What You'll Build
An automated pull request review system that:
- Reviews code automatically when pull requests open or update
- Applies your team’s custom rules and standards
- Runs in your GitHub Actions runner (code is sent directly to your configured LLM)
- Posts actionable feedback as pull request comments
- Responds to interactive review requests
Why This Approach?
Privacy-First
All logs and processing happen in your runner: Continue CLI runs in GitHub Actions → code to your LLM provider (OpenAI, Anthropic, etc.). No hosted Continue service reads your code.
Customizable
Define team-specific rules in
.continue/rules/
that automatically apply to every pull request.Context Awareness
Leverage Continue’s AI agent for intelligent, context-aware reviews with full control over your configuration.
Prerequisites
Before starting, ensure you have:- A GitHub repository with pull requests
- Continue account with Hub access
- Read: Understanding Configs
- A Continue API key from hub.continue.dev/settings/api-keys
- Continue assistant configured for code reviews (or use our recommended default)
Quick Setup (10 Minutes)
1
Configure Repository Secrets and Variables
Navigate to your repository settings: Settings → Secrets and variables → ActionsRequired Secrets:
CONTINUE_API_KEY
- Your Continue API key from hub.continue.dev/settings/api-keys
- Variables tab:
APP_ID
- GitHub App ID (for enhanced API rate limits) - Secrets tab:
APP_PRIVATE_KEY
- GitHub App private key
Setting up a GitHub App (Optional but Recommended)
Setting up a GitHub App (Optional but Recommended)
For better rate limits and permissions, create a GitHub App:
- Go to Settings → Developer settings → GitHub Apps → New GitHub App
- Set permissions:
- Contents: Read
- Pull Requests: Write
- Issues: Write
- Generate a private key
- Install the app on your repository
- Add
APP_ID
as a repository variable (Variables tab) - Add
APP_PRIVATE_KEY
as a repository secret (Secrets tab)
GITHUB_TOKEN
.2
Add Workflow File
Create a GitHub Actions workflow file at
.github/workflows/code-review.yml
with the provided configuration.3
Create Custom Rules (Optional)
Define your team’s standards in
.continue/rules/
:- Security Rule
- TypeScript Standards
- Testing Standards
- Python Standards
Create
.continue/rules/security.md
:How It Works
The workflow follows these steps:- Pull Request Created/Updated - A pull request is opened or synchronized
- Workflow Triggered - GitHub Actions workflow starts automatically
- Load Custom Rules - Reads your team’s rules from
.continue/rules/
- Get Pull Request Diff - Fetches the diff and list of changed files
- Continue CLI Analyzes Code - AI agent reviews the code with your rules
- Post or Update Review Comment - Creates or updates a single PR comment with feedback
Interactive Commands
Comment on any pull request to trigger focused reviews:Advanced Configuration
- Use Your Own Continue Config
- Filter by File Types
- Review Size Limits
By default, the workflow uses the Store
continuedev/code-reviewer
config optimized for code reviews. Replace continuedev/code-reviewer
with your own config:CONTINUE_ORG
and CONTINUE_CONFIG
as repository variables for easy updates.Troubleshooting
Continue CLI not found
Continue CLI not found
- The workflow installs the CLI automatically, but ensure Node.js 20+ is available
- Check the “Install Continue CLI” step logs for errors
Authentication failed
Authentication failed
- Verify your
CONTINUE_API_KEY
is valid - Check that GitHub token has required permissions
No review generated
No review generated
- Verify your Continue config is accessible
- Check Continue CLI logs in the workflow run
- Try running locally:
cn -p "Test prompt" --auto
Review comment not posted
Review comment not posted
- Ensure
pull-requests: write
permission is set - Verify GitHub token has scope to comment on pull requests
- Check if the repository requires signed commits
Example Output
Here’s what a typical review comment looks like:🤖 AI Code Review
Summary
This pull request introduces a new user authentication system with JWT tokens and password hashing. The implementation follows security best practices with a few minor suggestions.Key Findings
Security ✅Code Quality 💡
- Password hashing properly implemented with bcrypt
- JWT tokens include appropriate expiry
- Input validation present for all endpoints
- Consider adding rate limiting to login endpoint
- The
secretKey
should be loaded from environment variables, not hardcoded- Add unit tests for token expiration edge cases
Positive Observations
- Good separation of concerns with middleware pattern
- Clear error messages for authentication failures
- Proper async/await usage throughout
Recommendations
- Move
secretKey
to environment variables (see.continue/rules/security.md
)- Add rate limiting middleware to prevent brute force attacks
- Consider adding integration tests for the auth flow
- Document the JWT payload structure
Powered by Continue • Need a focused review? Comment@review-bot check for security
What You’ve Built
After completing this setup, you have an AI-powered code review system that:- ✅ Runs automatically - Reviews every pull request without manual intervention
- ✅ Privacy-first - CLI runs in your GitHub Actions runner, code sent directly to your configured LLM
- ✅ Customizable - Team-specific rules apply automatically
- ✅ Interactive - Responds to focused review requests
- ✅ Continuous - Updates reviews as pull requests change
Continuous AI
Your pull request workflow now operates at Level 2 Continuous
AI -
AI handles routine code review with human oversight through review and
approval.
Next Steps
- Test it out - Create a test pull request and watch the review appear
- Refine rules - Add more custom rules specific to your codebase
- Customize prompts - Adjust the review prompt to match your team’s style
- Add metrics - Track review effectiveness over time
- Create team config - Set up a shared Continue config for consistent reviews
Inspiration & Resources
CodeBunny
Original inspiration - Privacy-first AI code reviews
Continue CLI Guide
Learn more about Continue CLI capabilities
Continue Hub
Browse shared configs and create your own
Rules Documentation
Deep dive into custom rules
Community Examples
Share your pull request review bot configuration:- Tweet your setup with
#ContinueDev
- Share improvements as GitHub discussions
- Contribute example rules to the docs