Building an AI Code Review Bot with Chinese Models

July 20, 2026 · 14 min read · Pricing

Manual code review doesn't scale. When your team ships 50+ PRs per week, reviewers become bottlenecks, reviews get shallow, and bugs slip through. An AI code review bot catches issues before humans even look at the code — and with DeepSeek V4 Pro, it costs $0.02 per PR vs $0.10 with GPT-4o.

Architecture Overview

GitHub Webhook → Bot Server → Fetch PR Diff
                                    ↓
                          DeepSeek V4 Pro Review
                                    ↓
                          Post Comments on PR

Bot Implementation

"""AI Code Review Bot powered by DeepSeek V4 Pro"""
import os
import json
import openai
from flask import Flask, request, jsonify

app = Flask(__name__)

client = openai.OpenAI(
    api_key=***"AIWAVE_API_KEY"],
    base_url="https://aiwave.live/v1",
)

REVIEW_SYSTEM = """You are a senior code reviewer. Analyze the diff and provide:
1. **Critical Issues** (bugs, security vulnerabilities, data loss risks)
2. **Warnings** (performance issues, bad practices, potential errors)
3. **Suggestions** (code style, readability improvements)
4. **Positive Notes** (well-written code, good patterns)

For each issue, specify the file and line number. Be concise.
Format in Markdown."""

@app.route("/webhook", methods=["POST"])
def github_webhook():
    event = request.headers.get("X-GitHub-Event")
    if event != "pull_request":
        return jsonify({"status": "ignored"})

    data = request.json
    action = data.get("action")
    if action not in ("opened", "synchronize"):
        return jsonify({"status": "ignored"})

    pr = data["pull_request"]
    diff_url = pr["diff_url"]
    repo_full = data["repository"]["full_name"]
    pr_number = pr["number"]

    # Fetch diff
    import urllib.request
    diff_req = urllib.request.Request(diff_url)
    with urllib.request.urlopen(diff_req, timeout=30) as resp:
        diff = resp.read().decode("utf-8", errors="replace")

    # Truncate very large diffs (max 50K tokens ≈ 100K chars)
    if len(diff) > 100_000:
        diff = diff[:100_000] + "\n\n... (diff truncated for review)"

    # Call DeepSeek V4 Pro
    response = client.chat.completions.create(
        model="deepseek-v4-pro",
        messages=[
            {"role": "system", "content": REVIEW_SYSTEM},
            {"role": "user", "content": f"Review this PR diff:\n\n{diff}"}
        ],
        temperature=0.1,
        max_tokens=2048,
    )

    review = response.choices[0].message.content
    cost = (response.usage.prompt_tokens / 1_000_000 * 0.48 +
            response.usage.completion_tokens / 1_000_000 * 3.60)

    print(f"PR #{pr_number}: {response.usage.total_tokens} tokens, ${cost:.4f}")

    # Post comment via GitHub API (implement with requests + token)
    post_github_comment(repo_full, pr_number, review)

    return jsonify({"status": "reviewed", "tokens": response.usage.total_tokens})

def post_github_comment(repo: str, pr_num: int, body: str):
    """Post review comment on GitHub PR."""
    import requests
    token = ***"GITHUB_TOKEN"]
    url = f"https://api.github.com/repos/{repo}/issues/{pr_num}/comments"
    requests.post(url, headers={
        "Authorization": f"token {token}",
        "Accept": "application/vnd.github.v3+json",
    }, json={"body": body})

if __name__ == "__main__":
    app.run(port=8080)

Cost Per PR

PR Size	Avg Tokens	DeepSeek V4 Pro	GPT-4o
Small (<200 lines)	4K	$0.006	$0.032
Medium (200-500 lines)	12K	$0.016	$0.096
Large (500+ lines)	30K	$0.038	$0.240

50 PRs/week × avg $0.02 = $1/week or $4/month for automated code review. With GPT-4o: $16/month.

Security Review Focus

SECURITY_PROMPT = """In addition to general review, focus on:
- SQL injection vectors
- XSS risks in web output
- Hardcoded secrets or API keys
- Unsafe deserialization
- Improper input validation
- Authentication/authorization bypasses
- Insecure dependency usage

Rate severity: 🔴 Critical | 🟡 Warning | 🔵 Info"""

Production Tips

• Truncate large diffs — review the most critical files first (test files, auth, payment code)
• Cache reviews — if a PR is updated with the same diff, don't re-review
• Use DeepSeek V4 Flash for large PRs to keep costs down ($0.14/M vs $0.48/M)
• Rate limit per repo — avoid overwhelming GitHub API (5,000 req/hour)