AI Code Review in GitHub Actions: Setup Guide

AI-assisted pull request review is now within reach for any team, without an expensive SaaS subscription. Code review is one of the most time-consuming parts of shipping software, and automating the first pass with an AI reviewer frees that time for the judgment work humans do best. This guide walks through adding AI code review to any repository with Robin, a free GitHub Action, in about five minutes.

There’s a reason to automate that first pass now: Sonar’s 2026 State of Code survey found AI now writes 42% of committed code, yet only 48% of developers say they always review AI-assisted code before committing. Wiring an automatic reviewer into your pull-request pipeline closes part of that verification gap without adding a manual step anyone has to remember.

Key Takeaways

• Robin is a free, MIT-licensed GitHub Action that adds AI PR review to any repository
• Setup takes under five minutes: one install command, three repo secrets
• Bring your own API key (BYOK) - free models via OpenRouter cost nothing
• Two slash commands control the bot after install: /robin re-reviews, /summary gives a short overview
• Fork PRs don’t expose secrets by default - a brief workaround exists for trusted contributors

---

What Is Robin and Why Use It for GitHub Actions?

Robin is a free, MIT-licensed GitHub Action that posts AI-generated code review comments directly on pull requests. It requires no third-party account beyond an LLM API key you already control. By catching obvious issues on the first pass, it shortens review cycles — it’s a lightweight bridge between your GitHub workflow and any OpenAI-compatible endpoint.

The project lives at github.com/antongulin/robin and is maintained under the MIT license, meaning you can fork, modify, and self-host freely.

---

Prerequisites

Before running the install command, confirm you have:

• A GitHub repository where you have admin access (needed to add Actions secrets)
• An LLM API key from any OpenAI-compatible provider. OpenRouter offers genuinely free models with no credit card required, which makes it the fastest way to get started
• Git installed locally if you prefer to inspect the install script before running it

That’s the full list. Robin doesn’t need a database, a webhook server, or a paid GitHub plan.

---

How to Install Robin

The installer adds a ready-to-run GitHub Actions workflow file to your repository. Run this in your project root:

npx robin-review

No npm? Install with curl instead:

curl -fsSL https://robinreview.dev/install.sh | bash

Both commands configure the Git repository you are currently in. The workflow and secrets are per repository; the companion agent skill is installed globally once per machine.

Want to read the script before running it (a good habit)? Download it first instead of piping:

curl -fsSL https://robinreview.dev/install.sh -o install.sh
# review install.sh
bash install.sh

The script creates .github/workflows/robin.yml and commits nothing on its own - you stage and push the file yourself. Commit the workflow file to your default branch and the Action becomes active immediately.

---

Configuring the Three Required Secrets

Robin reads three repository secrets at runtime. Go to Settings > Secrets and variables > Actions > New repository secret and add each one.

Choosing a model. OpenRouter’s free tier routes requests to community-sponsored models. Passing openrouter/free as the model value lets OpenRouter pick an available free model automatically. For stricter control - say, a private deployment or a specific model version - set LLM_BASE_URL to your own gateway and LLM_MODEL to the exact model name your endpoint expects.

Data flow. The PR diff is sent directly to the URL in LLM_BASE_URL. If you use OpenRouter, OpenRouter forwards the request to the underlying provider. For teams with strict data residency requirements, point LLM_BASE_URL at a private endpoint you control and no data leaves your infrastructure.

See the Robin docs for a full list of optional configuration variables.

---

What the Workflow Does

The generated robin.yml file is short by design. It triggers on two GitHub events:

on:
  pull_request:
    types: [opened, synchronize, reopened]
  issue_comment:
    types: [created]

When a PR is opened or updated, Robin fetches the diff, sends it to your LLM endpoint, and posts the response as a PR review comment. When a comment event fires, Robin checks whether the comment body starts with a slash command and responds accordingly.

The workflow runs on ubuntu-latest and uses only the permissions it needs: actions: read to detect superseded runs, contents: read, and pull-requests: write. It does not store the diff, log API responses, or create any external side effects beyond the review comment.

---

Triggering Your First Review

Once the secrets are set and the workflow file is on your default branch, open any pull request in the repository. Within a minute or two you’ll see a comment from the GitHub Actions bot with Robin’s review.

