AI Code Review Golang: How AI Becomes an Effective Reviewer for Go

 1AI review is very effective for:
 2
 3MECHANICAL CHECKS (deterministic, objective):
 4  - Error handling patterns (fmt.Errorf with %w?)
 5  - Architecture violations (handler imports repo impl?)
 6  - Type safety (float64 for money?)
 7  - Context propagation (ctx passed to all downstream?)
 8  - Nil handling (check nil after repo call?)
 9  - Naming conventions
10  - Import organization
11  - Go idiom violations (panic in non-main, init() abuse)
12
13COMPLETENESS CHECKS:
14  - Test coverage for all error paths
15  - Missing error codes
16  - Incomplete interface implementation
17  - Missing godoc comments
18
19AI review is LESS effective for:
20  - Business logic correctness (AI doesn't know the domain rules)
21  - Complex security vulnerabilities
22  - Performance implications in high-traffic scenarios
23  - Architecture decisions that need broad business context
24  - Subtle concurrency bugs that need domain knowledge

 1# Approach 1: Manual pre-PR review
 2
 3claude
 4> Review all the changes in this working directory:
 5> [or: "Review the PR diff from main to HEAD"]
 6>
 7> Check for:
 8>
 9> CRITICAL (must fix before the PR):
10>   1. Error handling: are all errors wrapped with fmt.Errorf?
11>   2. Repository: return nil, nil for not-found?
12>   3. Architecture: no cross-layer imports that violate the rules?
13>   4. Types: no float64 for monetary values?
14>   5. Context: is ctx passed to all downstream calls?
15>   6. Nil checks: are all repo returns checked for nil before use?
16>
17> SUGGESTION (nice to have):
18>   7. Test coverage for all error paths?
19>   8. Godoc for exported functions?
20>   9. Helpful error messages?
21>
22> Output format:
23> CRITICAL: [issue] at [file:line] — [explanation + fix]
24> SUGGESTION: [improvement] at [file:line]
25> SCORE: [X]/100
26>
27> Start with the most critical.
28
29# Approach 2: AI review from a git diff
30git diff main..HEAD -- '*.go' | claude
31> Review this diff. Check: error handling, architecture, types, nil checks.
32> Format: CRITICAL/SUGGESTION/SCORE

 1# .github/workflows/ai-code-review.yml
 2
 3name: AI Code Review
 4
 5on:
 6  pull_request:
 7    types: [opened, synchronize, ready_for_review]
 8    paths: ['**.go']
 9
10jobs:
11  ai-review:
12    runs-on: ubuntu-latest
13    if: github.event.pull_request.draft == false
14    permissions:
15      pull-requests: write
16      contents: read
17
18    steps:
19      - uses: actions/checkout@v4
20        with:
21          fetch-depth: 0
22
23      - name: Copilot Go Review
24        uses: github/copilot-for-pull-requests@v1
25        with:
26          github-token: ${{ secrets.GITHUB_TOKEN }}
27          review-type: "code-review"
28          review-instructions: |
29            Review Go code for the Santekno Shop production service.
30
31            CRITICAL CHECK (comment as "CRITICAL: ..."):
32            1. Error wrap: ALL errors must be fmt.Errorf("pkg.Method: %w", err)
33               If there is: return err (without wrap) → CRITICAL
34
35            2. Repository not-found: MUST return nil, nil
36               If there is: return nil, pgx.ErrNoRows → CRITICAL
37
38            3. Monetary type: MUST be int64 cents
39               If there is: float64 or float32 for price/amount → CRITICAL
40
41            4. Architecture: handler must not import the repository impl
42               If there is a cross-layer import → CRITICAL
43
44            5. Context: ctx must be passed to all downstream calls
45               If there is a DB/cache call without ctx → CRITICAL
46
47            SUGGESTION CHECK (comment as "SUGGESTION: ..."):
48            6. Test coverage for all error paths
49            7. Godoc for exported functions and types
50            8. Interface methods not more than 5 (split if more)
51
52            For each issue: give an exact code fix, not just a description.
53            Prioritize CRITICAL before SUGGESTION.
54            End with: REVIEW_SCORE: [X]/100

