AI-powered code review CLI for GitLab merge requests. Uses Vertex AI (Gemini, Claude, Mistral) to analyze diffs and post actionable findings as inline comments or summary notes.

• Multi-model — Gemini 2.5 Flash (default), Pro, Claude, Mistral via single Vertex AI ADC credential
• Focus modes — bugs, security, performance, style, docs, or all
• Severity filtering — low (default), medium, high, critical
• GitLab integration — Inline diff discussions or simple MR notes, with idempotent cleanup on re-push
• Context-aware — Modular chunking strategies for large MRs
• Configurable — CLI flags, env vars, or per-repo .code-reviewer.yaml

# Review your branch against origin/HEAD
export GOOGLE_CLOUD_PROJECT=my-gcp-project
code-reviewer --diff

# Review against a specific ref
code-reviewer --diff HEAD~3

# Review specific files
code-reviewer --files internal/handler.go,internal/service.go

# Security-focused review
code-reviewer --diff --focus security

# Only show high/critical issues
code-reviewer --diff --min-severity high

Add to your .gitlab-ci.yml:

# Quick setup — uses CI_JOB_TOKEN, no PAT needed
code-review:
  stage: review
  image: gcr.io/$PROJECT/code-reviewer:latest
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    GITLAB_TOKEN: $CI_JOB_TOKEN
    REVIEW_COMMENT_MODE: "notes"
  script:
    - code-reviewer --ci
  allow_failure: true

For inline diff-anchored comments, use a Project Access Token with api scope:

code-review:
  variables:
    GITLAB_TOKEN: $CODE_REVIEWER_TOKEN    # PAT with api scope
    REVIEW_COMMENT_MODE: "discussions"
  script:
    - code-reviewer --ci

See .gitlab-ci.example.yml for the full setup.

Settings are applied in priority order: CLI flags > env vars > .code-reviewer.yaml > defaults.

Create .code-reviewer.yaml in your repo root:

model: gemini-2.5-flash
focus: [bugs, security]
min_severity: low
comment_mode: discussions
excluded_patterns:
  - "*.pb.go"
  - "generated/*"
extra_rules: |
  Always flag raw SQL string concatenation.
  Check that zerolog is used instead of log/fmt.

See .code-reviewer.example.yaml for all options.

All models are accessed via Vertex AI using Application Default Credentials (ADC). No separate API keys needed.

Uses Application Default Credentials:

# Local development
gcloud auth application-default login

# CI/CD — use Workload Identity Federation or a service account key

Large MRs may exceed the model's context window. The --chunk-strategy flag controls behavior:

• fail (default) — Errors with a helpful message if the diff is too large. Forces teams to scope MRs.
• split — Auto-splits diffs into file groups, runs separate model calls, merges results.

The chunker interface is modular — custom strategies can be added.

# Enter dev shell
nix develop

# Build
go build ./cmd/code-reviewer

# Test
go test ./...

# Lint
golangci-lint run

Apache 2.0