AI Assisted Code Reviews - Augmenting Pull Requests in .NET Projects

public class GitHubPrClient(HttpClient http)
{
    // Returns the raw unified diff for a pull request
    public async Task<string> GetPullRequestDiffAsync(
        string owner, string repo, int prNumber)
    {
        // GitHub returns a diff when you request this Accept header
        http.DefaultRequestHeaders.Add("Accept", "application/vnd.github.v3.diff");

        var response = await http.GetAsync(
            $"https://api.github.com/repos/{owner}/{repo}/pulls/{prNumber}");

        response.EnsureSuccessStatusCode();
        return await response.Content.ReadAsStringAsync();
    }

    // Posts a top-level review comment on the PR
    public async Task PostReviewCommentAsync(
        string owner, string repo, int prNumber, string body)
    {
        var payload = JsonSerializer.Serialize(new
        {
            body,
            event = "COMMENT"   // COMMENT = non-blocking; APPROVE / REQUEST_CHANGES block the PR
        });

        var response = await http.PostAsync(
            $"https://api.github.com/repos/{owner}/{repo}/pulls/{prNumber}/reviews",
            new StringContent(payload, Encoding.UTF8, "application/json"));

        response.EnsureSuccessStatusCode();
    }
}

builder.Services.AddHttpClient<GitHubPrClient>(client =>
{
    client.DefaultRequestHeaders.Add("User-Agent", "NimblePros-PR-Bot");
    client.DefaultRequestHeaders.Authorization =
        new AuthenticationHeaderValue("Bearer",
            builder.Configuration["GitHub:Token"]);
});

public class PullRequestReviewService(
    GitHubPrClient github,
    IChatService chat,
    ILogger<PullRequestReviewService> logger)
{
    public async Task ReviewPullRequestAsync(
        string owner, string repo, int prNumber)
    {
        logger.LogInformation("Fetching diff for PR #{PrNumber}", prNumber);
        var diff = await github.GetPullRequestDiffAsync(owner, repo, prNumber);

        if (string.IsNullOrWhiteSpace(diff))
        {
            logger.LogWarning("PR #{PrNumber} has no diff — skipping", prNumber);
            return;
        }

        // Truncate very large diffs to avoid token limit issues
        const int maxDiffLength = 12_000;
        if (diff.Length > maxDiffLength)
        {
            diff = diff[..maxDiffLength] + "\n\n[diff truncated — only first 12,000 characters reviewed]";
            logger.LogWarning("Diff truncated for PR #{PrNumber}", prNumber);
        }

        var prompt = BuildReviewPrompt(diff);
        var review = await chat.GetCompletionAsync(prompt);

        var comment = $"## AI Code Review\n\n> ⚠️ This is an automated review. " +
                      $"Human review is still required before merging.\n\n{review}";

        await github.PostReviewCommentAsync(owner, repo, prNumber, comment);
        logger.LogInformation("Review posted for PR #{PrNumber}", prNumber);
    }

    private static string BuildReviewPrompt(string diff) => $"""
        You are a .NET code reviewer. Review the following pull request diff and provide 
        concise, actionable feedback.

        Focus on:
        - Correctness: null reference risks, unhandled exceptions, async/await misuse
        - Security: input validation, sensitive data exposure, injection risks
        - .NET conventions: naming, SOLID principles, proper use of DI
        - Performance: unnecessary allocations, N+1 patterns, missing cancellation tokens

        Do NOT comment on:
        - Code you cannot see (missing context from other files)
        - Stylistic preferences with no correctness impact
        - Things that are already handled by Roslyn analyzers or StyleCop

        Format your response as a markdown list grouped by category.
        If you find no issues in a category, omit that category entirely.
        If the diff looks good overall, say so briefly.

        DIFF:
        {diff}
        """;
}

app.MapPost("/webhook/github", async (
    HttpRequest request,
    PullRequestReviewService reviewer,
    IConfiguration config) =>
{
    // Validate the webhook signature (never skip this in production)
    if (!await IsValidGitHubSignature(request, config["GitHub:WebhookSecret"]!))
        return Results.Unauthorized();

    using var reader = new StreamReader(request.Body);
    var body = await reader.ReadToEndAsync();
    var payload = JsonDocument.Parse(body).RootElement;

    var action = payload.GetProperty("action").GetString();
    if (action is not ("opened" or "synchronize"))
        return Results.Ok("Ignored");  // Only review on new/updated PRs

    var owner = payload
        .GetProperty("repository").GetProperty("owner").GetProperty("login").GetString()!;
    var repo = payload
        .GetProperty("repository").GetProperty("name").GetString()!;
    var prNumber = payload
        .GetProperty("number").GetInt32();