 1<!-- .github/pull_request_template.md -->
 2
 3## Summary
 4[Describe what this PR does]
 5
 6## Changes
 7- [ ] Domain changes
 8- [ ] Usecase changes
 9- [ ] Repository changes
10- [ ] Handler changes
11- [ ] Tests
12
13## AI Pre-Review Checklist
14Copy-paste the output from the AI review here:
15
16​```
17[AI Review Output]
18CRITICAL: [list]
19SUGGESTION: [list]
20SCORE: __/100
21​```
22
23Status: All CRITICAL fixed | Some CRITICAL still outstanding
24
25## Manual Test
26- [ ] go test -race ./...
27- [ ] go build ./...
28- [ ] go vet ./...
29
30## Spec Compliance
31- [ ] specify audit score: __/100

 1# Comprehensive Claude Code review rules:
 2
 3claude
 4> Review this with the following rules:
 5>
 6> === CRITICAL RULES (score penalty: -10 each) ===
 7>
 8> C1. ERROR WRAPPING
 9>     All errors must use: fmt.Errorf("packageName.MethodName: %w", err)
10>     Violations: "return err", errors.New() in non-domain code, wrap without %w
11>
12> C2. REPOSITORY NOT-FOUND
13>     Must return (nil, nil) for not-found, never an error
14>     Violation: return nil, pgx.ErrNoRows, return nil, sql.ErrNoRows
15>
16> C3. MONETARY TYPES
17>     Must use int64 (cents), never float64/float32
18>     Violation: Price float64, Amount float32, any decimal for money
19>
20> C4. ARCHITECTURE LAYERS
21>     handler: only import usecase interfaces
22>     usecase: only import domain + repository interfaces
23>     repository: only import domain + drivers
24>     domain: zero external imports
25>
26> C5. CONTEXT PROPAGATION
27>     ctx must be first parameter and passed to ALL downstream
28>     Violation: DB query without ctx, HTTP call without ctx
29>
30> C6. NIL CHECKS
31>     After every repo/cache call: check error, then check nil
32>     Violation: use result without nil check
33>
34> C7. ERROR IGNORE
35>     Never use _ for errors in non-test code
36>     Violation: result, _ := db.Query(...)
37>
38> === SUGGESTION RULES (score penalty: -3 each) ===
39>
40> S1. TEST COVERAGE
41>     Error paths should have corresponding test cases
42>
43> S2. GODOC
44>     Exported functions, types, constants need godoc
45>
46> S3. INTERFACE SIZE
47>     Interface methods > 5: suggest split
48>
49> S4. CONTEXT TIMEOUT
50>     External calls should have context with timeout
51>
52> === OUTPUT FORMAT ===
53> [CRITICAL|SUGGESTION] [rule-code]: [description] at [file:line]
54> Fix: [exact code fix]
55>
56> Final: SCORE: [X]/100 (100 - sum of penalties)

 1# Security-focused review prompt:
 2claude
 3> Review this code for common Go security issues:
 4>
 5> 1. SQL INJECTION
 6>    Parameterized queries? No string concatenation in SQL?
 7>
 8> 2. PATH TRAVERSAL
 9>    User-controlled file paths that aren't sanitized?
10>
11> 3. RATE LIMITING
12>    Endpoints that could be abused without a rate limit?
13>
14> 4. AUTHENTICATION CHECK
15>    Protected endpoints that forgot the auth middleware?
16>
17> 5. INFORMATION DISCLOSURE
18>    Error messages that expose internal details?
19>    Stack traces returned to the client?
20>
21> 6. INSECURE DEFAULTS
22>    Insecure TLS config?
23>    Hardcoded secrets?
24>
25> 7. INTEGER OVERFLOW
26>    Arithmetic that could overflow for financial data?
27>    (int64 for price is ok, but multiplication must be careful)
28>
29> 8. CONCURRENCY ISSUES
30>    Shared state that isn't protected?
31>    Channels that could deadlock?
32>
33> Mark each issue as: CRITICAL (exploit potential) or WARNING

