Claude Code Automated Pull Request Review Workflow Guide

Pull request reviews are a critical part of maintaining code quality, but they can also be time-consuming and repetitive. Automating parts of the review process with Claude Code skills can significantly reduce manual effort while ensuring consistent quality standards. This guide shows you how to build and deploy an automated PR review skill — a reusable, always-on workflow that handles linting, security scanning, and generates formatted feedback without requiring a developer to be present.

Note: If you are looking for how to use the claude CLI interactively to assist your own review sessions, see Claude Code for Pull Request Review Workflow Guide.

Why Automate PR Reviews?

Manual PR reviews consume significant developer time, especially for repetitive issues like formatting, import ordering, or common security vulnerabilities. An automated workflow addresses these challenges by:

Catching issues early before human reviewers see them
Providing instant feedback to developers
Freeing reviewers to focus on logic, architecture, and design
Enforcing consistency across the codebase

Claude Code skills can orchestrate these checks, aggregate results, and format feedback in a way that integrates smoothly with your existing workflow.

Setting Up Your PR Review Skill

Create a new skill for automated PR reviews. This skill will handle the entire review process from detecting new PRs to posting comments.

---
name: pr-reviewer
description: Automated pull request review workflow
---

# Automated Pull Request Reviewer

This skill automatically reviews pull requests for common issues.

The skill declares the tools it needs: bash for running linters and scanners, read_file for examining code, and write_file for generating review output.

Running Code Quality Checks

The core of automated review is running static analysis tools. Here’s how to structure these checks:

# Run multiple linters in parallel
echo "Running code quality checks..."

# JavaScript/TypeScript
if [ -f "package.json" ]; then
  npx eslint --format stylish . 2>&1 || true
fi

# Python
if [ -f "requirements.txt" ] || [ -f "pyproject.toml" ]; then
  python -m flake8 . --max-line-length=100 2>&1 || true
fi

# General
npx prettier --check "**/*.{js,ts,json,md}" 2>&1 || true

Store this as a script your skill can invoke. The || true ensures one failed check doesn’t stop the entire review process.

Implementing Security Scanning

Security vulnerabilities deserve special attention in automated reviews. Integrate SAST tools to catch common issues:

# Run security scans
echo "=== Security Scan Results ==="

# npm audit for JavaScript dependencies
if [ -f "package-lock.json" ]; then
  npm audit --json | jq -r '.vulnerabilities | to_entries[] | 
    "\(.key): \(.value.modules | length) affected modules"' 2>&1
fi

# Bandit for Python
if command -v bandit &> /dev/null; then
  bandit -r . -f json 2>&1 | jq -r '.results[] | 
    "\(.issue_text) (Severity: \(.issue_severity))"' || true
fi

The skill parses output from these tools and transforms it into actionable feedback.

Generating Review Comments

Once checks complete, aggregate results into a structured review:

#!/usr/bin/env python3
"""Generate PR review summary from check results."""

import json
import sys
from pathlib import Path

def parse_eslint_results(output):
    """Parse ESLint JSON output into review comments."""
    if not output.strip():
        return []
    
    try:
        data = json.loads(output)
        return [f"ESLint: {msg['message']} at {msg['filePath']}:{msg['line']}"
                for msg in data]
    except (json.JSONDecodeError, KeyError):
        return ["ESLint: Issues found (output not parseable)"]

def generate_review_summary(checks):
    """Generate human-readable review summary."""
    sections = ["## Automated Review Summary\n"]
    
    for check_name, result in checks.items():
        sections.append(f"### {check_name}\n")
        if result['issues']:
            sections.append("**Issues Found:**\n")
            for issue in result['issues']:
                sections.append(f"- {issue}\n")
        else:
            sections.append("✅ No issues found\n")
        sections.append("\n")
    
    return "".join(sections)

if __name__ == "__main__":
    # Read accumulated results
    results = json.loads(sys.argv[1] if sys.argv else "{}")
    summary = generate_review_summary(results)
    print(summary)

This script takes JSON input from your various checks and produces a formatted markdown review.

Integrating with GitHub

To post automated reviews to GitHub, use the GitHub CLI or API:

# Post review comments via GitHub CLI
gh pr comment $PR_NUMBER --body-file review-summary.md

# Or create a formal review
gh pr review $PR_NUMBER \
  --body "Automated review found 3 issues" \
  --request-changes \
  --title "Automated Code Review"

For more sophisticated integration, create a GitHub App with appropriate permissions to post reviews directly.

Complete Workflow Example

Here’s how all pieces fit together in a cohesive workflow:

---
name: full-pr-review
description: Complete PR review automation
---

# Full PR Review Workflow

## Trigger
This skill runs on PR open and sync events.

## Process

1. **Detect Changed Files**
   Use GitHub API or local git to identify what changed:
   ```bash
   git diff --name-only $BASE_BRANCH...$HEAD_BRANCH

Run Category-Specific Checks
- Linting (ESLint, flake8, go vet)
- Formatting (Prettier, Black, gofmt)
- Type checking (TypeScript, mypy)
- Security (npm audit, Bandit, Gosec)
- Tests (unit test execution)
Generate Summary Aggregate all results using the review generator.
Post Results Comment on PR with formatted results.
Fail on Critical Issues For security vulnerabilities, consider setting PR status to failed. ```

Best Practices for PR Review Automation

Start small and iterate. Begin with formatting and linting checks, then gradually add security scans and more complex analysis. This approach lets you tune false positive rates before overwhelming reviewers.

Use appropriate severity levels. Not all issues warrant blocking a PR. Use “request changes” for critical bugs or security issues, but post comments for style and minor improvements.

Maintain the human element. Automated reviews supplement, not replace, human code review. Focus automation on objective, mechanical issues, leaving subjective and architectural decisions to human reviewers.

Keep skills focused. Rather than one monolithic review skill, consider separate skills for different check types. This makes maintenance easier and lets teams customize their workflow.

Monitor and tune. Track false positive rates and developer feedback. Regularly update your check configurations to reduce noise and improve signal.

Conclusion

Automated PR review workflows powered by Claude Code skills transform how teams handle code quality. By catching issues early, providing instant feedback, and enforcing consistent standards, you free developers to focus on what matters most: building great software. Start with simple linting checks, gradually add more sophisticated analysis, and watch your code quality improve while review cycles shorten.

The investment in setting up these workflows pays dividends in reduced review time, fewer regressions, and more consistent code across your project.

Built by theluckystrike — More at zovo.one