Automated Code Review: Git Hooks + Claude API in Production
Implementing an AI-powered code review pipeline using git hooks and the Claude API that catches 73% of issues before human review.
Our team of 4 developers had no dedicated code reviewer. PRs sat for days waiting for someone to context-switch into review mode, and recurring issues — missing error handling, inconsistent patterns, forgotten type annotations — kept slipping through.
We needed a system that could catch the obvious stuff automatically, so human reviewers could focus on architecture and business logic. Here's what we built.
Architecture
The pipeline has three stages:
1. Pre-Commit: Local Validation
Git hooks run before every commit. They're fast (under 3 seconds) and catch formatting, linting, and type errors locally. No AI involved at this stage — just standard tooling.
# .git-hooks/pre-commit
pnpm lint-staged
pnpm type-check --filter $(git diff --cached --name-only | head -1 | cut -d/ -f2)
2. Pre-Push: AI Review
Before pushing, the AI reviews the diff against the project's coding standards. This is where the Claude API comes in. The hook sends the staged diff along with the project's rules file and gets back structured feedback.
const review = await claude.messages.create({
model: 'claude-sonnet-4-5-20250929',
messages: [{
role: 'user',
content: `Review this diff against these rules:\n\n${rules}\n\nDiff:\n${diff}`
}],
})
The AI returns a structured response with severity levels (critical, warning, info) and file-specific feedback. Critical issues block the push. Warnings are shown but don't block.
3. GitHub Actions: Full Pipeline
On PR creation, a GitHub Action runs the full review suite including security scanning, dependency audit, and a more thorough AI review with full file context (not just the diff).
What the AI Catches
After 3 months of data collection, here's what the AI consistently catches:
| Category | % of All Catches | |----------|-----------------| | Missing error handling | 28% | | Inconsistent patterns | 22% | | Security issues (XSS, injection) | 15% | | Type safety gaps | 14% | | Performance anti-patterns | 12% | | Accessibility missing | 9% |
The total catch rate is 73% of all issues that would have been flagged in human review. The remaining 27% are architectural decisions and business logic validation that genuinely need human judgment.
Lessons Learned
Keep hooks fast. The pre-commit hook must stay under 3 seconds or developers will bypass it with --no-verify. We moved the AI review to pre-push specifically because it takes 5-8 seconds.
Structured output is essential. The AI returns JSON with file paths, line numbers, and severity levels. Free-form text reviews were too noisy and hard to parse programmatically.
False positives kill adoption. We spent two weeks tuning the rules to minimize false positives. A 5% false positive rate is acceptable. Above 10%, developers start ignoring the tool.
Cost is negligible. At ~$0.003 per review (Sonnet pricing for typical diffs), the cost for our team of 4 is under $30/month. That's less than 15 minutes of engineer time.
Results
| Metric | Before | After | |--------|--------|-------| | PR review wait time | 2.3 days | < 1 hour | | Issues caught pre-review | 0% | 73% | | Production incidents/month | 4.2 | 0.8 | | Developer satisfaction | 6.1 | 8.7 |
The biggest win isn't the numbers — it's the cultural shift. Developers now push with confidence because they know the obvious stuff is covered. Human reviews are shorter, more focused, and more enjoyable because they can focus on the interesting problems.