AI code review: Claude Code reviews every pull request, read-only
On this page
Working alone on a project also means working without a reviewer: nobody to ask the awkward question before a pull request gets merged. I gave that role to an AI agent, Claude Code, making sure it gets exactly the rights it needs, and not one more.
Context
I am the only developer of the admin console of an education platform that handles data about minor students. Every change goes through a pull request on GitHub.
But a pull request without a reviewer is a half-empty validation step: automated tests check what you thought of checking, not the rest.
The problem
To review code, an AI agent needs to read the repository. Giving it anything more would be a mistake:
- with write access, an agent can change the code, push a commit or tamper with the configuration;
- in a shared environment, it can reach secrets that are none of its business;
- and the content of a pull request is not necessarily trustworthy: malicious text slipped into the code can try to hijack the agent (prompt injection).
The goal: a systematic second pair of eyes, without opening a new door.
The solution
A review on every pull request
On every pull request, a GitHub Actions workflow runs Claude Code in an isolated container. The agent analyzes the changes in the context of the rest of the code, then posts its remarks as comments on the pull request.
The principle of least privilege
The agent is treated like an outside contributor whose work you do not know yet:
- read-only: it can read the code and the pull request, but can neither change files nor push commits;
- isolated container: each review runs in its own environment, which shares nothing with the rest;
- a single output: its review comments.
The decision to merge remains mine: the agent flags, I decide.
Results
- Every pull request gets a review before it is merged, even with no colleague available.
- Feedback where I already work, right in the pull request.
- No write access granted: the agent cannot change anything in the repository.
Takeaways
- An AI agent is a contributor like any other: its rights are granted case by case, never by default.
- AI does not replace human review, it makes review possible when no one is available. It asks questions; answering them is my job.
- The security of your tooling matters as much as the security of your product. An overly permissive CI is a way in like any other.