AI-Assisted Merge-Request Review

1 · The shape of an AI reviewer essential

An automated reviewer is three moves: get the diff, ask the model, post the reply. Everything else is plumbing. The diff is what changed in the MR; the model is a senior engineer you're renting by the token; the posted comment is how the feedback reaches the author where they're already looking. None of these moves is novel on its own — you've made model calls since the API chapter — the newness is only that a push triggers it and the result goes back to GitLab.

Why automate review at all, when a human will review anyway? Because the AI reviewer never gets tired, never skips the boring files, and runs in seconds on every MR — so it catches the obvious stuff (missing error handling, a hardcoded secret, an off-by-one, an undocumented public function) before a human spends attention on it. It doesn't replace human review; it does the first, tireless pass so humans review the reviewed.

The common mistake is pointing the model at the whole repository instead of the diff. Reviewing everything on every MR is slow, expensive, and noisy — the author changed 40 lines, not 40,000. Scope the review to the diff (plus just enough surrounding context), and both cost and signal improve dramatically.

2 · The review prompt & the model call intermediate

The heart of the reviewer is a function that takes the diff and returns review text. The prompt frames the model as a focused reviewer — concrete, prioritized, and honest about severity. Here it is in both SDKs; the review logic is identical, only the vendor call differs.

review.pyimport sys
from anthropic import Anthropic
client = Anthropic()

SYSTEM = (
    "You are a senior code reviewer. Review the diff only. "
    "List concrete issues by severity (blocker/major/minor), each with "
    "file:line and a fix. If it's clean, say so briefly. No praise padding."
)

def review(diff: str) -> str:
    resp = client.messages.create(
        model="claude-opus-4-8", max_tokens=1500,
        system=SYSTEM,
        messages=[{"role":"user","content": diff}],
    )
    return next(b.text for b in resp.content if b.type=="text")

if __name__ == "__main__":
    diff = open(sys.argv[1]).read()
    print(review(diff))

review.pyimport sys
from openai import OpenAI
client = OpenAI()

SYSTEM = (
    "You are a senior code reviewer. Review the diff only. "
    "List concrete issues by severity (blocker/major/minor), each with "
    "file:line and a fix. If it's clean, say so briefly. No praise padding."
)

def review(diff: str) -> str:
    resp = client.responses.create(
        model="gpt-5.5", max_output_tokens=1500,
        reasoning={"effort": "high"},      # review is reasoning-heavy
        instructions=SYSTEM,
        input=diff,
    )
    return resp.output_text

if __name__ == "__main__":
    diff = open(sys.argv[1]).read()
    print(review(diff))

3 · Posting the review back to the MR intermediate

A review nobody sees is useless. GitLab has a REST API for posting a note (comment) to a merge request; the CI job calls it with the review text, authenticating with a token and using the predefined MR variables from gl1 to target the right MR.

post_comment.pyimport os, sys, urllib.request, urllib.parse

def post_note(body: str):
    project = os.environ["CI_PROJECT_ID"]
    mr_iid  = os.environ["CI_MERGE_REQUEST_IID"]
    token   = os.environ["GITLAB_TOKEN"]          # a CI secret (gl5)
    url = f"https://gitlab.com/api/v4/projects/{project}/merge_requests/{mr_iid}/notes"
    data = urllib.parse.urlencode({"body": body}).encode()
    req = urllib.request.Request(url, data=data, method="POST",
        headers={"PRIVATE-TOKEN": token})
    urllib.request.urlopen(req)

if __name__ == "__main__":
    post_note(sys.stdin.read())        # review text piped in

4 · Wiring it into the pipeline advanced

Now assemble it: a merge-request-only job that captures the diff, reviews it, and posts the result. This is the gl1 skeleton with the two scripts dropped in.

.gitlab-ci.ymlai-review:
  stage: test
  image: python:3.12-slim
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  script:
    - pip install anthropic openai        # whichever vendor review.py uses
    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
    - git diff origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME > changes.diff
    - python review.py changes.diff | python post_comment.py
  allow_failure: true                     # advisory — don't block merge on reviewer errors

5 · Tech-lead — making the reviewer trusted tech-lead

An AI reviewer that cries wolf gets muted. The lead-level work is making it trusted: keep it advisory at first (allow_failure: true) so a flaky model never blocks a merge; tune the prompt to your real standards so it flags what matters and stays quiet otherwise; and label its comments clearly as automated so humans weight them appropriately. Measure whether its findings get acted on — if developers routinely dismiss them, the rubric is wrong, not the developers. A reviewer earns the right to become a required check only after it's demonstrably precise.

Knowledge check check yourself