If the review doesn’t appear, check the Actions tab. Common first-run issues:

• A secret name is misspelled (names are case-sensitive)
• The LLM_BASE_URL value includes a trailing path segment beyond /v1 - it should end at /v1, not /v1/chat/completions
• The chosen model name doesn’t match what the provider expects

Fix the secret value in Settings and push an empty commit to re-trigger the workflow.

---

Using the Slash Commands

Two slash commands work anywhere in PR comments after Robin is installed.

/robin - triggers a fresh review of the current diff. Useful after pushing new commits when you want immediate feedback without waiting for the next synchronize event, or when you want a second pass after addressing earlier comments.

/summary - asks Robin to post a short, plain-language overview of what the PR does. This is helpful for reviewers who need context before they read the diff, or for generating release note fodder.

Both commands are available to anyone with comment access on the repository. There’s no separate permission layer - access follows your repository’s existing collaborator settings.

---

Choosing and Switching Models

The model Robin uses is entirely controlled by the LLM_MODEL secret. You can change it at any time in Settings without touching the workflow file. The next review will use the new value.

Some practical options when using OpenRouter:

• openrouter/free - automatic selection from available free models, zero cost
• google/gemini-flash-1.5 - fast, low cost, strong at structured output
• anthropic/claude-3-haiku - good balance of speed and review quality
• openai/gpt-4o-mini - reliable, widely tested for code tasks

If you later decide to switch providers entirely - for example, to an Azure OpenAI deployment - update all three secrets. The workflow file itself doesn’t need to change because it reads the endpoint from the secret at runtime.

The tools page has a comparison of popular model choices and their tradeoffs for code review tasks.

---

A Note on Fork Pull Requests

GitHub does not expose repository secrets to workflows triggered by pull requests from forks. This is a deliberate security boundary: a forked PR could otherwise read your LLM_API_KEY and exfiltrate it.

In practice this means Robin will silently skip the review step when a contributor opens a PR from their fork. The workflow runs, but the secrets are empty, so the API call fails and no comment is posted.

The standard workaround is to use the pull_request_target event instead of pull_request for the fork case. This event runs in the context of the base repository and has access to secrets, but it also has elevated permissions - treat any code changes in the PR as untrusted before the workflow runs. The Robin docs cover this configuration in detail, including a safe pattern using an environment approval gate.

For private repositories where all contributors are trusted collaborators, fork PRs are rarely an issue and you can ignore this entirely.

---

FAQ

Does Robin store my code or diff anywhere? No. Robin sends the diff to the endpoint you configure in LLM_BASE_URL and posts the response as a comment. It has no storage layer. What the LLM provider does with the request depends on their terms - OpenRouter’s privacy policy governs requests routed through their service.

Can I use Robin on a private repository? Yes. Robin works on any GitHub repository type. Private repos have the additional benefit that fork PRs from outside contributors are impossible, which sidesteps the fork secret limitation entirely.

What happens if the LLM API call fails? The workflow step exits with an error and GitHub marks the check as failed. No comment is posted. The PR is not blocked - Robin uses a non-blocking check by default, so the failure is visible but doesn’t prevent merging.

Is there a way to disable Robin for a specific PR? There’s no built-in skip flag yet. The practical workaround is to add a path filter to the workflow trigger so Robin only runs on PRs that touch certain directories. See the docs for the paths filter syntax.

How does Robin compare to paid AI review tools? Robin is self-hosted, BYOK, and free. Paid tools like CodeRabbit offer additional features such as persistent learning and dashboard analytics. The comparison page covers the tradeoffs in detail if you’re evaluating options.

---

Next Steps

With Robin installed and the three secrets set, every new pull request in your repository gets an AI-generated first-pass review automatically. The setup takes under five minutes and costs nothing if you use OpenRouter’s free models.

In our experience maintaining Robin, the teams that get the most from it install it once on a single active repository, watch a week of real reviews on their own PRs, and only then roll it out more widely. The five-minute install is the easy part; the value comes from tuning the model and the file filters to your codebase’s actual noise profile before you scale it.

From here, the most useful next step is reading through the full configuration reference. The Robin docs cover optional settings like review tone, file-type filters, and the safe fork-PR pattern using pull_request_target. Start there to tune Robin for your team’s workflow.