AI-Assisted Code Review in 2026: GitHub Copilot, Claude, Custom Linting, and Pair Programming

AI code review tools have matured significantly. GitHub Copilot's code review feature leaves inline PR comments. Claude can analyze entire PR diffs with context from your codebase. Custom ESLint rules enforce team-specific conventions that no off-the-shelf linter knows about. Used well, AI handles the mechanical review work — security anti-patterns, missing error handling, style violations — so human reviewers focus on architecture, business logic, and knowledge transfer.

Used poorly, AI code review creates noise that engineers learn to ignore and slows down shipping. This post covers the patterns that add signal, not noise.

---

The Right Division of Labor

Key principle: AI reviews complement human reviews; they don't replace the human understanding of why code exists.

---

GitHub Copilot Code Review

GitHub Copilot's code review integration (GitHub-native, 2026) leaves inline PR comments on:

• Potential bugs and logic errors
• Missing null checks and error handling
• Security anti-patterns (hardcoded secrets, SQL injection patterns)
• Inconsistency with patterns in the rest of the file

# .github/copilot-review.yml — Configure Copilot code review
version: 1

# Which paths to include / exclude
paths:
  include:
    - "src/**/*.ts"
    - "src/**/*.tsx"
  exclude:
    - "src/generated/**"
    - "**/*.test.ts"
    - "**/__mocks__/**"

# Focus areas for review comments
review:
  security: true         # Security anti-patterns
  performance: true      # Obvious performance issues
  correctness: true      # Logic bugs
  style: false           # Let Prettier/ESLint handle style
  documentation: false   # Don't comment on missing JSDoc

# Confidence threshold (0-1): only show comments above this confidence
min_confidence: 0.8

What Copilot Review Does Well

// ❌ Copilot catches: unchecked array access
function getFirstAdmin(users: User[]): string {
  return users.filter(u => u.role === 'admin')[0].email;
  // Copilot comment: "Potential runtime error if no admin users found.
  // Consider: users.filter(u => u.role === 'admin')[0]?.email ?? null"
}

// ❌ Copilot catches: missing await
async function deleteUser(id: string): Promise<void> {
  db.query('DELETE FROM users WHERE id = $1', [id]);  // Missing await
  // Copilot comment: "This query may not be awaited. Add 'await' to ensure
  // the deletion completes before the function returns."
}

// ❌ Copilot catches: loose equality
if (user.role == 'admin') {  // Should be ===
  // Copilot comment: "Use strict equality (===) instead of loose equality (==)"
}

---

Claude for PR Analysis via GitHub Actions

For deeper analysis — security architecture, data flow concerns, violation of team patterns — use Claude via the Anthropic API in a CI workflow:

// scripts/ai-pr-review.ts
import Anthropic from '@anthropic-ai/sdk';
import { execSync } from 'node:child_process';
import { Octokit } from '@octokit/rest';

const anthropic = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY! });
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN! });

async function reviewPR(
  owner: string,
  repo: string,
  prNumber: number,
): Promise<void> {
  // Get the PR diff
  const { data: diff } = await octokit.pulls.get({
    owner, repo, pull_number: prNumber,
    mediaType: { format: 'diff' },
  });

  // Get PR metadata
  const { data: pr } = await octokit.pulls.get({ owner, repo, pull_number: prNumber });

  // Review with Claude
  const response = await anthropic.messages.create({
    model: 'claude-sonnet-4-6',
    max_tokens: 2048,
    messages: [
      {
        role: 'user',
        content: `You are a senior software engineer reviewing a pull request.

PR Title: ${pr.title}
PR Description: ${pr.body ?? '(no description)'}

Review the following diff for:
1. Security issues (SQL injection, hardcoded secrets, missing auth checks)
2. Missing error handling in async code
3. Race conditions or incorrect async/await usage
4. Obvious performance issues
5. Breaking API contract changes

Be concise. Only flag genuine issues, not style preferences.
Format your response as a bulleted list of specific issues with the file and line number.
If there are no significant issues, say "No significant issues found."

Diff:
\`\`\`diff
${String(diff).slice(0, 8000)}  // Token limit guard
\`\`\``,
      },
    ],
  });

  const reviewComment = response.content[0].type === 'text'
    ? response.content[0].text
    : 'AI review unavailable';

  // Post as PR comment
  await octokit.issues.createComment({
    owner,
    repo,
    issue_number: prNumber,
    body: `## 🤖 AI Code Review\n\n${reviewComment}\n\n---\n*Automated review by Claude. Human review required before merge.*`,
  });
}

# .github/workflows/ai-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    # Only run on PRs from the same repo (not forks) to protect API keys
    if: github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '22' }
      - run: npm install @anthropic-ai/sdk @octokit/rest
      - name: Run AI review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx ts-node scripts/ai-pr-review.ts ${{ github.repository_owner }} ${{ github.event.repository.name }} ${{ github.event.pull_request.number }}

---

Custom ESLint Rules for Team Conventions

ESLint's custom rule API lets you enforce team patterns that no standard linter knows:

