PR Code Reviews

CodeStax combines deterministic checks, AI-assisted diff analysis, and repository-head scanners to produce evidence-backed pull-request reviews.

How It Works

1. A supported pull-request event reaches CodeStax through a connected SCM webhook, or a user starts a review manually.
2. CodeStax resolves and clones the pull request’s current head commit.
3. Deterministic and AI-assisted checks analyze changed code, including enabled organization custom rules, while repository scanners evaluate the checked-out PR head.
4. CodeStax stores the findings, analyzer coverage state, risk score, and gate result.
5. Results are delivered using the provider capabilities available for GitHub, GitLab, or Bitbucket.

Because repository scanners run against the PR head, some findings can refer to code outside the changed lines. PR reviews are not strictly diff-only scans.

Triggering a PR Review

Webhooks

Connected provider webhooks support open, update/synchronize, and reopen events. Before dispatch, CodeStax evaluates the effective organization/repository policy: the automatic-review master switch, matching event switch, and target-branch patterns are enforced. Path exclusions are worker-only: the worker first obtains the complete authoritative provider file list, then applies the effective path policy. If it cannot establish a complete list, the review fails closed; if every changed file is excluded, it records a durable no-scope result.

Manual

1. Open Reviews from the dashboard sidebar.
2. Select a repository.
3. Enter the pull-request number.
4. Select Trigger Review.

Reading a Review

AI privacy execution evidence

When an attempt has an AI execution record, the review page shows the immutable resolved mode, provider and model identifiers, credential source, processing boundary, retention and logging policy, token accounting, outcome, and policy snapshot hash. It never returns prompts, source, provider responses, or credential secrets. Missing legacy execution evidence is labeled unavailable rather than inferred. Organization admins and owners configure the fail-closed policy and BYOK credentials under PR Reviews → AI Privacy. See PR Review AI Privacy & BYOK.

Analysis integrity

CodeStax reports analyzer coverage separately from the quality gate:

A gate is shown as Passed only when its policy passes and analyzer coverage is complete. A completed review with degraded, incomplete, or unverified coverage is shown as Inconclusive, not as safe to merge.

The stored evidence ledger separates policy scope from AI-context coverage. It records provider changed-file totals, files excluded by policy and their matched patterns, in-scope files, analyzed files, and bounded diff/repository-context omission identities up to the disclosed manifest cap. The effective excluded-path-pattern ledger lists at most 100 patterns and always reports the authoritative total, listed count, unlisted count, and truncation state. Authoritative omission-record and unique-file totals remain separate when identities are truncated; repository-index aggregates whose identities are unavailable are labeled as such and never presented as exact unique-file counts. Repository context reports candidate, processed, represented, and omitted files; generated/included parts; UTF-8 bytes; and a clearly labeled conservative token estimate. Any file, part, or byte-budget omission makes coverage partial. For custom rules, the immutable non-sensitive snapshot separates loaded, eligible, submitted, response-accepted, verified-evaluated, verified-matched, and unverified/skipped counts. Raw rule text is excluded. If every changed file is excluded, the review is recorded as a no-scope result and explicitly reports that analyzers were not required.

Risk score

The 0–100 risk score is normalized from the complete set of accepted evidence: deterministic diff findings, accepted AI-assisted findings, and repository-scanner findings. The final value is the greater of its weighted category composition and the evidence-severity floor (75 for high, 95 for critical), so confidence cannot reduce accepted high/critical evidence below those floors. Use the score together with the individual findings and coverage state; when required analysis is incomplete, the gate remains Inconclusive rather than presenting a clean pass.

Enabled organization custom rules participate in the AI-assisted layer. Each accepted custom-rule finding must cite an added line and the exact enabled custom:<id> identifier; the stored configured severity is authoritative. The current shared response does not provide one explicit outcome per rule, so submission or a structurally accepted response is not presented as verified per-rule evaluation. If the enabled-rule set cannot be resolved safely, analysis fails closed. Unavailable, timed-out, invalid, and per-rule-unverified outcomes are recorded explicitly, and the review remains inconclusive where required evidence is missing.

Review details

Each review can include the PR identity and branches, changed-file statistics, scan duration, evidence by file and severity, provider-delivery state, analyzer coverage, and gate decision.

Provider delivery and merge enforcement

• GitHub: summary, inline review comments, and a check/status signal.
• GitLab: summary, inline discussions, and a commit status.
• Bitbucket: summary plus Code Insights reports and annotations; it does not have the same durable inline review-thread delivery as GitHub and GitLab.

CodeStax publishes a gate signal; it does not make an SCM setting enforceable by itself. To block a merge, configure the canonical gate under Settings → Quality Gates, then require the CodeStax check/status/report in the provider’s branch protection, merge checks, or branch restrictions.

Review dashboard

Open Reviews to search and filter reviews, inspect dispatch/provider-delivery state, and distinguish complete, degraded, incomplete, and unverified analysis at a glance.