AI Code Review Tutor

Extract your team's implicit standards from the evidence — your closed PRs. Here's the process:

Step 1 — Mine past review comments

# GitHub CLI: get all review comments from last 90 days
gh api '/repos/{owner}/{repo}/pulls/comments' \
  --paginate --jq '.[] | select(.created_at > "2025-12-01") | .body' \
  > review_comments.txt

Step 2 — Cluster into categories Group ~100 comments by theme. Common clusters:

• Security (SQL injection, auth bypass, secrets in logs)
• Error handling (unhandled rejections, missing error boundaries)
• Performance (N+1 queries, missing indexes, unbounded loops)
• Testing (missing edge cases, brittle mocks, no integration coverage)
• Architecture (business logic in routes, missing abstraction layers)

Step 3 — Write review rules from the clusters

## Our Review Checklist

### Security (always block on these)
- [ ] No user input used in SQL without parameterization
- [ ] JWT not logged anywhere (check logger calls and error messages)
- [ ] No secrets committed (scan with `trufflehog`)

### Error Handling (block if missing)
- [ ] All async functions have explicit error handling or are in a try/catch boundary
- [ ] DB errors don't leak schema info to API responses

### Performance (advisory, not blocking)
- [ ] No queries inside loops — check for N+1 patterns
- [ ] New endpoints have response time budget documented

Step 4 — Calibrate blocking vs. advisory Pass this checklist to AI with: 'Block only on Security and Error Handling items. Flag Performance items as advisory with suggested fixes.' Run on 3 past PRs to calibrate.