GitHub code review with an automated AI first pass - line-level findings on the diff, optional PR comments, and the same engine in CI via Action. Humans keep merge ownership; CodeCritic clears obvious risk before review starts.
Free tier · Pre-merge checklist · Integrations · Rollout guide
Integration
OAuth connects your GitHub account to CodeCritic. From there you choose which repositories participate, how reviews are triggered (PR events, manual runs, or Action workflows), and how results surface - in the product, on the PR, or both. Exact capabilities depend on your plan - see Pricing and the User guide for step-by-step setup.
Connect a repository and run AI reviews where your team already discusses code. Feedback is tied to the diff so context stays next to the change.
Summaries and findings can be published back to the pull request so human reviewers see AI output alongside their own notes - less back-and-forth in chat.
Automate runs in CI with the official Action: trigger on push or pull_request, reuse the same review engine as the web app and REST API.
Incoming webhooks tie pushes and PR events to review jobs so automation matches how your repo already moves - configure what your plan supports.
The same analysis pipeline powers HTTP APIs for custom pipelines - useful when you wrap CodeCritic into internal tools or release automation.
As you add repos and members, company billing and workspace controls scale with you - see the teams page for how orgs map to subscriptions.
Typical flow
Sign up for CodeCritic and open Settings. Your workspace is where reviews, API keys, and GitHub links live.
Authorize via OAuth and pick repositories you want to analyze. You stay in control of scope and can revisit access anytime.
Run from the dashboard, from a webhook when a PR opens or updates, or from the GitHub Action in a workflow file.
Read structured findings in CodeCritic and, where configured, on the PR thread - so reviewers agree on what changed before merge.
Why teams use it
AI code review on GitHub is not a replacement for your team - it is a fast first pass that catches risky patterns, missing edge cases, and style drift before humans spend time on line-by-line debate. CodeCritic groups issues by theme and severity so triage stays readable even when the diff is large.
Because the same engine backs the browser, API, and GitHub paths, you do not maintain two different quality bars. Developers can paste a snippet in the web UI for a quick check, while release branches stay on the PR workflow your managers already trust.
For compliance-minded orgs, access is explicit: connect only the repos you need, use company billing when you are ready, and pair the product with 2FA and API key rotation in Settings. Data handling is described in Privacy.
When you outgrow a single maintainer, move to shared plans and the teams story - same GitHub integration, clearer ownership of who pays and who can run reviews.
On GitHub, code review happens on pull requests: authors propose a diff, reviewers leave comments, and someone approves or requests changes before merge. CodeCritic adds an AI first pass on that same diff - structured findings grouped by severity so humans spend time on judgment, not repetitive scanning.
pull_request events, or the GitHub Action in your workflow file.Need a browser-only path first? Try online code review on snippets before you wire GitHub org-wide.
CI and linters answer whether encoded checks pass - tests, formatters, policy rules. GitHub code review answers whether the change is acceptable to merge given intent, architecture, and risk. CodeCritic sits between them: after deterministic gates, before human sign-off. It complements your existing integrations, not replaces them.
Use the official Action when every pull request or push should get the same automated review in CI - especially when you want PR comments without someone clicking run in the dashboard. Start with dashboard or webhook runs for pilots; graduate to Actions once comment quality and false-positive triage look right for your team. For a staged org rollout and pre-merge gate habits, see the AI review rollout guide. Setup steps live in the user guide.
Workflow examples
Copy-adapt these patterns for your repo. Exact Action inputs and permissions are documented in Help.
Run CodeCritic on every PR update. Adjust secrets and repo permissions per your org policy.
name: CodeCritic review
on:
pull_request:
types: [opened, synchronize, reopened]
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run CodeCritic
uses: codecritic/review-action@v1
with:
api_key: ${{ secrets.CODECRITIC_API_KEY }}
post_comments: trueIncoming webhooks map repository events to review jobs in your CodeCritic workspace.
GitHub: pull_request.opened / synchronize
-> CodeCritic webhook endpoint
-> fetch PR diff at head SHA
-> queue AI review job
-> optional: post summary + inline comments on PRReviews target the diff hunk, not the whole monorepo - include related files when context matters.
diff --git a/src/auth/token.ts b/src/auth/token.ts
--- a/src/auth/token.ts
+++ b/src/auth/token.ts
@@ -12,7 +12,7 @@ export function verify(raw: string) {
- const payload = JSON.parse(raw);
+ const payload = JSON.parse(raw ?? '');
if (!payload.exp) throw new AuthError('missing exp');
return payload;
}Sample PR findings
Illustrative issues CodeCritic might flag on webhook or PR diff reviews before a human approves merge.
JSON.parse on webhook body can throw TypeError when the payload is empty or not a string. Only catching JSON.parse syntax errors leaves a 500 on malformed delivery.
Before
const payload = JSON.parse(raw_body);Suggested direction
let payload: Payload;
try {
payload = JSON.parse(String(raw_body ?? ''));
} catch (e) {
return res.status(400).json({ error: 'invalid_json' });
}Debug logging prints the full Authorization header. If this ships, tokens can leak into CI logs visible on the pull request checks tab.
Before
console.log('auth', req.headers.authorization);Suggested direction
logger.debug('auth_present', { hasAuth: Boolean(req.headers.authorization) });Review job uses base SHA from webhook payload but fetches files without verifying the PR head still matches. Stale comments can land on outdated lines after a fast push.
Before
const sha = event.pull_request.head.sha;
// ... later, no re-check before comment
await postReviewComments(sha, findings);Suggested direction
const head = await github.pulls.get({ pull_number }).then(r => r.data.head.sha);
if (head !== event.pull_request.head.sha) return; // superseded
await postReviewComments(head, findings);Illustrative patterns from real review categories. Your output depends on diff size, language, and context.
FAQ
Short answers - full procedures are in the user guide.
Sign up, connect GitHub from Settings, and route reviews through the path that fits your team - dashboard, webhook, or Action.
