Rork Max × Automated AI Code Review: Continuous Quality Assurance with GitHub Actions + Claude API

# Secret configuration (set via GitHub UI)
Name: ANTHROPIC_API_KEY
Value: YOUR_ANTHROPIC_API_KEY

# .github/workflows/ai-code-review.yml
 
name: AI Code Review
 
on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - 'app/**'
      - 'components/**'
      - 'hooks/**'
      - 'lib/**'
      - 'utils/**'
      - 'api/**'
      - '*.ts'
      - '*.tsx'
 
jobs:
  ai-code-review:
    name: AI Code Review with Claude
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write   # Required for posting PR comments
 
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0   # Full history required to compute diffs
 
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
 
      - name: Install dependencies for review script
        run: npm install @anthropic-ai/sdk @octokit/rest
 
      - name: Run AI Code Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: node .github/scripts/ai-review.js

// .github/scripts/ai-review.js
 
const Anthropic = require('@anthropic-ai/sdk');
const { Octokit } = require('@octokit/rest');
const { execSync } = require('child_process');
 
const anthropic = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
 
// Retrieve the code diff for changed files
function getDiff() {
  try {
    const baseSha = process.env.BASE_SHA;
    const headSha = process.env.HEAD_SHA;
    const diff = execSync(
      `git diff ${baseSha}...${headSha} -- '*.ts' '*.tsx' '*.js' '*.jsx'`,
      { maxBuffer: 1024 * 1024 * 10 }
    ).toString();
 
    // Truncate very large diffs to save tokens
    const maxLength = 15000;
    if (diff.length > maxLength) {
      return diff.substring(0, maxLength) + '\n\n... (diff truncated due to length)';
    }
    return diff;
  } catch (error) {
    console.error('Failed to retrieve diff:', error.message);
    return null;
  }
}
 
// Call Claude API to perform the code review
async function reviewWithClaude(diff) {
  const systemPrompt = `You are an expert in React Native, Expo, and Rork Max app development.
Please review the following code diff with attention to:
 
1. Bugs and logic errors: null access, type mismatches, async handling issues, state update problems
2. Security risks: hardcoded API keys, improper permissions, XSS vulnerabilities
3. Performance issues: unnecessary re-renders, incorrect useEffect dependency arrays
4. React Native best practices: Platform.OS branching, StyleSheet usage
5. TypeScript: overuse of any, missing type definitions
 
Return the review in the following format:
 
## AI Code Review
 
### Critical Issues (must fix)
(Description and location of each issue)
 
### Recommended Improvements
(Areas to improve)
 
### Suggestions and Best Practices
(Better implementation approaches)
 
### What's Working Well
(Positive aspects of the code)
 
If no issues are found, state: "No significant issues found."
Do not use Markdown tables.`;
 
  const response = await anthropic.messages.create({
    model: 'claude-opus-4-6',
    max_tokens: 2048,
    messages: [
      {
        role: 'user',
        content: `Please review the following code diff:\n\n\`\`\`diff\n${diff}\n\`\`\``,
      },
    ],
    system: systemPrompt,
  });
 
  return response.content[0].text;
}
 
// Post the review as a GitHub PR comment
async function postReviewComment(reviewText) {
  const owner = process.env.REPO_OWNER;
  const repo = process.env.REPO_NAME;
  const prNumber = parseInt(process.env.PR_NUMBER, 10);
 
  // Check for existing AI review comments to avoid duplicates
  const { data: comments } = await octokit.issues.listComments({
    owner,
    repo,
    issue_number: prNumber,
  });
 
  const existingComment = comments.find(
    (comment) =>
      comment.user.login === 'github-actions[bot]' &&
      comment.body.includes('AI Code Review')
  );
 
  const commentBody = `${reviewText}\n\n---\n*This review was automatically generated by Claude AI.*`;
 
  if (existingComment) {
    // Update existing comment instead of creating a duplicate
    await octokit.issues.updateComment({
      owner,
      repo,
      comment_id: existingComment.id,
      body: commentBody,
    });
    console.log('Updated existing AI review comment');
  } else {
    await octokit.issues.createComment({
      owner,
      repo,
      issue_number: prNumber,
      body: commentBody,
    });
    console.log('Posted new AI review comment');
  }
}
 