 1# Performance-focused review:
 2claude
 3> Review this code for potential performance issues in a high-traffic scenario:
 4>
 5> 1. N+1 QUERIES
 6>    Loops that contain DB queries?
 7>    → Should be a batch query or JOIN
 8>
 9> 2. MISSING INDEX
10>    Query without an obvious index? (filter by non-PK column on a large table)
11>
12> 3. UNBOUNDED QUERY
13>    SELECT * without LIMIT for a potentially large table?
14>
15> 4. MISSING CACHE
16>    Data that is read often and rarely changes but isn't cached?
17>
18> 5. EXPENSIVE OPERATION IN HOT PATH
19>    Expensive JSON serialization in a loop?
20>    String concatenation in a loop?
21>
22> 6. GOROUTINE LEAK POTENTIAL
23>    Goroutine without a cancellation mechanism?
24>
25> 7. MEMORY ALLOCATION
26>    A large struct passed by value (should be a pointer)?
27>    Append in a loop that can grow significantly?
28>
29> Mark: HIGH (will show in production) / MEDIUM / LOW

 1An effective workflow for code review:
 2
 31. DEVELOPER SELF-REVIEW (with AI):
 4   Before pushing the PR:
 5
 6   claude > "Review the changes I made today"
 7   → Fix all CRITICAL
 8   → Evaluate SUGGESTIONS
 9   → Score target: > 90/100
10
11   go test -race ./...
12   golangci-lint run ./...
13
14   Commit with an informative message
15
162. AI AUTOMATED REVIEW (in GitHub Actions):
17   PR created → Copilot reviews automatically
18   → Fix flagged issues
19   → Update PR
20
213. HUMAN REVIEW (after AI pre-filter):
22   The reviewer doesn't need to check:
23   - Error handling format
24   - Architecture violations
25   - Type safety
26   (AI already caught these)
27
28   The reviewer focuses on:
29   - Business logic correctness
30   - Architecture decisions (not violations)
31   - Code clarity and maintainability
32   - Edge cases the AI missed
33   - Domain-specific security implications
34
354. MERGE:
36   All CRITICAL issues resolved
37   AI score: > 85/100
38   Human reviewer approved

 1How to measure the value of AI review:
 2
 3Metric 1: Mechanical review comments per PR
 4  Before AI review: [X] comments about error handling, types, etc.
 5  After AI review (AI catches first): [Y] comments
 6  Target: Y < X * 30% (AI catches 70%+ mechanical issues)
 7
 8Metric 2: Time spent in human review per PR
 9  Before: [X] minutes average
10  After: [Y] minutes average
11  Target: Y < X * 50% (reviewer more focused)
12
13Metric 3: Post-merge bug rate
14  Before: [X] bugs/sprint discovered post-merge
15  After: [Y] bugs/sprint
16  Target: Y < X * 60% (AI catches more before merge)
17
18Metric 4: PR cycle time (open to merge)
19  Before: [X] days average
20  After: [Y] days average
21  Target: Y < X (faster feedback loop)
22
23Track all of this in a spreadsheet, evaluate quarterly.

