从 0 到 1 搭建 AI 代码审查工具：基于 GPT-4.5+GitHub API 实战教程

# 1. 创建项目目录
mkdir ai-code-reviewer && cd ai-code-reviewer
python -m venv venv
source venv/bin/activate  # Linux/macOS
# venv\Scripts\activate   # Windows

# 2. 安装核心依赖
pip install fastapi uvicorn httpx openai python-dotenv

# .env 文件示例
OPENAI_API_KEY=sk-your-secret-key-here
GITHUB_APP_ID=123456
GITHUB_APP_PRIVATE_KEY_PATH="./private-key.pem"
GITHUB_WEBHOOK_SECRET=your-webhook-secret-here

# config.py
from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    openai_api_key: str
    github_app_id: str
    github_app_private_key_path: str
    github_webhook_secret: str

    class Config:
        env_file = ".env"

settings = Settings()

# prompts.py
def build_code_review_prompt(diff_text: str, file_ext: str, pr_context: str = "") -> list:
    """
    构建发送给 OpenAI 的消息列表。
    """
    system_message = f"""你是一位资深{_get_language_name(file_ext)}开发专家，正在严格审查代码变更。请专注于：
    1. **代码缺陷与错误**：逻辑错误、边界条件、潜在崩溃、资源泄露。
    2. **安全风险**：注入漏洞、敏感信息泄露、不安全的函数调用。
    3. **代码质量**：重复代码、过高的复杂度、糟糕的命名、违反 SOLID/DRY 原则。
    4. **最佳实践**：语言或框架特有的最佳实践，性能优化点。

    请以专业、清晰、建设性的语气回答。按以下格式组织回复：

    ## 🎯 总结
    （总体评价，高风险问题数量）

    ## ⚠️ 关键问题（需修复）
    - **文件:行号** 问题描述...
      建议修复方案...

    ## 💡 改进建议
    - 建议描述...
      理由与优化方案...

    ## 📚 最佳实践提示
    - 相关建议...
    """
    
    user_message = f"""
    请审查以下代码变更：

    **Pull Request 上下文**：
    {pr_context}

    **代码差异 (Diff)**：
    ```
    {diff_text}
    ```
    """
    
    return [
        {"role": "system", "content": system_message},
        {"role": "user", "content": user_message}
    ]

# openai_client.py
import openai
from tenacity import retry, stop_after_attempt, wait_exponential

class OpenAICodeReviewer:
    def __init__(self, api_key: str, model: str = "gpt-4-turbo-preview"):
        self.client = openai.OpenAI(api_key=api_key)
        self.model = model

    @retry(stop=stop_after_attempt(3), wait=wait_exponential(multiplier=1, min=2, max=10))
    async def review_code_diff(self, diff_text: str, file_ext: str, pr_context: str) -> str:
        """发送代码Diff进行审查，并返回AI的文本回复。"""
        messages = build_code_review_prompt(diff_text, file_ext, pr_context)
        
        try:
            response = await self.client.chat.completions.create(
                model=self.model,
                messages=messages,
                temperature=0.2,  # 较低的温度使输出更稳定、专注
                max_tokens=2000,
            )
            return response.choices[0].message.content
        except openai.APIError as e:
            # 处理API错误，如超时、限额
            logging.error(f"OpenAI API error: {e}")
            return f"## ⚠️ 审查服务暂时不可用\nAPI错误: {e.status_code}"

# main.py
from fastapi import FastAPI, Request, HTTPException, Header, BackgroundTasks
import hmac
import hashlib
import json

app = FastAPI()

async def verify_webhook_signature(payload_body: bytes, signature: str, secret: str) -> bool:
    """验证 GitHub Webhook 签名"""
    expected_signature = hmac.new(
        secret.encode(),
        payload_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected_signature}", signature)

@app.post("/webhook")
async def handle_webhook(
    request: Request,
    background_tasks: BackgroundTasks,
    x_hub_signature_256: str = Header(None),
):
    # 1. 验证签名
    body = await request.body()
    if not verify_webhook_signature(body, x_hub_signature_256, settings.github_webhook_secret):
        raise HTTPException(status_code=403, detail="Invalid signature")
    
    # 2. 解析事件
    event_type = request.headers.get("X-GitHub-Event")
    payload = json.loads(body)
    
    # 3. 只处理 PR 相关事件
    if event_type == "pull_request" and payload["action"] in ["opened", "synchronize"]:
        background_tasks.add_task(process_pull_request, payload)
        return {"message": "Review task started"}
    
    return {"message": "Event received, no action taken"}

# review_processor.py
import logging
from github_client import GitHubAppClient
from openai_client import OpenAICodeReviewer

async def process_pull_request(payload: dict):
    """处理 PR 审查的完整流程"""
    pr_info = payload["pull_request"]
    repo_full_name = payload["repository"]["full_name"]
    pr_number = pr_info["number"]
    
    # 1. 初始化客户端
    github_client = GitHubAppClient(
        app_id=settings.github_app_id,
        private_key_path=settings.github_app_private_key_path,
        repo_full_name=repo_full_name
    )
    ai_reviewer = OpenAICodeReviewer(api_key=settings.openai_api_key)
    
    try:
        # 2. 获取 PR 的差异文件
        diff_files = await github_client.get_pr_diff(repo_full_name, pr_number)
        
        # 3. 为每个变更文件生成审查评论
        for file in diff_files:
            if _should_review_file(file.filename):  # 过滤非源码文件
                review_comment = await ai_reviewer.review_code_diff(
                    diff_text=file.patch,
                    file_ext=file.filename.split('.')[-1],
                    pr_context=pr_info["title"] + "\n" + (pr_info["body"] or "")
                )
                # 4. 将评论发布到 GitHub PR
                await github_client.create_review_comment(
                    repo_full_name,
                    pr_number,
                    review_comment,
                    commit_id=pr_info["head"]["sha"],
                    path=file.filename,
                    position=1  # 简化处理，实际应根据 diff hunks 计算
                )
        logging.info(f"Review completed for {repo_full_name}#{pr_number}")
    except Exception as e:
        logging.exception(f"Failed to process PR {repo_full_name}#{pr_number}: {e}")
        # 可向 PR 发布一条错误提示

# Dockerfile
FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

docker run -d \
  --name code-reviewer \
  -p 8000:8000 \
  --env-file .env \
  ai-code-reviewer

# .github/workflows/ai-review.yml
name: AI Code Review
on: [pull_request]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run AI Code Reviewer
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python -m review_processor \
            --repo ${{ github.repository }} \
            --pr ${{ github.event.pull_request.number }}