// Main execution
async function main() {
  console.log('Fetching code diff...');
  const diff = getDiff();
 
  if (!diff || diff.trim() === '') {
    console.log('No diff found. Target files may not have changed.');
    return;
  }
 
  console.log(`Diff size: ${diff.length} characters`);
  console.log('Calling Claude API for code review...');
  const reviewText = await reviewWithClaude(diff);
 
  console.log('Posting review comment to GitHub...');
  await postReviewComment(reviewText);
 
  console.log('AI code review completed successfully!');
}
 
main().catch((error) => {
  console.error('An error occurred:', error);
  process.exit(1);
});

// .github/scripts/security-scan.js
 
const { Octokit } = require('@octokit/rest');
const { execSync } = require('child_process');
const fs = require('fs');
 
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
 
// Patterns that indicate potential security issues
const DANGEROUS_PATTERNS = [
  {
    pattern: /api[_-]?key\s*=\s*["'][A-Za-z0-9+/]{20,}["']/gi,
    desc: 'Hardcoded API key detected'
  },
  {
    pattern: /password\s*=\s*["'][^"']{8,}["']/gi,
    desc: 'Hardcoded password detected'
  },
  {
    pattern: /eval\s*\(/g,
    desc: 'Use of eval() — potential security risk'
  },
  {
    pattern: /dangerouslySetInnerHTML/g,
    desc: 'dangerouslySetInnerHTML usage — XSS risk'
  },
];
 
function getChangedFiles() {
  try {
    const output = execSync(
      `git diff --name-only ${process.env.BASE_SHA}...${process.env.HEAD_SHA} -- '*.ts' '*.tsx' '*.js' '*.jsx'`
    ).toString();
    return output.trim().split('\n').filter(Boolean);
  } catch {
    return [];
  }
}
 
function quickScan(files) {
  const issues = [];
  for (const file of files) {
    if (!fs.existsSync(file)) continue;
    const lines = fs.readFileSync(file, 'utf8').split('\n');
    for (const { pattern, desc } of DANGEROUS_PATTERNS) {
      lines.forEach((line, idx) => {
        if (pattern.test(line)) {
          issues.push({ file, line: idx + 1, issue: desc, code: line.trim() });
        }
        pattern.lastIndex = 0;
      });
    }
  }
  return issues;
}
 
async function main() {
  const files = getChangedFiles();
  if (files.length === 0) { console.log('No changed files found'); return; }
 
  const issues = quickScan(files);
 
  let report = '## Security Scan Results\n\n';
  if (issues.length > 0) {
    report += '### Issues Detected\n\n';
    for (const issue of issues) {
      report += `- **${issue.file}** (line ${issue.line}): ${issue.issue}\n`;
      report += `  \`${issue.code.substring(0, 100)}\`\n`;
    }
  } else {
    report += '### No obvious security issues detected\n\n';
  }
  report += `Files scanned: ${files.length}\n\n---\n*Automated security scan by AI.*`;
 
  if (process.env.PR_NUMBER) {
    await octokit.issues.createComment({
      owner: process.env.REPO_OWNER,
      repo: process.env.REPO_NAME,
      issue_number: parseInt(process.env.PR_NUMBER, 10),
      body: report,
    });
  }
 
  console.log('Security scan complete');
 
  if (issues.some((i) => i.issue.includes('API key') || i.issue.includes('password'))) {
    console.error('Critical security issues found — failing workflow');
    process.exit(1);
  }
}
 
main().catch((e) => { console.error(e); process.exit(1); });

// .github/scripts/performance-check.js
 
const fs = require('fs');
const { execSync } = require('child_process');
 
const PERF_PATTERNS = [
  {
    pattern: /console\.(log|warn|error)/g,
    desc: 'console statements present in production code — wrap with __DEV__ or remove',
    severity: 'warning',
  },
  {
    pattern: /\.map\([^)]+\)\s*\.\s*filter/g,
    desc: '.map().filter() order — consider filtering first for better performance',
    severity: 'info',
  },
  {
    pattern: /new\s+\w+\(\)/g,
    desc: 'Object creation during render — consider useMemo or useRef',
    severity: 'info',
  },
];
 