 1Limitation 1: AI doesn't know the business context
 2  Example: "this must be idempotent because of Kafka delivery"
 3  AI doesn't know your Kafka delivery semantics
 4
 5  Mitigation: Include domain context in the review prompt
 6  "Review this. Context: this is a Kafka consumer handler.
 7   Idempotency is a CRITICAL requirement because of at-least-once delivery."
 8
 9Limitation 2: False positives
10  AI sometimes flags code that is actually correct
11
12  Mitigation: Include exceptions in the review rules
13  "Note: test files may ignore errors with _"
14  "Note: domain error types may return errors.New()"
15
16Limitation 3: False negatives (miss what should be caught)
17  For complex business logic bugs, AI can miss them
18
19  Mitigation: Human review for business logic
20  AI review for mechanical, human review for logic
21
22Limitation 4: Inconsistency between runs
23  The same code can get a slightly different review each run
24
25  Mitigation: Structured prompts with explicit rules
26  → More rules = more consistent results

 1# Universal review prompt that works for Claude Code, Cursor, Copilot Chat
 2
 3REVIEW_PROMPT="Review these changes for Go production code:
 4
 5CRITICAL (stop the PR if any of these):
 6□ Error without wrap (return err, not fmt.Errorf)
 7□ Repository returns an error for not-found (not nil, nil)
 8□ Float64 for monetary values
 9□ Architecture layer violations
10□ Error ignored with _
11
12IMPORTANT (fix recommended):
13□ Context not propagated to downstream
14□ Nil not checked after a repo call
15□ Interface > 5 methods
16
17NICE TO HAVE:
18□ Missing godoc for exported symbols
19□ Missing test for error paths
20
21Output: list issues with file:line, severity, and exact fix.
22End with: OVERALL: APPROVE / REQUEST_CHANGES / NEEDS_REVIEW"
23
24# Use this prompt in:
25# Claude Code: claude > "$REVIEW_PROMPT"
26# Cursor: Composer or Chat with the prompt
27# Copilot: Chat with @workspace + the prompt
28# Windsurf: Chat with the prompt

 1Recommended workflow for a team of 5-10 developers:
 2
 3SETUP:
 4  □ Set up GitHub Actions Copilot review (14.3)
 5  □ All developers install an AI tool (Claude Code / Cursor)
 6  □ Share the pre-PR review prompt (14.2) with all developers
 7  □ Add an AI review section to the PR template (14.4)
 8
 9PER PR WORKFLOW:
10  Developer → self AI review (< 5 minutes) → push PR
11  GitHub Actions → Copilot review (auto, < 5 minutes)
12  Reviewer → human review (focus: logic, not mechanical)
13
14  A PR must not be human-reviewed without the AI review complete
15
16MONTHLY:
17  Review the AI review effectiveness metrics (14.9)
18  Update review rules based on frequently recurring issues
19  Update CLAUDE.md/copilot-instructions if there's a new pattern
20
21ANTI-PATTERN:
22  "AI review is enough, no need for human review"
23  → WRONG. AI is a filter, not a replacement

 1# Special review for migration files:
 2claude
 3> Review this migration file (SQL):
 4> @migrations/20250701_cancel_order_index.sql
 5>
 6> Check:
 7> 1. DESTRUCTIVE: is there a DROP or DELETE without a backup strategy?
 8> 2. LOCKING: is there an operation that locks a large table?
 9>    (ALTER TABLE in PostgreSQL can lock a production table)
10> 3. REVERSIBLE: is there a corresponding down migration?
11> 4. INDEX: is there no missing index for a column that's queried often?
12> 5. DEFAULT VALUES: does a new NOT NULL column have the correct default?
13> 6. FK CONSTRAINT: does the foreign key have an index?
14> 7. DATA MIGRATION: is the data migration safe (no truncate without backup)?
15>
16> Mark as: BLOCKING (don't deploy until fixed) / WARNING / OK

 1# Combine AI review with the Spec Kit audit:
 2
 3# Step 1: AI mechanical review
 4claude > "Review my changes from the perspective of Go conventions and architecture"
 5
 6# Step 2: Spec compliance audit
 7specify audit --feature cancel-order --compare-to spec.md
 8# → Check whether the implementation matches all ACs
 9
10# Step 3: Combined score
11# AI review score: 92/100
12# Spec compliance: 95/100
13# Combined: (92 + 95) / 2 = 93.5/100
14
15# Target for the PR: combined score > 85/100
16
17# Automatic in CI:
18# .github/workflows/quality-gates.yml
19# Step 1: go test + lint (standard)
20# Step 2: specify audit (spec compliance)
21# Step 3: Copilot review (AI mechanical review)
22# All must pass to merge