// eslint-plugins/rules/no-direct-db-in-route.ts
// Rule: database queries must go through service layer, not directly in API handlers
import type { Rule } from 'eslint';

const noDirect: Rule.RuleModule = {
  meta: {
    type: 'problem',
    docs: {
      description: 'Disallow direct DB queries in route handlers; use service layer',
    },
    messages: {
      noDirectDb: 'Direct DB queries in route handlers violate the service layer pattern. Use a service function instead.',
    },
  },
  create(context) {
    // Only enforce in api/routes directories
    const filename = context.getFilename();
    if (!filename.includes('/api/') && !filename.includes('/routes/')) {
      return {};
    }

    return {
      CallExpression(node) {
        // Flag: db.query(), db.execute(), pool.query()
        if (
          node.callee.type === 'MemberExpression' &&
          node.callee.property.type === 'Identifier' &&
          ['query', 'execute', 'transaction'].includes(node.callee.property.name) &&
          node.callee.object.type === 'Identifier' &&
          ['db', 'pool', 'database'].includes(node.callee.object.name)
        ) {
          context.report({ node, messageId: 'noDirectDb' });
        }
      },
    };
  },
};

export default noDirect;

// eslint-plugins/rules/require-await-on-db.ts
// Rule: all db.query() calls must be awaited
const requireAwait: Rule.RuleModule = {
  meta: {
    type: 'problem',
    fixable: 'code',
    docs: { description: 'Database query calls must be awaited' },
    messages: { missingAwait: 'Database query must be awaited to handle errors properly.' },
  },
  create(context) {
    return {
      CallExpression(node) {
        if (
          node.callee.type === 'MemberExpression' &&
          node.callee.property.type === 'Identifier' &&
          node.callee.property.name === 'query' &&
          node.callee.object.type === 'Identifier' &&
          node.callee.object.name === 'db'
        ) {
          const parent = node.parent;
          // Check if parent is an await expression
          if (parent?.type !== 'AwaitExpression') {
            context.report({
              node,
              messageId: 'missingAwait',
              fix(fixer) {
                return fixer.insertTextBefore(node, 'await ');
              },
            });
          }
        }
      },
    };
  },
};

// eslint.config.js — register custom rules
import { noDirect, requireAwait } from './eslint-plugins/index.js';

export default [
  {
    plugins: {
      'team-conventions': {
        rules: {
          'no-direct-db-in-route': noDirect,
          'require-await-on-db': requireAwait,
        },
      },
    },
    rules: {
      'team-conventions/no-direct-db-in-route': 'error',
      'team-conventions/require-await-on-db': 'warn',
    },
  },
];

---

AI Pair Programming: What Works

## Effective AI Pair Programming Patterns

### ✅ What AI is great at:
1. **Boilerplate generation**: "Write a Fastify route handler for PATCH /users/:id
   that validates with Zod, updates the DB, and returns the updated user"

2. **Test generation**: "Write Jest tests for this function including edge cases"

3. **Explaining unfamiliar code**: "Explain what this Postgres query does line by line"

4. **Refactoring for patterns**: "Refactor this to use the repository pattern"

5. **Debugging with context**: Paste error + code + "What's wrong here?"

### ❌ Where AI confidently fails:
1. **Business logic correctness**: AI doesn't know your domain; verify everything
2. **Security analysis**: Missing context about your threat model
3. **Performance at scale**: AI doesn't know your data distribution or load profile
4. **Cross-file dependencies**: Without full codebase context, AI misses interactions
5. **Testing edge cases for your domain**: AI generates generic tests, not domain-specific

### 🔑 The key habit:
Always review what AI generates before committing.
AI is a fast typist, not a senior engineer.

---

What Human Reviewers Should Focus On

When AI handles the mechanical review, humans should focus on:

## Human Review Checklist (Post-AI)

### Business logic
- [ ] Does this implementation match what the spec actually requires?
- [ ] Are there edge cases specific to our domain that aren't handled?
- [ ] Will this interact correctly with related systems?

### Architecture
- [ ] Does this fit the established patterns in the codebase?
- [ ] Are we creating accidental complexity?
- [ ] Will this be maintainable in 12 months?

### Knowledge transfer
- [ ] Would a new team member understand why this was done this way?
- [ ] Are the key decisions documented in comments or ADRs?
- [ ] Is this a pattern others should know about?

### Risk
- [ ] What breaks if this code has a bug in production?
- [ ] Is there a rollback path?
- [ ] Do we need a feature flag for this?

---

Working With Viprasol

We set up AI-assisted code review pipelines and custom linting for engineering teams — reducing review overhead while improving the quality of feedback.

What we deliver:

• GitHub Copilot code review configuration and tuning
• Claude-based PR analysis GitHub Actions workflow
• Custom ESLint rule development for your team conventions
• Code review process design (what AI handles vs human review)
• AI pair programming workflow and prompt engineering for your stack

→ Discuss your code review process → AI and machine learning services

---

See Also

• LLM Integration in Production Applications
• Developer Experience (DX) Metrics
• Testing Strategy for Engineering Teams
• CI/CD Pipeline Setup
• Technical Writing for Developers