Free AI Code Review on Every PR via GitHub Actions

· Tutorials

Automate AI code review on every PR with GitHub Actions and OpenRouter\’s free models. One API key, no per-token cost, just a YAML file and a secret.

Last updated: July 10, 2026 · 5-minute read

I added AI code review to every pull request using a single GitHub Actions workflow. It costs $0 for low volume, but you do need a free OpenRouter account. Setup took about ten minutes. Here is the version that actually works.

Step 1: Get a Free OpenRouter Key

Go to openrouter.ai/keys and create an account. Copy the key that starts with sk-or-v1-... — free models work with $0 balance. No card needed.

Step 2: Add It to GitHub

Repo → Settings → Secrets and variables → Actions → New repository secret.

Name: OPENROUTERAPIKEY Value: your key

Step 3: Create the Workflow

Create a file at .github/workflows/ai-review.yml in your repository:

jobs: review: runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps: - uses: actions/checkout@v4 with: fetch-depth: 0

  • name: Get diff
  • name: AI Review

RESPONSE=$(curl -s https://openrouter.ai/api/v1/chat/completions \ -H "Authorization: Bearer $OPENROUTERAPIKEY" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg diff "$DIFF" '{ model: "meta-llama/llama-4-maverick:free", messages: [{ role: "user", content: "Review this code diff. List issues as: [SEVERITY] file:line - description. Severities: ERROR, WARNING, SUGGESTION. Be concise.\n\n" + $diff }] }')")

COMMENT=$(echo "$RESPONSE" | jq -r '.choices[0].message.content // "AI review failed - check API key"')

gh pr comment \${{ github.event.pullrequest.number }} \ --body "## AI Code Review (Llama 4 Maverick)\n\n$COMMENT"

The Authorization: Bearer header is required — without it, OpenRouter returns 401. The head -c 8000 truncation keeps the diff within the free model's context window. The jq fallback (// "AI review failed") means the PR comment is useful even if the API call fails.

The Cost (Actually)

OpenRouter's free tier in 2026 works like this:

  • No credits on file: 50 requests/day, 20 requests/minute
  • With $10+ in credits (one-time): 1,000 requests/day, 20 requests/minute

The $10 does not get spent on free models — it just unlocks the higher request quota. My repos average 3-5 PRs per day, so the free tier is enough.

GitHub Actions minutes: roughly 30 seconds per PR review on ubuntu-latest. Free accounts get 2,000 minutes/month, which is roughly 4,000 reviews before GitHub charges anything.

What It Actually Catches (My Experience on 47 PRs)

  • Logic errors (41%): Off-by-one errors, inverted conditionals, wrong comparison operators. The model is good at pattern matching these.
  • Missing error handling (28%): Unhandled promise rejections, null checks, catch blocks that swallow errors silently.
  • Security (19%): Hardcoded secrets, obvious SQL injection patterns. It flagged two environment variable names I accidentally left in a commit message.
  • Style and performance (12%): Unused imports, React re-renders, inefficient array operations.

This is anecdotal data from my repos, not a controlled benchmark. The model (Llama 4 Maverick) is a generalist — it spots patterns well but does not understand your architecture.

What It Misses

  • Business logic: It flagged a deliberate loose type assertion as a bug when it was an intentional escape hatch for legacy data.
  • Large multi-file refactors: The diff gets truncated and the review turns generic.
  • Context beyond the diff: It does not know your project structure, conventions, or why certain patterns exist.

When This Is Worth It

For solo developers and small teams, this is a net positive as a first-pass reviewer. For open source projects, it gives contributors fast feedback without waiting for a maintainer. Do not use it as your only review — and do not send huge diffs or secrets through the API, since the request goes to OpenRouter's servers.

For the open source PR guide that complements this setup, check out the full walkthrough. Browse the lab to see the repos where this runs, or head to the blog for more automation tutorials.

---

Not affiliated with OpenRouter, Meta, or GitHub. Free tier limits subject to change. Tested with GitHub Actions and OpenRouter in July 2026.