AI-powered GitHub Pull Request code review using Z.ai models. Automatic PR comments, bug detection, improvement suggestions, security checks, and feedback learning via GitHub Actions.
Latest version: v0.0.8
⚠️ Incomplete reviews are now disclosed - Final PR comments show a visible caution banner when one or more chunks fail, so reviewers can see partial coverage directly in GitHub- 📊 Chunk merge logging is clearer - Merge summaries now report successful chunk count and failed chunk count explicitly instead of implying all attempted chunks were merged
- 🧪 Partial-failure regression coverage added - Tests now cover the final merged review body when some chunks fail, including the warning banner path
- 🔎 Retry diagnostics are richer - Timeout and
ECONNRESETretries now log chunk position, file count, oversized-file count, patch size, prompt size, and elapsed time per failed attempt
Previous: v0.0.7
- 🧩 Fixed real-world combined chunk parsing - Final review grouping now handles plain severity banners, contextual heading-style findings, and bold finding titles from multi-chunk output
- 🧹 Stops narrative leakage between findings - Chunk markers and review filler text no longer bleed into the previous finding body
- 🛡️ Hardened review prompt contract - The reviewer is now explicitly told to avoid conversational intros, standalone severity banners, and chunk/part headings in chunk responses
- ✅ Added production-shape regression coverage - Tests now cover the noisy combined syntax seen in v0.0.6 outputs, not just idealized bracketed findings
Previous: v0.0.6
- 📍 Accurate security line numbers - SecurityCheck now parses diff hunk headers (
@@) for correct file line numbers - 📦 Oversized file handling - Files exceeding 50KB are flagged and isolated into their own chunk with warnings
- 📄 Pagination for resolved comments - Now handles PRs with 100+ resolved review comments
- 🔒 Input validation - Thread similarity threshold validated to 0-1 range; head SHA checked early
- 🛡️ Failure recovery - All chunks failing now aborts gracefully instead of posting empty review
Previous: v0.0.5
- 📊 Fixed multi-chunk severity grouping - Chunked reviews now stay in Critical, Major, Minor, and Info instead of collapsing into Info after the first chunk
- 💬 Fixed inline comment threading - Separate findings no longer pile into the first matching inline thread
- 🧵 Safer thread reuse - Replies are now reserved for actual follow-up on the same finding within an existing thread
- 🐛 Bug detection - Identifies logic errors, bugs, and potential runtime issues
- ✨ Improvement suggestions - Actionable recommendations for code quality
- 🤖 AI-driven review - Leverages Z.ai models for contextual code review
- ⚡ GitHub Actions native - Runs automatically on PR events
- 💬 Inline code suggestions - Posts actionable diff suggestions as GitHub review comments
- 🔒 Static security checks - Scans for hardcoded secrets, eval, dangerous functions, disabled lint
- 📈 Feedback learning - Adapts future suggestions based on accepted/rejected feedback
📦 Advanced Features
- 📦 Large PR support - Automatic chunking for PRs that exceed token limits
- 🚫 Comment deduplication - Prevents duplicate suggestions across chunks and reviews
- 🧵 Threaded comments - Replies to existing threads instead of creating duplicates
- ⏭️ Resolved comment filtering - Skips suggestions on already-resolved discussions
- 📊 Severity grouping - Groups findings by severity (Critical, Major, Minor, Info) in collapsible sections
- 🔍 Outside-diff handling - Separates and groups comments outside the diff range
- ✅ A Z.ai account with API access - Get your API key
- ✅ A GitHub repository with GitHub Actions enabled
Create .github/workflows/code-review.yml:
name: AI Code Review with Z.ai
on:
pull_request:
types: [opened, synchronize]
permissions:
issues: write
pull-requests: write
# Add `contents: write` only if you enable ZAI_COMMIT_FEEDBACK.
jobs:
review:
name: Review
runs-on: ubuntu-latest
steps:
- name: Code Review
uses: bizzkoot/zai-code-review@v0.0.8
with:
ZAI_API_KEY: ${{ secrets.ZAI_API_KEY }}
ZAI_MODEL: ${{ vars.ZAI_MODEL || 'glm-4.7' }}
ZAI_REVIEWER_NAME: ${{ vars.ZAI_REVIEWER_NAME || 'Z.ai Code Review' }}
ZAI_SYSTEM_PROMPT: ${{ vars.ZAI_SYSTEM_PROMPT || '' }}
ZAI_THREAD_SIMILARITY_THRESHOLD: ${{ vars.ZAI_THREAD_SIMILARITY_THRESHOLD || '0.6' }}
ZAI_COMMIT_FEEDBACK: ${{ vars.ZAI_COMMIT_FEEDBACK || 'false' }}- Go to your repository → Settings → Secrets and variables → Actions
- Click New repository secret
- Add: Name:
ZAI_API_KEY, Value: Your key from platform.z.ai
Commit the workflow and create a PR. The review appears automatically as a comment.
