How to Build a Free AI Code Reviewer with Gemini and GitHub Actions
Automate code reviews for solo developers using AI-powered workflows
1The Challenge of Self-Review
Solo developers often struggle with code review quality when working alone. AI-generated code makes this worse by increasing acceptance of potentially problematic code. Without peer review, subtle bugs, security issues, or poor patterns can slip through. This solution addresses the gap by providing automated feedback before merging pull requests.
2Solution Architecture
The system combines GitHub Actions for automation and Google's Gemini AI for code analysis. When a developer pushes changes or opens a PR, GitHub automatically triggers the workflow. The action extracts code differences and sends them to Gemini via API. The AI's review comments then post directly back to the PR discussion thread for developer consideration.
3Workflow Configuration
The setup requires creating a YAML file in .github/workflows/ with specific triggers for PR events. It uses Ubuntu runners and Python for script execution. Key components include checkout actions, Python setup, dependency installation, and environment variables for API keys. The workflow is designed to run on PR open, sync, and reopen events.
4Security Best Practices
Sensitive credentials like the Gemini API key are stored as GitHub secrets, never hardcoded. The workflow accesses these via ${{ secrets.NAME }} syntax. Similarly, the AI model name is configured as a repository variable for easy updates. This follows security principles of least privilege and secret rotation capabilities.
5Python Script Logic
The core script performs three main functions: fetches PR diffs using GitHub's API, processes the changes through Gemini's API, and posts results back. It includes error handling for API failures and supports custom headers for GitHub's API versioning. The script filters file types to focus reviews on relevant source code.
6File Filtering Mechanism
The solution intelligently ignores generated files and build artifacts by checking paths against an exclusion list. It only reviews files with specific extensions (.kt, .java, etc.) relevant to Android development. This prevents wasting AI capacity on non-code files and reduces unnecessary API calls.
7Gemini API Integration
The script constructs API requests to Google's generative language endpoint with the configured model. It sends code diffs as prompts and receives structured feedback. The model can be easily swapped (e.g., to gemini-3.5-flash) without workflow changes. Response handling includes parsing and formatting for GitHub comments.
8GitHub Comment System
Reviews post as PR comments with a special marker (!-- gemini-code-review --) for identification. The system checks for existing comments to avoid duplicates. It uses GitHub's REST API with proper authentication (Bearer token) and follows current API versioning standards (2022-11-28).
9Error Handling
The implementation includes comprehensive error checking: API response validation, timeout handling, and fallback behaviors. Failed GitHub or Gemini calls log detailed error messages. The script exits gracefully for non-PR events. This ensures workflow stability and maintainability.
10Performance Considerations
The workflow runs on GitHub's Ubuntu runners with optimized dependency installation. Python requests use 60-second timeouts. The solution batches file processing and implements efficient diff handling. These choices balance responsiveness with resource usage for cost-effective operation.
11Impact and Benefits
After a month of use, the creator reports significant quality improvements. The AI catches logical errors, style issues, and potential bugs before merging. While not replacing human review, it provides valuable second opinions for solo developers. The solution is particularly effective for catching AI-generated code pitfalls.