 1// If the team needs a more customized review: build a custom review bot
 2
 3// cmd/review-bot/main.go
 4package main
 5
 6import (
 7    "context"
 8    "fmt"
 9    "os"
10    "os/exec"
11    "strings"
12
13    "github.com/anthropics/anthropic-sdk-go"
14)
15
16func main() {
17    // Get the git diff from the PR
18    diff, err := getGitDiff()
19    if err != nil {
20        fmt.Fprintf(os.Stderr, "Error getting diff: %v\n", err)
21        os.Exit(1)
22    }
23
24    // Review with the Claude API
25    review, score, err := reviewWithClaude(diff)
26    if err != nil {
27        fmt.Fprintf(os.Stderr, "Review error: %v\n", err)
28        os.Exit(1)
29    }
30
31    fmt.Println(review)
32
33    // Exit with code 1 if there are CRITICAL issues
34    if score < 70 || strings.Contains(review, "CRITICAL:") {
35        os.Exit(1) // CI will fail
36    }
37}
38
39func getGitDiff() (string, error) {
40    cmd := exec.Command("git", "diff", "main..HEAD", "--", "*.go")
41    out, err := cmd.Output()
42    return string(out), err
43}
44
45func reviewWithClaude(diff string) (string, int, error) {
46    client := anthropic.NewClient()
47
48    prompt := fmt.Sprintf(`Review the Go code diff for a production service.
49
50Rules:
51CRITICAL (exit 1 if found):
52- Error not wrapped with fmt.Errorf("pkg.Method: %%w", err)
53- Repository returns error for not-found (must nil, nil)
54- float64 for monetary values
55- Architecture layer violations
56
57SUGGESTION (warning only):
58- Missing tests for error paths
59- Interface > 5 methods
60
61Diff:
62%s
63
64Output: list issues + SCORE:[0-100]`, diff)
65
66    msg, err := client.Messages.New(context.Background(), anthropic.MessageNewParams{
67        Model:     anthropic.F(anthropic.ModelClaudeSonnet4_6),
68        MaxTokens: anthropic.F(int64(2000)),
69        Messages: anthropic.F([]anthropic.MessageParam{
70            anthropic.NewUserMessage(anthropic.NewTextBlock(prompt)),
71        }),
72    })
73    if err != nil {
74        return "", 0, fmt.Errorf("claude api: %w", err)
75    }
76
77    result := msg.Content[0].Text
78
79    // Extract the score from the result
80    score := 80 // default
81    fmt.Sscanf(result, "SCORE:%d", &score)
82
83    return result, score, nil
84}

 1# Special review rules for concurrent code:
 2claude
 3> Review this concurrent code with a focus on:
 4>
 5> 1. DATA RACES
 6>    A shared variable accessed concurrently without sync?
 7>    → Solution: sync.Mutex, sync.RWMutex, or atomic
 8>
 9> 2. CHANNEL CORRECTNESS
10>    A channel that could deadlock?
11>    A goroutine that doesn't exit (goroutine leak)?
12>    Closing a nil channel?
13>
14> 3. CONTEXT CANCELLATION
15>    A goroutine that doesn't respect context cancellation?
16>    → Every goroutine must select case ctx.Done()
17>
18> 4. ERRGROUP USAGE
19>    An error from a goroutine that isn't propagated?
20>    → Use errgroup.WithContext for goroutine management
21>
22> 5. WAITGROUP
23>    wg.Add() before go? (not inside the goroutine)
24>    wg.Done() guaranteed to be called? (defer wg.Done())
25>
26> Mark: RACE_CONDITION (critical) / LEAK (critical) / WARNING

