Our team of 4 developers had no dedicated code reviewer. PRs sat for days waiting for someone to context-switch into review mode, and recurring issues — missing error handling, inconsistent patterns, forgotten type annotations — kept slipping through.

We needed a system that could catch the obvious stuff automatically, so human reviewers could focus on architecture and business logic. Here's what we built.

Architecture

The pipeline has three stages:

1. Pre-Commit: Local Validation

Git hooks run before every commit. They're fast (under 3 seconds) and catch formatting, linting, and type errors locally. No AI involved at this stage — just standard tooling.

# .git-hooks/pre-commit
pnpm lint-staged
pnpm type-check --filter $(git diff --cached --name-only | head -1 | cut -d/ -f2)

2. Pre-Push: AI Review

Before pushing, the AI reviews the diff against the project's coding standards. This is where the Claude API comes in. The hook sends the staged diff along with the project's rules file and gets back structured feedback.

const review = await claude.messages.create({
  model: 'claude-sonnet-4-5-20250929',
  messages: [{
    role: 'user',
    content: `Review this diff against these rules:\n\n${rules}\n\nDiff:\n${diff}`
  }],
})

The AI returns a structured response with severity levels (critical, warning, info) and file-specific feedback. Critical issues block the push. Warnings are shown but don't block.

3. GitHub Actions: Full Pipeline

On PR creation, a GitHub Action runs the full review suite including security scanning, dependency audit, and a more thorough AI review with full file context (not just the diff).

What the AI Catches

After 3 months of data collection, here's what the AI consistently catches:

| Category | % of All Catches | |----------|-----------------| | Missing error handling | 28% | | Inconsistent patterns | 22% | | Security issues (XSS, injection) | 15% | | Type safety gaps | 14% | | Performance anti-patterns | 12% | | Accessibility missing | 9% |

The total catch rate is 73% of all issues that would have been flagged in human review. The remaining 27% are architectural decisions and business logic validation that genuinely need human judgment.

Lessons Learned

Keep hooks fast. The pre-commit hook must stay under 3 seconds or developers will bypass it with --no-verify. We moved the AI review to pre-push specifically because it takes 5-8 seconds.

Structured output is essential. The AI returns JSON with file paths, line numbers, and severity levels. Free-form text reviews were too noisy and hard to parse programmatically.