Bad AI code review spams pull requests with style nitpicks, hallucinated APIs, and vague improve error handling comments. Good AI review finds missing awaits on payments, unvalidated webhooks, Arabic RTL bugs, and N+1 queries, with file plus line plus fix.
This is the workflow that cut our review time 30 percent while keeping humans as owners.
1. Scope to the diff, not the repo
Review only changed lines plus 20 lines context, max 400 lines per run. Larger diffs get chunked by file. Full-file reviews repeat known tech debt and drown signal. Prompt must state review this diff only, do not comment on unchanged code unless it breaks the change.
Require severity for every comment. Blocker for data loss or security, major for bugs and perf, minor for readability. Ban style comments. Leave formatting to ESLint and Prettier. One style comment erodes trust and developers ignore the bot.
2. Custom rules that match your stack
Generic rules produce generic reviews. Encode your Saudi stack rules. No any for CMS payloads, validate every webhook with Zod, handle Arabic RTL with logical properties, use idempotency keys for Moyasar and Fatoora, and check VAT rounding half-up.
Provide file patterns. For payments, check double-click double-charge. For Next.js, check server versus client component misuse. For Arabic forms, check dir auto on phone inputs. The bot should cite rule id like PAY-02 in each comment so authors learn.
Update rules from postmortems. When a missing await causes double capture, add a rule with incident link. Rules file lives in the repo and is reviewed like code.
3. Ask for reproduction plus fix
Every major comment needs why it breaks with a Saudi example, plus suggested diff. Bad comment is consider edge cases. Good comment is order.items[0] crashes when cart has free sample with empty items array from test order 4521, fix with if empty return early, plus test case.
Require the model to quote the exact lines it references. If it cannot quote, it must not comment. This single rule kills most hallucinations.
4. Security and performance focus
Prompt sections for secrets in diff, SQL injection via string concat, XSS via dangerouslySetInnerHTML with Arabic user content, and open redirects after login. For perf, flag N+1 on order items, missing pagination on Arabic search, and uncached CMS fetches in loops.
For RTL, flag ml and mr classes that break Arabic layout, hardcoded left and right in CSS, and phone numbers without dir ltr. These are invisible to English-only reviewers but break Saudi UX.
5. Human ownership and metrics
Bot never merges. Human approves. Track acceptance rate of bot comments, false-positive rate via thumbs down, and time from PR open to merge. Target over 50 percent useful rate. Review bot rules monthly with the team and delete noisy rules fast.
Run review on draft PRs for early signal, and full review on ready. Keep logs of prompts and diffs for a month to debug bad advice.
Bottom line is scoped diffs, custom Saudi stack rules, quoted fixes, and human merge. Do that and AI review becomes a junior reviewer that never sleeps, not spam.
