Using OpenCode in CI/CD for AI pull request reviews
a day ago
- OpenCode is an open-source CLI tool used in CI/CD pipelines to perform AI code reviews without granting third-party access to repositories.
- It addresses security concerns of existing AI code review SaaS tools by eliminating the need for OAuth or persistent third-party access to code repositories.
- The setup works with any YAML-based CI/CD system (e.g., GitHub Actions, GitLab CI, Bitbucket Pipelines) and involves cloning the repo, installing OpenCode, and running a prompt to analyze diffs.
- The AI review process uses a conservative prompt that focuses on critical issues (e.g., performance, security, validation) and avoids false positives by verifying concerns through code reading.
- Economics are favorable: OpenCode works with existing ChatGPT subscriptions (Plus/Pro/Business) at no extra cost, unlike per-seat or per-PR pricing from dedicated code review tools.
- OpenCode is provider-agnostic, allowing easy switching between AI models (e.g., from OpenAI to Minimax) without changing the pipeline configuration.
- Beyond PR reviews, OpenCode can be integrated into a Slack bot for on-demand code queries, enabling teams to ask questions about the codebase without opening an IDE.
- Users maintain control over their code as it only passes through their CI/CD runners, though code is sent to the AI provider for inference unless a local model is used for air-gapped setups.
- Future improvements include automated resolution of PR comments, specialized agents for tasks like UX auditing, and better handling of OpenAI key expiration via secrets management.