Case study
How to use AI to transform code review with 100% automated pipelines on GitHub Actions
schedule3 min
calendar_today28 November 2025
syncCaricamento...
Code review is one of the most critical moments in the development cycle: it should focus on architecture, design, performance and security.
In reality, a huge share of senior developers’ time is wasted instead on fixing:
- inconsistent naming
- wrong spacing
- broken conventions
- non-compliant formatting
These are purely mechanical tasks, perfectly definable and therefore completely automatable.
That is why we implemented an AI-Driven Code Compliance pipeline based exclusively on GitHub Actions, able to validate every Pull Request automatically before a human reviewer even opens it.
The result: cleaner PRs, faster turnaround and seniors busy only with the decisions that really matter.
Why move code validation to GitHub Actions
GitHub Actions lets you:
- react immediately every time a PR is opened or updated
- run custom scripts
- call external APIs (e.g. LLMs such as Gemini, Claude, OpenAI)
- add automatic comments to PRs
- block merges until the code meets the standards
All of this with no additional infrastructure, no new services, no external orchestrators.
If the repository lives on GitHub, it is the most natural and robust place for automated validation to live.
Our pipeline: AI + GitHub Actions + internal technical specification
We built a system made up of three main elements:
- GitHub Actions trigger on
pull_request - Call to an LLM to analyse the diff
- Validation against an internal technical document
- Automatic comment or blocking of the PR
Let’s look at the structure in detail.
1) Automatic trigger via GitHub Actions
In the file .github/workflows/validation.yml:
name: AI Code Compliance
on:
pull_request:
types: [opened, synchronize, reopened]
jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
Every PR triggers the workflow automatically.
2) Extracting the PR diff
A simple shell action:
- name: Get PR diff
run: |
git fetch origin ${{ github.base_ref }}
git diff origin/${{ github.base_ref }}... > diff.patch
This reduces the payload sent to the AI and minimises the token cost.
3) Comparison with the Technical Compliance Specification (TCS.md)
We defined a versioned file, TCS.md, that holds the company’s internal rules:
- naming policy
- formatting
- allowed / forbidden patterns
- constraints for classes, functions, components
- minimum security rules
- standards for DTOs, controllers, services, tests
The AI model receives:
- the diff (
diff.patch) - the
TCS.md - strict instructions to produce a structured JSON
Example call:
- name: Run AI Validation
run: |
node scripts/validate.js
where validate.js:
- reads the diff + TCS
- sends everything to the LLM
- receives a deterministic JSON in response
4) Structured output and automatic comment on the PR
Required response format:
{
"violations": [
{
"line": 58,
"rule": "naming:camelCase",
"message": "Identificatore non conforme",
"suggested_fix": "rename user_name to userName",
"severity": "medium"
}
]
}
If violations are found:
- the Action comments on the PR
- or sets the status to failed, blocking the merge
Example:
- name: Comment on PR
uses: marocchino/sticky-pull-request-comment@v2
if: ${{ steps.validate.outputs.has_violations == 'true' }}
with:
message: ${{ steps.validate.outputs.report }}
The PR reaches the reviewers only when it is compliant.
Advantages of the GitHub Actions approach
No new systems
The whole pipeline lives where the code already lives: GitHub.
Zero learning curve for the team
No new tools to learn, no external dashboard.
Full reproducibility
Every run is tracked and verifiable in Actions.
Scalability at no cost
More PRs → more runs → GitHub handles everything automatically.
Minimal costs
You pay only for the LLM, and only on the diff.
Results achieved
After introducing the pipeline:
- –70% of the time wasted on low-level review
- more uniform code
- PRs that are quicker to read
- seniors focused only on the architectural side
- fewer bugs introduced by careless syntax slips
The team is faster and more aligned, without changing the way it works.
Conclusion
Automating code validation with GitHub Actions and an AI model means turning the review process from a slow, manual activity into a reliable, reproducible and fully automatic flow.
It is a way to:
- guarantee solid internal standards,
- speed up development cycles,
- reduce the load on senior developers,
- and raise software quality.
If you want to introduce this system in your repositories, Shellonback can implement it turnkey, or guide your team in building a custom pipeline based on GitHub Actions and AI, integrated with your internal standards.
We bring automation and quality to the heart of your development process.
Write to us to transform your code review.