[Feature Request] Adopt AI-Powered Code Review for OpenCue Pull Requests

[ramonfigueiredo]

Is your feature request related to a problem? Please describe.

OpenCue is a multi-language project (Python, Java, C++, Rust, and more) maintained by a small group of reviewers within the ASWF. Pull request reviews depend entirely on human maintainers, which creates two recurring problems:

1. Review bottlenecks: PRs can sit waiting for review for days or weeks, especially when changes span multiple components (Cuebot, RQD, PyCue, CueGUI, CueSubmit). Maintainers have limited bandwidth, and the review queue grows during busy periods.
2. Inconsistent early feedback: Common issues like style violations, potential bugs, missing edge cases, or security concerns are sometimes caught late in the review cycle. SonarCloud (currently in CI) covers rule-based static analysis but does not provide contextual, natural-language feedback on code logic, design, or intent.

Contributors, especially new ones, would benefit from immediate, automated feedback on their PRs so they can iterate before a human reviewer is needed.

Describe the solution you'd like

Note: AI-powered code review does not replace human reviews. It enhances them by providing immediate, automated feedback on common issues, freeing maintainers to focus on architecture, domain logic, and project direction.

Integrate an AI-powered code review tool into the OpenCue GitHub repository that automatically reviews every pull request and provides:

• A summary of what the PR changes and why
• Line-by-line comments with suggestions for improvements, bug risks, and security concerns
• Incremental reviews when new commits are pushed to an open PR
• Support for all languages used in OpenCue (Python, Java, C++, Rust)

The tool should be free for open-source projects, require minimal configuration, and run automatically without manual triggers. It should complement (not replace) human review and the existing SonarCloud pipeline.

Recommended tool: CodeRabbit: free for public repositories, language-agnostic, provides PR summaries + line comments + interactive review, configurable via .coderabbit.yaml.

This recommendation is open for discussion with the ASWF TSC before any adoption decision is made.

Describe alternatives you've considered

Below are all the alternatives evaluated, grouped by pricing model.

Free Options for Open Source:

Tool	Integration	Languages	Highlights	Limitations
CodeRabbit	GitHub App	All (Python, Java, C++, Rust)	PR summaries, line comments, interactive replies, learnable, configurable via .coderabbit.yaml	Third-party hosted service
Gemini Code Assist	GitHub App	Python, Java, C++	Backed by Gemini 2.0, PR summarization, security analysis, customizable instructions	Requires Google Cloud linkage
Qodo Merge (PR-Agent)	GitHub Actions (self-hosted)	All	Self-hostable with your own LLM key, commands (/review, /improve, /describe), configurable via .pr_agent.toml	Self-hosted version requires an LLM API key and maintenance
Sourcery AI	GitHub App	Python (primary)	Refactoring suggestions, code quality scoring, custom rules	Limited Java/C++ support, not ideal for Cuebot or RQD
DeepSource	GitHub App	Python, Java, C++	Static analysis + AI autofix, anti-pattern detection	AI features are partial; less mature PR review experience
SonarCloud (already in use)	GitHub Actions	Python, Java, C++	Bug/vulnerability/code smell detection, quality gates	Rule-based only, no contextual AI feedback

Paid Options:

Tool	Pricing	Integration	Highlights	Limitations
Claude Code Actions	Usage-based (Anthropic API)	GitHub Actions	Deep contextual analysis, fully customizable via prompts, multi-file understanding	Requires API billing; cost scales with PR volume
GitHub Copilot Code Review	$19–39/user/month	Native GitHub	Request review like a human, inline suggestions, custom guidelines via .github/copilot-instructions.md	Per-seat cost; review is on-demand (not automatic)
Greptile	From $20/seat/month	GitHub App	Full codebase indexing, architecture-aware comments, Slack integration	Per-seat cost

Why free options are preferred?

As an ASWF open-source project with community contributors:

• Tools must be free and accessible to all contributors without per-seat licensing
• Setup should not depend on organizational billing or paid accounts
• Self-hosted options (Qodo Merge) are viable if data privacy is a concern

Paid tools remain valid for organizations that use OpenCue internally and want deeper integration, but they are not practical as a default for the public repository.