    // Fire and forget — webhook must return quickly or GitHub retries
    _ = reviewer.ReviewPullRequestAsync(owner, repo, prNumber);

    return Results.Accepted();
});

static async Task<bool> IsValidGitHubSignature(HttpRequest request, string secret)
{
    request.Headers.TryGetValue("X-Hub-Signature-256", out var signature);
    if (string.IsNullOrEmpty(signature)) return false;

    request.EnableBuffering();
    var body = await new StreamReader(request.Body).ReadToEndAsync();
    request.Body.Position = 0;

    var key = Encoding.UTF8.GetBytes(secret);
    var hash = HMACSHA256.HashData(key, Encoding.UTF8.GetBytes(body));
    var expected = "sha256=" + Convert.ToHexString(hash).ToLowerInvariant();

    return CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expected),
        Encoding.UTF8.GetBytes(signature!));
}

public class PullRequestReviewServiceTests
{
    [Fact]
    public async Task ReviewPullRequest_PostsFormattedComment()
    {
        var github = Substitute.For<GitHubPrClient>();
        var chat = Substitute.For<IChatService>();

        github.GetPullRequestDiffAsync("org", "repo", 42)
              .Returns("+ var x = null;\n+ x.ToString();");

        chat.GetCompletionAsync(Arg.Any<string>())
            .Returns("**Correctness**\n- Potential null reference on line 2");

        var sut = new PullRequestReviewService(github, chat, NullLogger<PullRequestReviewService>.Instance);
        await sut.ReviewPullRequestAsync("org", "repo", 42);

        await github.Received(1).PostReviewCommentAsync(
            "org", "repo", 42,
            Arg.Is<string>(s =>
                s.Contains("AI Code Review") &&
                s.Contains("automated review") &&
                s.Contains("Correctness")));
    }

    [Fact]
    public async Task ReviewPullRequest_TruncatesLargeDiffs()
    {
        var github = Substitute.For<GitHubPrClient>();
        var chat = Substitute.For<IChatService>();

        github.GetPullRequestDiffAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<int>())
              .Returns(new string('+', 20_000));  // Massive diff

        chat.GetCompletionAsync(Arg.Any<string>()).Returns("Looks fine.");

        var sut = new PullRequestReviewService(github, chat, NullLogger<PullRequestReviewService>.Instance);
        await sut.ReviewPullRequestAsync("org", "repo", 1);

        await chat.Received(1).GetCompletionAsync(
            Arg.Is<string>(s => s.Contains("diff truncated")));
    }
}

Review this code and tell me if there are any problems.

You are reviewing a C# pull request for an ASP.NET Core 8 web API.

The codebase uses:
- Minimal APIs with vertical slice architecture
- EF Core 8 with SQL Server
- MediatR for command/query handling
- xUnit + NSubstitute for testing

Review the diff below. Focus only on:
1. Correctness — null risks, unhandled exceptions, broken async patterns
2. Security — input that reaches the database or HTTP response without validation
3. Missing test coverage — new public methods or branches with no corresponding test

Do NOT flag:
- Formatting or whitespace
- Naming style (we use a StyleCop ruleset for that)
- Anything you can't see in the diff (no guessing about other files)
 
Return a markdown list grouped by the three categories above.
If a category has no issues, omit it.
If the diff looks good overall, say so in one sentence.

You are a senior .NET developer reviewing a pull request specifically for async/await correctness.

Flag any of the following in the diff:
- async void methods (except event handlers — those are acceptable)
- Calls to .Result or .GetAwaiter().GetResult() that could deadlock
- Missing CancellationToken parameters on async methods that accept I/O
- Tasks that are created but not awaited
- ConfigureAwait(false) missing in library code (not application code)

For each issue found:
- Quote the relevant line(s) from the diff
- Explain the specific risk
- Suggest the corrected code

If none of the above are present, respond with: "No async issues found."

private const string SystemPrompt = """
    You are a .NET code reviewer working on a team that values:
    - Explicit over implicit (prefer clarity over cleverness)
    - Failing fast (validate inputs early, throw meaningful exceptions)
    - Testability (code should be injectable and mockable)

    Your tone is direct and collegial — like a peer, not a gatekeeper.
    You acknowledge good decisions as well as flagging problems.
    You never suggest changes outside the scope of the diff.
    """;

private static string BuildDiffPrompt(string diff) => $"""
    Review this pull request diff. Apply the standards from your system instructions.

    Return your feedback as:
    ## Summary
    One sentence overall assessment.

    ## Issues
    Bulleted list of specific problems with line references. Omit if none.

    ## Suggestions
    Optional improvements that aren't blocking. Omit if none.

    DIFF:
    {diff}
    """;

This is a DRAFT pull request — the author has flagged it as a work in progress.

Do not flag:
- TODOs or placeholder comments (these are expected)
- Missing tests (test coverage comes later)
- Incomplete error handling

DO flag:
- Architectural decisions that will be hard to change later
- Data model choices that look problematic at this stage
- Any security concerns that need to be designed in from the start, not bolted on later

Keep feedback high-level and directional. 
The goal is early course correction, not a full review.