How to set up AI PR review on GitHub

Last updated 29 Oct 2026 · by Thomas, editor · How we verify

Anthropic and OpenAI each publish a GitHub Action that reviews pull requests. Here's the setup from the two official repos, plus the permission rules teams add so the bot comments and a person merges.

What you need

A GitHub repo with Actions
An Anthropic API key for claude-code-action, or an OpenAI API key for codex-action
About 15 minutes, per both recipes
Branch protection and CI on your default branch

Set it up, step by step

Add the API key as a repository secret. (recipe)
Copy the workflow: the Claude action's quick start, or the review workflow in the Codex README. (recipe)
Lock permissions. Give the workflow contents: read so only the comment step can write; for the Claude action, limit tools so it comments rather than pushes. (recipe)
Paste a review prompt (below), then add your repo's own rules. Ask for real problems only, ranked by risk. (recipe)
Pick the trigger: every new PR on a quiet repo, an @claude mention or a label on a busy one. (recipe)
Protect the default branch and require CI, so “humans merge” holds even if a bot ignores its prompt. (recipe)
Open a test PR and read the comments before you rely on it. (recipe)

Starter prompt: OpenAI's codex-action README example

This is PR #${{ github.event.pull_request.number }} for ${{ github.repository }}. Review ONLY the changes introduced by the PR, so consider: git log --oneline ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} Suggest any improvements, potential bugs, or issues. Be concise and specific in your feedback. Pull request title and body: ---- ${{ github.event.pull_request.title }} ${{ github.event.pull_request.body }}

Approval and safety rules

Treat PR and issue text as untrusted. Prompt injection is the first listed failure: limit tools and don't give write tokens. (recipe)
Forked PRs can't read secrets by default. That's intended. (recipe)
Have a different model review than the one that wrote the code. (recipe)
After a third failed review, ask for a redesign instead of another patch. (recipe)
Agents that open PRs open drafts only, and a person merges. (recipe)

Real examples

Each one links to the recipe and its original source.

@claude in pull requests (GitHub Action)Anthropic's action: reviews PRs, answers @claude questions and can implement small changes.
Your own PR review bot with CodexOpenAI's action: runs Codex with locked-down privileges and posts a review comment on each new PR.
Claude Code builds, Codex reviewsClaude Code builds; Codex reviews the branch read-only and ranks findings by risk.
The writer never reviews its own laneA fleet rule: the model that writes a lane never reviews it.
Overnight test coverage PRs with CodexAn OpenAI engineer queues low-coverage modules overnight and reviews test PRs in the morning.
Night shift: labeled GitHub bugs → reviewed draft PRs by morningLabeled GitHub bugs become reproduced, reviewed draft PRs by morning.

Compare more setups: AI code review agents: all 7 recipes →

Common questions

Is there an official GitHub Action for AI code review?

Yes, two: anthropics/claude-code-action and openai/codex-action. Each runs in a GitHub Actions workflow with your own API key.

How much does AI PR review cost?

Both recipes list API usage and state no figure. The Claude action's failure list warns costs grow on busy repos, so trigger on mention there.

Can the AI reviewer merge or push?

Not in these setups. The Codex workflow is read-only except for the comment step, the Claude recipe limits tools so it comments rather than pushes, and humans merge.

More guides: Make money with AI agents · AI voice agent business · AI agent agency ideas · Claude Code use cases · Grok Bot use cases · Claude Code vs Codex · AI agents for small business · AI email agents · AI code review agents · Parallel coding agents · AI agents that save you money · Autonomous agents that made money