 1Tracking AI review effectiveness in the team:
 2
 3Weekly standup addition (5 minutes):
 4  "AI review caught X issues that weren't in the pre-review"
 5  "Human review caught Y issues that AI missed"
 6  "Top 3 most frequent issue types: ___"
 7
 8Monthly review retrospective:
 9  A PR sample from last month (5 PRs)
10  Count: mechanical issues that slipped to human review
11  Count: issues that AI caught and the developer fixed before push
12
13  Goal: ratio AI-catch / total-mechanical > 80%
14
15Dashboard metrics (a simple spreadsheet):
16  Date | PR ID | AI Score | CRITICAL count | Time-to-merge | Post-deploy bugs

 1ROI calculation for AI Code Review for a team of 5 developers:
 2
 3WITHOUT AI REVIEW:
 4  Average mechanical review comments per PR: 8
 5  Time reviewer spends per mechanical comment: 5 minutes
 6  Time developer spends to fix + re-push: 10 minutes
 7  Total per PR: 8 × (5+10) = 120 minutes = 2 hours
 8  PRs per week per dev: 3
 9  Total mechanical review overhead per week: 5 × 3 × 2 hours = 30 hours/week
10
11WITH AI REVIEW:
12  AI catches 70% of mechanical issues before human review
13  Remaining mechanical comments: 8 × 30% = 2.4 per PR
14  Total per PR: 2.4 × 15 = 36 minutes = 0.6 hours
15  Total per week: 5 × 3 × 0.6 = 9 hours/week
16
17SAVINGS:
18  30 - 9 = 21 hours/week
19  = 84 hours/month
20
21  If the team's hourly rate = Rp 100,000/hour:
22  Value = 84 × 100,000 = Rp 8,400,000/month
23
24COST:
25  Copilot Business: $19 × 5 = $95/month ≈ Rp 1,500,000/month
26
27ROI = (8,400,000 - 1,500,000) / 1,500,000 × 100 = 460%
28
29And this doesn't yet include the value from: fewer post-merge bugs,
30faster PR cycle, more focused reviewers.

 1# PR Checklist That Includes AI Review
 2
 3## Developer Checklist (before requesting review)
 4- [ ] AI pre-review done: `claude > "review changes"`
 5- [ ] AI review score: ___/100
 6- [ ] All CRITICAL from AI fixed
 7- [ ] go test -race ./...
 8- [ ] go vet ./...
 9- [ ] golangci-lint run ./...
10
11## Reviewer Checklist (human review)
12- [ ] AI review score acceptable (> 85/100)
13- [ ] Business logic correct (AI can't check this)
14- [ ] Edge cases the AI might miss
15- [ ] The right architecture decision
16- [ ] Code clarity acceptable for maintainability

 1# Real session: a developer just implemented CancelOrder
 2# Before pushing the PR, run the pre-review:
 3
 4cd santekno-shop
 5git diff main..HEAD -- '*.go' | head -100
 6# [shows 5 files changed]
 7
 8claude
 9> Review the changes in git diff main..HEAD.
10> Focus: error handling, architecture, types, nil checks.
11> Output: CRITICAL/SUGGESTION + SCORE
12
13# Claude output:
14# CRITICAL: cancel_order.go:45 — error not wrapped
15#   return err (WRONG)
16#   Should be: return fmt.Errorf("cancelOrder.Execute: %w", err)
17#
18# CRITICAL: order_handler.go:89 — float64 for monetary
19#   Amount float64 (WRONG)
20#   Should be: AmountIDR int64
21#
22# SUGGESTION: cancel_order.go:60 — missing nil check
23#   order may be nil after the repo call, check first
24#
25# SCORE: 72/100
26
27# Developer fixes the CRITICAL issues
28# Re-run the review:
29
30claude
31> Review again after the fix
32
33# Claude output:
34# Error wrapping: OK
35# Monetary types: OK
36# SUGGESTION: missing nil check is still there
37#
38# SCORE: 92/100
39
40# Developer decides: fix the suggestion or push with a note
41# Push the PR with the AI review result pasted in the description