AI PR Reviewer (free-pr-reviewer)

Automated pull request code review that costs $0 to run, powered by
your own LLM key — OpenRouter, Google Gemini, or Anthropic Claude. Every
review runs entirely on GitHub Actions, inside the repository being
reviewed. There is no shared backend doing the actual review work, no
third-party server reading your code, and — if you pick OpenRouter — no
LLM bill either, because OpenRouter publishes a rotating catalog of
genuinely free (:free, $0-per-token) models that this app talks to
directly on your behalf.

That's the whole pitch: install the App, paste a free OpenRouter API key
(creating an OpenRouter account and key takes under a minute and requires no
credit card), and every pull request you open from then on gets a real,
structured code review — bugs, security issues, performance problems,
readability nits, one-click fix suggestions — for the price of exactly
nothing. No subscription, no seat licensing, no "free tier that quietly
throttles you after 10 PRs." If OpenRouter's free pool for your chosen model
is rate-limited at the moment your PR opens (it happens — free compute is
popular), the built-in auto-fallback feature just tries the next free
model down the list until one answers, so the review still shows up without
you lifting a finger or spending a cent.

The only piece hosted outside your repo is a small, single-purpose service
that (a) helps you set up the review workflow through a web dashboard instead
of hand-editing YAML, and (b) issues short-lived tokens so reviews are posted
under this App's identity rather than the generic github-actions[bot]. It
never sees your source code and never stores your API key — your key is
pushed straight into GitHub's own encrypted Actions secrets during setup.

What it reviews

• Functionality & correctness — bugs, logic errors, edge cases, missing
  error handling, regressions.
• Security — SQL injection, XSS, CSRF, command injection, hardcoded
  secrets, unsafe dependency usage.
• Performance — algorithmic complexity, N+1 queries, blocking I/O.
• Readability & maintainability — unclear naming, functions doing too
  much, duplicated logic.
• Testing — missing coverage for new behavior or error paths.
• Overall PR quality — scope creep, unclear intent.

Findings are labeled by severity (Blocker / Important / Nit) so
you know what actually has to be fixed before merging versus what's a nice-to-have.

Features

• Bring your own key — OpenRouter, Gemini, or Anthropic. Apply one model
  across several repos at once, or give each repo its own provider and model.
• Live free-model picker — when using OpenRouter, the dashboard shows its
  current list of $0 models fetched fresh on every page load, not a
  hardcoded list that goes stale as free models rotate.
• Auto-fallback — if the chosen free model is rate-limited or the
  provider has an outage, the Action automatically retries with other free
  models until one succeeds, instead of failing the whole review.
• One-click suggestions — where a fix is a simple substitution, the
  review includes GitHub's native suggestion block (the same "Apply
  suggestion" button you'd see from a human reviewer), not just prose telling
  you what to change.
• Posts as the App — reviews are authored by this App's identity via a
  verified, short-lived token exchange, not the generic Actions bot.
• Large-PR aware — big diffs get a truncated, architecture-focused review
  instead of a slow pass that runs out of context or takes forever.
• Search + per-repo or bulk setup — the dashboard lets you search across
  every repo the installation covers and either configure many at once with
  the same settings, or hand-pick one repo for a different model.
• Review stats table — every review ends with a summary table showing
  exactly which model answered (and every free model that was tried and
  skipped first, if fallback kicked in), how long the whole thing took, and
  a breakdown of blockers/important/nits/inline comments found — so you can
  see at a glance whether that review came from your primary model or a
  fallback, and how much time it cost your CI run.

Why "free" isn't a gimmick here

Most "free tier" AI tools mean free-for-a-while, free-with-a-catch, or free
until you have a real repo. This one is structurally different: the app
itself never calls an LLM with money attached to it. Every single API call
goes out from your own GitHub Actions runner, using your own key, straight to
your chosen provider. When that provider is OpenRouter and the model is one
of its :free entries, there is no metering, no invoice, and no plan to
upgrade out of — it is $0 per token, forever, for as long as OpenRouter keeps
offering that model for free (and there are consistently a dozen-plus decent
free models available at any given time, refreshed automatically by the
dashboard's live picker rather than a list someone forgot to update). Point
this app at ten repos, a hundred PRs a day, whatever — the review pipeline
itself does not care and does not bill you, because there is nothing to
bill: the compute is GitHub's (free Actions minutes on public repos, and
minutes you likely already have on private ones), and the inference is
OpenRouter's free pool.

How to reach the dashboard

1. Install the App on your account/organization (or open its existing
   installation from github.com/settings/installations).
2. GitHub redirects you to the Setup URL, which signs you in and takes
   you straight to the configuration dashboard — no separate login step.
3. Pick "Same model for all" to apply one provider/model/key to several
   repos at once, or "One repo at a time" to search for and configure a
   single repo independently.
4. Paste your API key and save. The dashboard commits a review workflow file
   to each selected repo and pushes your key as an encrypted repo secret —
   nothing is stored on our side.
5. Open a pull request in a configured repo and the review appears
   automatically within a minute or two (free-tier LLM models can be
   slower under load).

Support / found a bug?

This is an early, actively-developed project — if something breaks or looks
wrong, please email huseyinceniik@gmail.com with:

• The repo/PR where it happened (or a description if private)
• What you expected vs. what happened
• Any error text shown in the dashboard or in the Action's log

Privacy

• Your LLM API key is encrypted client-side (sealed box) before it ever
  leaves the dashboard and is stored only as an encrypted GitHub Actions
  secret on your own repo — never on our infrastructure.
• The token-minting service never reads your source code; it only verifies
  a signed proof that a specific workflow run belongs to a specific repo,
  then issues a scoped, short-lived token for that repo.
• Review content (the diff, the LLM's response) is sent directly from your
  own GitHub Actions runner to your chosen LLM provider — it does not pass
  through our infrastructure at all.