I Switched to an Open Source Code Reviewer And I'm Not Looking Back


I Switched to an Open Source Code Reviewer
And I'm Not Looking Back

This issue is brought to you by:
​

Stop typing. Start talking with Wispr Flow.

​
Your voice is faster than your keyboard.
Wispr Flow turns natural speech into polished, ready-to-send text across your favorite apps,
without the usual dictation mistakes or endless editing.

​

Be honest.. how much of your code are you actually reading?
Not the quick glance before merging.
I mean going through the changes, checking the logic, thinking about security, making sure the thing your agent just wrote makes sense.
I’m asking because my previous attempt at automated review was an OpenCode GitHub Action with a prompt that basically said, “review the changes in this pull request thoroughly.” (I actually made it worse by using a free model 🤣) Well done mate. You nailed it. Software engineering solved.

It worked as an experiment, but I wanted something built for the job.
That’s where PR-Agent comes in, and why I’m switching my personal projects over to it.

​
This isn’t a CodeRabbit breakup

Let’s get this out of the way: CodeRabbit is an amazing product, and I’m still a happy paying customer at work.
This isn’t me discovering that commercial software is evil.
For my own projects, though, I wanted an open-source reviewer I could configure and run myself, without another per-developer review subscription.

And to be fair, CodeRabbit already offers free reviews for public repositories.
So “open source means free reviews” isn’t the whole argument here.

For me, it’s control.
My workflow, my configuration, my choice of model.
Including when the repository is private.

PR Agent is now community maintained under its own GitHub organization, following Qodo’s donation of the project.
This just makes a stronger argument for me - literally a project customers paid for, made open source for everyone to use.

​
Better than “please review make no mistakes”

The difference isn’t just a longer prompt (I know that's what you think..)
PR-Agent has tools for reviewing changes, describing pull requests, answering questions, and suggesting improvements. It also deals with the less exciting work around those requests: preparing the diff, managing the available context, and fitting it into the model’s token budget.

That last part matters when an agent casually hands you a PR the size of a small novel.

Its compression strategy filters and trims what gets sent when the change is too large.
That doesn’t mean the model magically understands everything, it means there’s an actual strategy beyond throwing the whole thing into a prompt and hoping it works. Which, honestly, is already an improvement over my previous setup (low bars...)
​

Put it where the review already happens

I went with GitHub Actions.
No separate review dashboard to keep open.
The feedback shows up on the pull request, where I’m already deciding whether to merge it.

The GitHub setup needs a workflow under .github/workflows/ and credentials for the model provider.
In this setup, that’s an OpenAI API key, added as a repository secret:

gh secret set OPENAI_KEY=ABC123

GitHub supplies the workflow’s GITHUB_TOKEN (did you know that?! -> if you have something like:

steps:
- name: GitHub API
env:
GH_TOKEN: $
run: gh api user

The token will be set for you by the platform(!)
Merge the installation into the default branch, open the next PR, and the configured workflow can review it automatically.

You can also leave commands directly in the PR discussion. Request a review:

/review

Ask for a description:

/describe

Or request code suggestions:

/improve

That’s the interaction I wanted -not copying a diff between windows, the reviewer is part of the PR.

​
Don't settle for a "raw" review

PR-Agent supports committable suggestions!
You can enable them in the repository configuration, .pr_agent.toml, instead of asking for the same behavior manually every time. Set:

[pr_code_suggestions]
committable_code_suggestions = true
​
​# full reference here​

Give it something better to work with

The configuration goes beyond picking a model.
You can add custom review instructions, choose fallback models, and control token limits so it doesn't go wild.
There’s also support for skills, so you can give it guidance relevant to the code it’s reviewing instead of expecting generic advice to cover everything.

Another useful piece is dynamic context.: A diff alone doesn’t always explain what a function is doing.
PR-Agent can expand the surrounding code to give the model more context, without simply sending every entire file.

The configuration reference is worth looking through.
These are the kinds of controls that made me want a purpose-built reviewer in the first place.
​

Open source doesn’t pay the API bill

There isn’t a PR-Agent seat subscription in this setup. There is still model usage, and potentially GitHub Actions usage, to pay for.

Also, running the reviewer yourself doesn’t automatically make inference private.
With my OpenAI backed setup, review context goes to openai API.
A private GitHub repository doesn’t change that.
Only use code you’re authorized to send to that provider.

So no, this isn’t “everything is free and nothing leaves your machine.” It’s a different tradeoff, with more of the setup and responsibility on you.

For my personal projects, that’s a tradeoff I can work with.

I’m not claiming this thing beats every commercial reviewer, or that another AI checking your AI means you can stop reading code (not opening that debate!)
I’m saying it’s a welcome upgrade from my homemade “review this thoroughly” prompt, and it gives me a review workflow I can actually shape, for [kinda] free (using exiting subscriptions).

Start with one repo. See whether the findings are useful, check the suggestions, run your tests, and look at the usage bill.

The goal isn’t more comments on your PR, It’s catching something worth fixing before you merge.

I hope this was valuable!
Thank you for reading.
Feel free to reply directly with any question or feedback.
Have a great weekend!

​

ESPRESSO FRIDAYS

Every once in a while I send hand picked things I've learned. Kind of like your filter to the tech internet. No spam, I promise!

Read more from ESPRESSO FRIDAYS

AI Can Write Your Terraform. You Still Own the Blast Radius. This issue is brought to you by: 18 Kubernetes agentic AI security best practices CNCF and Teleport lay out the top cloud-native agentic standards that you should know before you deploy autonomous AI agents in your Kubernetes clusters. Read the full Kubernetes agentic AI blog I can ask an agent to generate a cloud environment and get hundreds of lines of Terraform back in seconds. I promise it's going to be BEAUTIFUL.It also means I...

Stop Using Elasticsearch. Use Postgres Instead This issue is brought to you by: Postgres for sensor and machine data Factories, wells, grids, and fleets run on live machine data. Tiger Data keeps it performant and scalable in one Postgres. Get started with Text Search on TigerData→ Do you still need Elasticsearch? I wanted to test that properly, so I put Postgres in Docker, loaded it with thousands of support tickets, and checked how far the same BM25 relevance search used by dedicated search...

Somehow, Atuin Just Got EVEN Better This issue is brought to you by: Give your AI agents memory Learn how Oracle Agent Memory handles persistent context with custom extraction, hybrid search, filtering, and more control over what your agents remember. Read the developer guide → There aren't many terminal utilities I'd take with me anywhere. But if I had to pick just one, Atuin may very well be it. I've been using it for a few years now, and somehow the magic turtle keeps getting better. It...