

## Code Quality Concerns (Comment for Improvement)
- Functions longer than 50 lines (suggest decomposition)
- Cognitive complexity score > 15 (McCabe complexity)
- Missing JSDoc for public functions
- React components with > 10 props (suggest composition)
- Missing unit tests for business logic functions
- Inconsistent naming (camelCase for variables, PascalCase for components)

## Style Issues (Auto-fix if possible, otherwise ignore)
- Formatting issues handled by Prettier
- Import organization handled by ESLint
- Basic TypeScript warnings handled by compiler

## Team-Specific Patterns to Enforce
- Error handling: Always use our custom ErrorBoundary pattern
- API calls: Must use React Query with proper error handling
- Form validation: Use our Zod schema validation pattern
- Database queries: Must include connection pooling and timeout
- Component props: Use TypeScript interfaces, not inline types

# .ai-review/architecture.md
# Project Architecture Context

## System Overview
- **Frontend**: React 18 + TypeScript SPA
- **Backend**: Node.js + Express + PostgreSQL
- **State Management**: Zustand for client state, React Query for server state
- **Authentication**: JWT with refresh tokens, role-based permissions
- **Deployment**: Docker containers on AWS ECS with RDS

## Current Technical Debt
- Legacy user authentication module (scheduled for refactor Q2)
- Old React class components in /legacy folder (migration in progress)
- Monolithic API endpoints in /api/v1 (splitting into microservices)
- Direct SQL queries in controllers (moving to repository pattern)

## Performance Requirements
- Page load: <2 seconds on 3G connection
- API response: <200ms for CRUD operations
- Database queries: <100ms average, <500ms max
- Bundle size: <1MB for main chunk
- Memory usage: <100MB heap for Node.js processes

## Security Context
- **Data classification**: PII requires encryption at rest
- **Audit requirements**: All user actions logged with metadata
- **Compliance**: SOC 2 Type II, user data residency requirements
- **Access control**: Principle of least privilege, attribute-based
- **Secrets management**: AWS Secrets Manager, no hardcoded values

# .github/workflows/ai-code-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  classify-changes:
    runs-on: ubuntu-latest
    outputs:
      review-type: ${{ steps.classify.outputs.type }}
      complexity-score: ${{ steps.classify.outputs.complexity }}
    steps:
      - uses: actions/checkout@v3
      - name: Classify PR Changes
        id: classify
        run: |
          # Analyze changed files and determine review type
          python .ai-review/classify-changes.py \
            --pr-number ${{ github.event.number }} \
            --changed-files "${{ steps.changes.outputs.files }}"

  security-review:
    needs: classify-changes
    if: contains(needs.classify-changes.outputs.review-type, 'security')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Security-Focused AI Review
        run: |
          ai-reviewer \
            --model gpt-4-turbo \
            --context .ai-review/security-context.md \
            --focus security,auth,data-handling \
            --severity critical,high

  architecture-review:
    needs: classify-changes
    if: contains(needs.classify-changes.outputs.review-type, 'architecture')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Architecture-Focused AI Review
        run: |
          ai-reviewer \
            --model claude-3-opus \
            --context .ai-review/architecture.md \
            --focus patterns,dependencies,performance \
            --include-related-files

  standard-review:
    needs: classify-changes
    if: needs.classify-changes.outputs.complexity-score < 7
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Standard AI Review
        run: |
          ai-reviewer \
            --model gpt-4 \
            --context .ai-review/standards.md \
            --focus quality,testing,documentation

# .ai-review/prompts/react-component-review.md

You are reviewing a React component change. Follow these specific criteria:

## Component Architecture Review
1. **Props Interface**: 
   - Are props properly typed with TypeScript interfaces?
   - Are there more than 10 props? (Suggest composition if yes)
   - Are optional props clearly marked and have sensible defaults?

2. **Hook Usage**:
   - Are hooks used in the correct order?
   - Is useCallback used for event handlers passed to child components?
   - Is useMemo used for expensive calculations?
   - Are dependencies arrays complete and correct?

3. **Performance Patterns**:
   - Is React.memo used appropriately for expensive components?
   - Are object/array props stable or memoized?
   - Is the component properly handling re-renders?

## Team-Specific Patterns
- **Error Handling**: Does it use our ErrorBoundary pattern?
- **Loading States**: Are loading indicators consistent with our design system?
- **Accessibility**: Are ARIA labels and semantic HTML used correctly?
- **Testing**: Are user interactions testable (proper test IDs, semantic selectors)?

## Business Logic Validation
Based on this component's purpose in our {component_domain} feature:
- Does it handle edge cases specific to our business rules?
- Are user permissions checked appropriately?
- Is audit logging included for user actions?
- Does error handling provide appropriate user feedback?

## Code Quality Checks
- Function length: Flag if >30 lines for components
- Complexity: Use cyclomatic complexity, flag if >10
- Naming: camelCase for functions/variables, PascalCase for components
- Comments: Required for complex business logic, not for obvious code

**Output Format**:
- 🚨 Critical: Security/breaking issues requiring immediate fix
- ⚠️ Important: Architecture violations or significant quality issues
- 💡 Suggestion: Minor improvements and optimizations
- ✅ Positive: Highlight particularly well-implemented patterns

# .ai-review/integration-config.json
{
  "reviewWorkflow": {
    "aiFirst": {
      "enabled": true,
      "blockOnCritical": true,
      "autoRequestChanges": false,
      "commentThreshold": "important"
    },
    "humanReviewRouting": {
      "skipHumanIf": [
        "aiConfidence > 0.9",
        "changeSize < 50 lines",
        "onlyStyleChanges",
        "documentationOnly"
      ],
      "requireSeniorReview": [
        "architectureChanges",
        "securityImpact",
        "performanceRisk",
        "publicAPIChanges"
      ]
    },
    "aiLearningFeedback": {
      "trackOverrides": true,
      "collectReasoningFeedback": true,
      "updateWeights": "monthly",
      "humanCorrection": "immediate"
    }
  },
  
  "notificationStrategy": {
    "developerSlack": {
      "onCritical": true,
      "onPattern": false,
      "summaryReport": "weekly"
    },
    "prComment": {
      "collapsible": true,
      "grouped": true,
      "hideResolved": true
    }
  }
}