function getChangedFiles() {
  try {
    const output = execSync(
      `git diff --name-only ${process.env.BASE_SHA}...${process.env.HEAD_SHA} -- '*.tsx' '*.ts'`
    ).toString();
    return output.trim().split('\n').filter(Boolean);
  } catch { return []; }
}
 
function main() {
  const files = getChangedFiles();
  const findings = files.flatMap((f) => {
    if (!fs.existsSync(f)) return [];
    const content = fs.readFileSync(f, 'utf8');
    return PERF_PATTERNS.flatMap(({ pattern, desc, severity }) => {
      const matches = content.match(pattern);
      pattern.lastIndex = 0;
      return matches ? [{ file: f, count: matches.length, desc, severity }] : [];
    });
  });
 
  if (findings.length === 0) {
    console.log('No performance issues detected');
    return;
  }
 
  console.log('\nPerformance Analysis:');
  findings.forEach(({ file, desc, count, severity }) => {
    const tag = severity === 'warning' ? '[WARN]' : '[INFO]';
    console.log(`${tag} [${file}] ${desc} (${count} occurrence${count > 1 ? 's' : ''})`);
  });
}
 
main();

# Add a size-check job to your workflow
 
jobs:
  check-size:
    name: Check PR Size
    runs-on: ubuntu-latest
    outputs:
      should-review: ${{ steps.check.outputs.should-review }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: check
        run: |
          CHANGED_LINES=$(git diff \
            ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} \
            --shortstat | grep -oP '\d+ insertion' | grep -oP '\d+' || echo 0)
          if [ "$CHANGED_LINES" -gt 2000 ]; then
            echo "should-review=partial" >> $GITHUB_OUTPUT
          else
            echo "should-review=full" >> $GITHUB_OUTPUT
          fi

// Add project-specific rules to the system prompt in ai-review.js
const projectRules = `
Additionally, verify the following project-specific conventions:
 
- Supabase client must always be imported from lib/supabase.ts
- Environment variables must be defined in .env.local only — never hardcoded
- All API response types must be explicitly defined — avoid using 'any'
- Components must be placed in the components/ directory
`;
 
// Log review results for later analysis
const fs = require('fs');
const logEntry = {
  date: new Date().toISOString(),
  prNumber: process.env.PR_NUMBER,
  diffSize: diff.length,
  hasIssues: reviewText.toLowerCase().includes('critical'),
  model: 'claude-opus-4-6',
};
fs.appendFileSync('.github/review-logs.jsonl', JSON.stringify(logEntry) + '\n');

concurrency:
  group: ai-review-${{ github.repository }}-${{ github.event.pull_request.number }}
  cancel-in-progress: false

// .github/scripts/test-generator.js
 
const Anthropic = require('@anthropic-ai/sdk');
const fs = require('fs');
const path = require('path');
 
const anthropic = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
 
async function generateTests(filePath) {
  if (!fs.existsSync(filePath)) return null;
 
  // Skip if test file already exists
  const testFilePath = filePath.replace(/\.(ts|tsx)$/, '.test.$1');
  if (fs.existsSync(testFilePath)) {
    console.log(`Skipping — test file already exists: ${testFilePath}`);
    return null;
  }
 
  const content = fs.readFileSync(filePath, 'utf8');
 
  const response = await anthropic.messages.create({
    model: 'claude-haiku-4-5-20251001', // Haiku is sufficient for test generation
    max_tokens: 1024,
    messages: [
      {
        role: 'user',
        content: `Generate Jest tests for the following React Native / TypeScript code.
Use @testing-library/react-native and include test cases for the main functions and components.
Return only the test code — no explanation needed.
 
