I Replaced Our $600/Month Code Review Tool with 30 Lines of YAML (Here's How)

name: AI Code Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get changed code
        id: diff
        run: |
          DIFF=$(git diff origin/${{ github.base_ref }}...HEAD -- \
            '*.py' '*.js' '*.ts' '*.go' '*.java' '*.rs' \
            ':!*.min.js' ':!*lock*' ':!*.generated.*')
          # Truncate to avoid token limits
          echo "diff<<EOF" >> $GITHUB_OUTPUT
          echo "$DIFF" | head -c 12000 >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: AI Review
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          REVIEW=$(curl -s https://api.openai.com/v1/chat/completions \
            -H "Authorization: Bearer $OPENAI_API_KEY" \
            -H "Content-Type: application/json" \
            -d "{
              \"model\": \"gpt-4o-mini\",
              \"messages\": [{
                \"role\": \"system\",
                \"content\": \"You are a senior code reviewer. Review for: 1) Bugs and logic errors 2) Security vulnerabilities (OWASP Top 10) 3) Performance issues 4) Code style violations. Be specific with line numbers. Use GitHub markdown.\"
              },{
                \"role\": \"user\",
                \"content\": $(echo '${{ steps.diff.outputs.diff }}' | jq -Rs .)
              }],
              \"max_tokens\": 2000
            }" | jq -r '.choices[0].message.content')

          gh pr comment ${{ github.event.pull_request.number }} \
            --body "## 🤖 AI Code Review

          $REVIEW

          ---
          *Powered by gpt-4o-mini · [How this works](https://1611833802030.gumroad.com/l/ai-code-review-cheat-sheet)*"

Focus exclusively on security:
- SQL injection (parameterized queries?)
- XSS (output encoding?)
- Authentication bypass
- Hardcoded credentials
- Insecure deserialization
- SSRF potential
Flag severity as 🔴 Critical / 🟡 Warning / 🟢 Info

      - name: Get changed code
        run: |
          DIFF=$(git diff origin/${{ github.base_ref }}...HEAD -- \
            '*.py' '*.js' '*.ts' \
            ':!*.generated.*' ':!*.min.*' ':!*lock*' \
            ':!*migration*' ':!*__snapshots__*' \
            ':!vendor/*' ':!node_modules/*')

curl -s https://api.anthropic.com/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d "{
    \"model\": \"claude-sonnet-4-20250514\",
    \"max_tokens\": 2000,
    \"messages\": [{
      \"role\": \"user\",
      \"content\": \"Review this code diff for architectural concerns, not just bugs:\n\n$DIFF\"
    }]
  }"

if: github.actor != 'dependabot[bot]'