All work
092025Internal engineering

AI Code-Review Assistant for .NET Repos

A GitHub Action that catches ~40% of bugs before a human ever opens the PR.

Before

Code reviews were inconsistent across teams, and common security and performance issues kept slipping past human reviewers.

After

A GitHub Action posts inline review comments — security checks, async/await pitfalls, EF Core anti-patterns, and a prompt-injection scanner for AI-touching files. It catches ~40% of bugs before human review across 6 repos, cut PR cycle time from 2.5 days to 1.1, and surfaced 14 latent SQL-injection and async issues in the first month.

Challenge

Code reviews were inconsistent across teams; common security and performance issues kept slipping past human reviewers.

Approach

GitHub Action that posts inline review comments — security checks, async/await pitfalls, EF Core anti-patterns, and a prompt-injection scanner for any AI-touching files.

How it was built

  1. 1

    Targeted rule set

    Phase 1

    Focused the reviewer on the issues that actually recur in .NET repos — security, async/await, EF Core — instead of generic style nagging.

  2. 2

    Inline PR comments

    Phase 2

    Wired it as a GitHub Action posting inline comments via Octokit, so feedback lands exactly on the offending line during review.

  3. 3

    Prompt-injection scanning

    Phase 3

    Added a prompt-injection scanner for any AI-touching files — reviewing the new class of risk that AI features introduce.

Key architecture decisions

Domain-specific checks over generic linting

Why · Roslyn + targeted prompts for real .NET pitfalls caught meaningful bugs; a generic 'review this' prompt would have produced noise reviewers ignore.

Augment human review, don't replace it

Why · The Action handles the repetitive 40% so humans spend their attention on design and intent — the things models are worst at.

Impact

  • Catches ~40% of bugs before human review across 6 active repos
  • Reduced average PR cycle time from 2.5 days to 1.1 days
  • Surfaced 14 latent SQL-injection and async issues in the first month
40%
caught
-56%
cycle
6
repos

What I'd tell someone building this

  • 01 · A focused rule set that catches real bugs beats a broad one that generates noise.
  • 02 · Put the feedback inline on the line, or it won't get acted on.
  • 03 · AI features need their own review checks — prompt injection is now part of code review.

Tech stack

GPT-4GitHub ActionsRoslyn AnalyzerOctokit

Ask anything about AI Code-Review Assistant for .NET Repos

AI scoped to this project · GPT-OSS 120B