\`\`\`typescript
${content.substring(0, 3000)}
\`\`\``,
      },
    ],
  });
 
  return {
    filePath: testFilePath,
    content: response.content[0].text,
  };
}
 
async function main() {
  // Read target files from environment variable (comma-separated)
  const targetFiles = (process.env.TARGET_FILES || '').split(',').filter(Boolean);
 
  // Limit to 3 files per run to manage costs
  for (const file of targetFiles.slice(0, 3)) {
    console.log(`Generating tests for: ${file}`);
    const result = await generateTests(file);
 
    if (result) {
      fs.writeFileSync(result.filePath, result.content);
      console.log(`Tests written to: ${result.filePath}`);
    }
  }
}
 
main().catch(console.error);

- name: Generate test scaffolding
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    TARGET_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
  run: node .github/scripts/test-generator.js

// .github/scripts/pr-description-generator.js
 
const Anthropic = require('@anthropic-ai/sdk');
const { Octokit } = require('@octokit/rest');
const { execSync } = require('child_process');
 
const anthropic = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
 
async function generateDescription(diff) {
  const response = await anthropic.messages.create({
    model: 'claude-haiku-4-5-20251001',
    max_tokens: 512,
    messages: [
      {
        role: 'user',
        content: `Based on the following code diff, write a clear, concise PR description.
Include: what changed, why it matters, and any important implementation notes.
Use plain paragraphs — no bullet lists or tables.
 
\`\`\`diff\n${diff.substring(0, 8000)}\n\`\`\``,
      },
    ],
  });
 
  return response.content[0].text;
}
 
async function main() {
  const baseSha = process.env.BASE_SHA;
  const headSha = process.env.HEAD_SHA;
 
  let diff;
  try {
    diff = execSync(`git diff ${baseSha}...${headSha}`).toString();
  } catch (e) {
    console.error('Failed to get diff:', e.message);
    return;
  }
 
  const prNumber = parseInt(process.env.PR_NUMBER, 10);
  const owner = process.env.REPO_OWNER;
  const repo = process.env.REPO_NAME;
 
  // Only auto-fill if the PR body is empty or minimal
  const { data: pr } = await octokit.pulls.get({ owner, repo, pull_number: prNumber });
  if (pr.body && pr.body.trim().length > 100) {
    console.log('PR already has a description — skipping auto-generation');
    return;
  }
 
  const description = await generateDescription(diff);
  await octokit.pulls.update({ owner, repo, pull_number: prNumber, body: description });
  console.log('PR description updated');
}
 
main().catch(console.error);

// .github/scripts/quality-reporter.js
// Generates a weekly code quality report from review logs
 
const fs = require('fs');
const path = require('path');
 
function loadReviewLogs(logFile) {
  if (!fs.existsSync(logFile)) return [];
  return fs.readFileSync(logFile, 'utf8')
    .split('\n')
    .filter(Boolean)
    .map((line) => {
      try { return JSON.parse(line); } catch { return null; }
    })
    .filter(Boolean);
}
 
function generateWeeklyReport(logs) {
  const oneWeekAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
  const weekLogs = logs.filter((log) => new Date(log.date) > oneWeekAgo);
 
  if (weekLogs.length === 0) {
    return 'No reviews in the past week.';
  }
 
  const totalReviews = weekLogs.length;
  const reviewsWithIssues = weekLogs.filter((log) => log.hasIssues).length;
  const issueRate = ((reviewsWithIssues / totalReviews) * 100).toFixed(1);
  const avgDiffSize = Math.round(
    weekLogs.reduce((sum, log) => sum + (log.diffSize || 0), 0) / totalReviews
  );
 
  return [
    '## Weekly Code Quality Report',
    '',
    `Total reviews this week: ${totalReviews}`,
    `Reviews with issues flagged: ${reviewsWithIssues} (${issueRate}%)`,
    `Average diff size: ${avgDiffSize} characters`,
    '',
    issueRate > 50
      ? 'Note: More than half of PRs had issues flagged. Consider a focused code quality sprint.'
      : 'Code quality looks healthy this week.',
  ].join('\n');
}
 
const logFile = path.join('.github', 'review-logs.jsonl');
const logs = loadReviewLogs(logFile);
const report = generateWeeklyReport(logs);
 
console.log(report);
 
// Save report to file for CI artifact upload
fs.writeFileSync('quality-report.md', report);

# .github/workflows/weekly-quality-report.yml
 
name: Weekly Quality Report
 
on:
  schedule:
    - cron: '0 9 * * MON'   # Every Monday at 9:00 UTC
  workflow_dispatch:
 
jobs:
  report:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: node .github/scripts/quality-reporter.js
 
      - name: Upload report as artifact
        uses: actions/upload-artifact@v4
        with:
          name: quality-report
          path: quality-report.md