How to Automate Code Review with LLMs: Practical Examples and Effective Prompts

Introduction: Why LLM-powered code review has become essential in 2026

Modern development teams face a unique challenge: balancing speed with complexity. Multimodal LLMs likeQwen3.8-Max

Choosing the right tools and workflows for 2026

The automated code review landscape has evolved dramatically. Traditional rule-based systems can no longer keep pace with the rapid tempo of modern development. Agent-based language models, coupled with advanced API orchestration, now deliver capabilities that were once science fiction:

• Source code defect detection(logic errors, memory leaks, type mismatches)
• Policy compliance checking(license adherence, coding standards, team guidelines)
• Refactoring and performance optimizationwith context-aware suggestions
• Seamless CI/CD integrationthrough webhooks and distributed agents

Practical implementation: Building an LLM-powered code review agent in GitHub Actions

Below is a complete, production-ready example of an LLM-based code review agent implemented as a GitHub Action. This agent runs automatically on every pull request, providing structured feedback and comments.

1. Custom action file:code-review.yml

name: LLM Code Review
on:
  pull_request:
    types: [opened, synchronize]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Configure Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install OpenAI client
        run: pip install openai==1.45.0
      - name: Run LLM code review
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          import openai, os, subprocess, json
          client = openai.OpenAI()
          pr = os.getenv('GITHUB_REF', '').split('/')[-1]
          repo = os.getenv('GITHUB_REPOSITORY')
          # Get changes
          diff = subprocess.check_output(['git', 'diff', 'origin/main...HEAD', '--no-ext-diff']).decode()
          prompt = f'''
          Examine the following code diff for pull request #{pr} of repository {repo}.
          1. List any bugs, security issues, or best practice violations.
          2. Provide concise corrective code examples.
          3. Assign an overall quality score from 1 to 10.
          Diff:
          {diff}
          '''
          response = client.chat.completions.create(
              model='gpt-4o',
              messages=[{'role': 'user', 'content': prompt}],
              temperature=0.2,
              max_tokens=1500
          )
          # Post comment to GitHub
          comment = response.choices[0].message.content
          subprocess.run(['gh', 'pr', 'comment', pr, '--body', comment], env={'GITHUB_TOKEN': os.getenv('GITHUB_TOKEN')})

2. Why this approach works in 2026

• Agent orchestration: This action leverages a lightweight agent that triggers LLMs only when necessary, minimizing latency and optimizing resource usage.
• Continuous assessment: Models like Qwen3.8-Max excel at analyzing large codebases, delivering consistent evaluations across multiple programming languages and frameworks.
• Policy enforcement

Prompt examples for common use cases

A well-crafted prompt is the cornerstone of effective code review. Here are three practical templates you can use right away.

1. Prompt for bug and security detection

Analyze the following code for:
- Logical errors (e.g., incorrect conditional logic, unhandled conditions)
- Security vulnerabilities (e.g., injection attacks, insecure credential handling, exposure of sensitive data)
- Performance issues (e.g., infinite loops, unoptimized operations)

Provide a bullet list with the exact location (file:line) for each issue and a concise suggestion for correction.

Code:
```python
{source_code}
```

2. Prompt for best practices compliance

Evaluate the code against our internal guidelines (PEP-8 for Python, spell-check, mandatory use of type hints, maximum cyclomatic complexity 10).
Return:
- Grades for each category (A-F)
- Specific recommendations to improve the grade

Guidelines:
{guidelines}

Code:
```{language}
{source_code}
```

3. Prompt for refactoring suggestions

Suggest a safe refactoring that improves readability while maintaining the same functionality.
Provide:
1. The refactored code in a separate code block
2. An explanation of the changes (why each change improves the outcome)

Original code:
```{language}
{source_code}
```

Setting up an end-to-end workflow in 2026

Relying solely on LLMs for every commit isn’t enough. Top-performing teams combine LLM-based code review with additional layers of oversight:

• Cascade reviews: The LLM identifies issues, a human reviewer approves or rejects them, and a second LLM applies any necessary changes.
• Continuous quality monitoring: Aggregated scores are logged in monitoring systems like Grafana + Prometheus to track trends over time.
• Active learning: Rejected reviews are added to a private training dataset, enabling local fine-tuning of the model with proprietary data.

These workflows leverageagent orchestration

Key takeaways

• Rapid integration: Using a CI action (GitHub Actions, GitLab CI, Bitbucket Pipelines) reduces integration time to just a few seconds.
• Model selection: GPT-4o, Claude-3 Opus, and Qwen3.8-Max all deliver exceptional performance; choose based on cost and latency requirements.
• Prompts as code: Store prompts as versioned files to ensure consistency and maintain an audit trail.
• Human feedback loops: Enable reviewers to label LLM results, improving evaluation accuracy over time.

Conclusion

Additional resources

• Anthropic blog:Agentic Orchestration for Code Development
• Alibaba technical paper:Qwen3.8-Max: A 2.4T-parameter multimodal MoE model
• GitHub guidelines:Custom workflows with GitHub Actions