The AI Code Review Pipeline Kit from WOWHOW gives a small team a code review process sized to risk. When AI agents write more of your pull requests, reading every diff line by line stops scaling, and approving everything quickly is worse. This kit lets the change itself decide how much human review it gets: docs and tests merge on green checks, ordinary code needs one approval, and auth, payments, migrations, infrastructure and CI changes need two. Findings from your AI reviewer are parsed, and open important or security findings block the merge until someone fixes them or resolves them with a reason.
Everything is plain, readable and free of dependencies: Node 20+ scripts, one GitHub Actions workflow, and Markdown templates you can read in an afternoon and change to fit your team.
What You Get
- Risk-tier classifier (classify.mjs): reads a unified diff or git diff --numstat output and returns low, medium or high, the reasons, and the number of approvals required. It handles renames, binary files, mode changes, lockfiles and size thresholds, and ships its own small glob matcher.
- risk-tiers.json: strict defaults for auth, payments, migrations, secrets, infrastructure, Docker and CI paths, with validation that rejects typos instead of ignoring them.
- GitHub Actions review gate: classifies every pull request with the base branch copy of the scripts and config, so a PR cannot lower its own tier. It counts approvals from distinct people other than the author on the current commit, ignores bot approvals, posts one sticky comment, works with merge queues and uses least-privilege token permissions.
- AI findings parser (parse.mjs): reads the latest review from your AI reviewer, counts [important], [security], [nit] and [pre-existing] findings, honours ticked boxes and [resolved: reason], ignores code blocks and quotes, and fails while blocking findings are open or when the review gives no verdict.
- REVIEW.md template and a CLAUDE.md review section: what reviewers must check, severity tags, what counts as security-sensitive, and a cap on review rounds.
- Fresh-context diff-reviewer subagent for Claude Code, and a pull request template with Testing, Risk and How to revert sections.
- Three checklists: self-review before a PR, merge queue and feature flags, and turning every escaped bug into a regression test and a reviewer eval, with replay scripts.
- 120 automated tests (node --test, no dependencies), an install script that never overwrites your files, worked examples, and a VERIFY.md that records exactly how the kit was tested.
How to Use
- Unzip the kit and run the tests and examples in its folder. This takes about a minute and needs no repository.
- Run install.sh against your repository on a new branch. It copies the scripts to .github/review-kit/ along with the workflow, PR template, subagent and REVIEW.md.
- Edit REVIEW.md, paste the CLAUDE.md section, add your own sensitive paths to risk-tiers.json, and set the login your AI reviewer posts as.
- Open the setup pull request. The gate runs in preview mode until it is on your main branch.
- Turn on the branch protection settings listed in the README: required status checks, code owner review, dismissal of stale approvals and conversation resolution.
Honest Limits
- It does not run an AI model. Bring your own reviewer: the Claude Code GitHub Action, claude -p, another model, or a person.
- The classifier reads paths, sizes and file types, not what the code means. Keep the high-risk list current and use the risk:high label when paths understate the risk.
- Enforcement comes from GitHub branch protection. Without the settings described in the README, the checks are advisory.
- A pull request that edits the workflow file controls its own run. Code owner review on .github/ is the backstop, and the README explains how to set it up.
- The workflow and approval counting are GitHub-only. The scripts themselves work with any diff.
- It was verified locally with unit tests, actionlint with shellcheck, an act dry run and a local runner against a real git merge commit. Your setup pull request is its first live run.
Who It Is For
Teams of two to twenty people who use AI coding agents on GitHub and want to spend fewer human hours on review without more reverts. Solo maintainers can still use REVIEW.md, the subagent and the findings gate; the README explains the approval settings for one-person repositories.
Includes an MIT-style licence for use in your own projects, commercial ones included. The design was inspired by Anthropic's public write-up on how the Claude Code team reviews code. This is an independent implementation by WOWHOW and is not affiliated with Anthropic or GitHub.
Related
The kit follows the small-team version of the review model in How the Claude Code Team Reviews Code. Pair it with the Model Regression Canary to catch model drift before it reaches review, use the free Agent Run Cost Simulator to price the AI reviewer, or browse every WOWHOW kit.