Findings are grouped by severity in collapsible sections:
## Z.ai Code Review
**Actionable comments posted: 3**
<details>
<summary>🔴 Critical/BLOCKER findings (1)</summary><blockquote>
**SQL Injection in query builder**
**Problem:** User input is directly concatenated into SQL query.
**Impact:** Allows attackers to execute arbitrary SQL commands.
**Suggested fix:**
- const query = `SELECT * FROM users WHERE id = ${userId}`;
+ const query = 'SELECT * FROM users WHERE id = ?';
+ db.query(query, [userId]);
</blockquote></details>
<details>
<summary>🟠 Major comments (2)</summary><blockquote>
...
</blockquote></details>
Actionable code replacements are posted as GitHub review comments:
- console.log(user);
+ console.log({ user });Reviewers can accept/reject suggestions directly in the GitHub UI.
Built-in static security checks on all diffs:
| Pattern | Severity | Description |
|---|---|---|
| Hardcoded API keys/secrets | Critical | Detects api_key = "..." or secret = "..." patterns |
eval() usage |
Critical | Flags dangerous dynamic code execution |
| Hardcoded passwords | Critical | Detects weak or hardcoded passwords |
| Dangerous functions | Major | Detects exec(), new Function(), child_process require |
| Disabled lint/security | Minor | Flags eslint-disable, tslint:disable |
Security findings now report accurate file line numbers using diff hunk headers.
The action adapts to your codebase over time:
- Accepted suggestions → Increases confidence for similar patterns
- Rejected suggestions → Filters out future similar suggestions
- Stored in
.zai-feedback.json(optional)
Architecture & Processing Pipeline
For small to medium PRs, all changes are sent in a single API request. Larger PRs are automatically split into chunks (50K characters each).
Processing Pipeline:
- Fetch Changed Files - Retrieves all files in the PR with pagination
- Security Check - Runs static analysis for hardcoded secrets, eval, dangerous functions
- AI Review - Sends diff to Z.ai API with conversational feedback prompt
- Post-Processing - Parses findings, groups by severity, formats with collapsible sections
- Inline Suggestions - Extracts and posts actionable code suggestions as GitHub review comments
- Threading - Checks existing threads and replies instead of creating duplicates
- Feedback Learning - Adapts suggestions based on prior accepted/rejected feedback
- Deduplication - Filters resolved suggestions and prevents duplicate comments
🔧 Customization Options
- Go to repository Settings → Secrets and variables → Actions
- Click Variables → New repository variable
- Add any of:
| Variable | Example | Description |
|---|---|---|
ZAI_MODEL |
glm-4.7 |
AI model to use |
ZAI_REVIEWER_NAME |
Security Bot |
Name in comment header |
ZAI_THREAD_SIMILARITY_THRESHOLD |
0.7 |
Thread matching strictness (higher = stricter) |
ZAI_COMMIT_FEEDBACK |
true |
Enable feedback learning commits (requires contents: write) |
ZAI_SYSTEM_PROMPT |
You are an expert... |
Custom system prompt |
Benefits: Customize without editing workflow, change settings without committing, same workflow across environments.
For multi-repository setups, configure at the organization level to apply settings across all repositories.
🔬 Advanced Configuration
- Range:
0.0to1.0 - Default:
0.6 - Higher values (e.g.,
0.8): More strict, creates new threads more often - Lower values (e.g.,
0.4): More permissive, replies to existing threads more often
- Default:
false(disabled) - Enable: Set
ZAI_COMMIT_FEEDBACK: 'true' - Permissions: Add
contents: writeto the workflowpermissions:block when enabled - Stores feedback in
.zai-feedback.jsonto adapt future suggestions
The default prompt instructs the AI to:
- Review code changes with clear, actionable feedback
- Focus on bugs, logic errors, security issues, and meaningful improvements
- Skip trivial style comments
- Use severity markers:
[BLOCKER],[CRITICAL],[Major],[Minor],[Info] - Emit inline suggestions:
[[suggestion:path:file:line:...]]
ZAI_SYSTEM_PROMPT: |
You are an expert code reviewer. Focus on security and performance.Chunking for Large PRs
Large PRs are automatically split into 50K character chunks:
Chunk 1/3 → Z.ai API → Review part 1
Chunk 2/3 → Z.ai API → Review part 2
Chunk 3/3 → Z.ai API → Review part 3
↓
Combined comment posted to PR
Deduplication Strategies
The action prevents duplicate comments through:
- Cross-chunk deduplication - Same file:line:body posted only once
- Content hashing - Similar suggestions filtered
- Thread detection - Replies to existing threads instead of creating duplicates
- Resolved filtering - Skips suggestions where thread is already resolved
- CONTRIBUTING.md - Contribution guidelines
- AGENTS.md - Development documentation for AI assistants
- CHANGELOG.md - Version history
- LICENSE - MIT License