Additional context

Discussion points for ASWF / TSC

This feature request is intended to open a conversation before any tool is adopted. Key topics to align on:

1. Tool selection: Should we start with a single tool (e.g., CodeRabbit) or trial multiple tools in parallel?
2. ASWF guidance: Does the foundation have preferences or policies on AI tooling for member projects? Are other ASWF projects (OpenEXR, OpenVDB, OpenTimelineIO) already using any of these?
3. Data and privacy: Are there concerns about PR diffs being sent to third-party AI services? Would a self-hosted solution (Qodo Merge with a project-owned API key) be required?
4. Noise management: How do we configure the tool so its comments are helpful rather than noisy? Should it only flag high-confidence issues?
5. Coexistence with SonarCloud: SonarCloud handles deterministic static analysis. The AI reviewer handles contextual feedback. How do we keep the two from producing duplicate or conflicting comments?

Proposed next steps (pending TSC approval)

1. Present this proposal at the next OpenCue TSC meeting
2. Discuss this option with ASWF
3. Agree on a tool (or short trial of 2–3 tools)
4. Install the chosen tool on the repository
5. Add a configuration file (e.g., .coderabbit.yaml) tuned to OpenCue conventions
6. Evaluate after 1–2 months and decide on permanent adoption

[ramonfigueiredo]

Free Options for Open Source

1. CodeRabbit

Website	https://coderabbit.ai
Pricing	Free for public open-source repositories
Integration	GitHub App + optional GitHub Actions
Languages	Language-agnostic (Python, Java, C++, Rust)

• Automatic PR summaries, walkthroughs, and line-by-line comments
• Incremental reviews on new commits
• Interactive: reviewers can reply to the bot in PR comments
• Learnable: adapts to project conventions over time
• Configurable via .coderabbit.yaml

2. Gemini Code Assist

Website	https://cloud.google.com/gemini/docs/code-assist/overview
Pricing	Free for open-source projects via Google Cloud
Integration	GitHub App
Languages	Python, Java, C++

• Full PR summarization
• Code quality and security analysis
• Customizable review instructions
• Backed by Gemini 2.0 models

3. Qodo Merge (formerly PR-Agent)

Website	https://qodo.ai/products/qodo-merge/
Open-source core	https://github.com/Codium-ai/pr-agent
Pricing	Free (self-hosted with your own LLM API key)
Integration	GitHub Actions or GitHub App
Languages	Language-agnostic

• Commands: /review, /describe, /improve, /ask
• Supports multiple LLM backends (GPT-4, Claude, etc.)
• Fully self-hostable: no vendor lock-in
• Configurable via .pr_agent.toml

4. Sourcery AI

Website	https://sourcery.ai
Pricing	Free for open-source projects
Integration	GitHub App
Languages	Python (primary); limited Java/C++ support

• Refactoring suggestions and code quality scoring
• Automated PR summaries
• Custom rules via .sourcery.yaml
• Limitation: Best coverage for Python only; limited value for Cuebot (Java) and C++ components.

5. DeepSource

Website	https://deepsource.com
Pricing	Free for open-source projects
Integration	GitHub App
Languages	Python, Java, C++, Go

• Static analysis combined with AI-powered autofix
• Anti-pattern and security vulnerability detection
• Performance issue detection

6. SonarCloud (Already in Use)

Website	https://sonarcloud.io
Pricing	Free for public open-source projects
Integration	GitHub Actions (already configured)
Languages	Python, Java, C++

• Rule-based static analysis (not AI-powered)
• Bug, vulnerability, and code smell detection
• Quality gate enforcement
• Note: Complements AI reviewers; does not replace them.

---

Paid Options

1. Claude Code (GitHub Actions)

Website	https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/github-actions
Pricing	Usage-based via Anthropic API
Integration	GitHub Actions workflow
Languages	Language-agnostic

• Deep contextual understanding of multi-file changes
• Fully customizable review criteria via system prompts
• Can enforce project-specific conventions

2. GitHub Copilot Code Review

Website	https://docs.github.com/en/copilot/using-github-copilot/code-review
Pricing	$19/user/month (Business) or $39/user/month (Enterprise)
Integration	Native GitHub UI
Languages	Broad

• Request AI review like a human reviewer
• Inline suggestions with one-click apply
• Custom guidelines via .github/copilot-instructions.md

3. Greptile

Website	https://greptile.com
Pricing	From $20/seat/month
Integration	GitHub App
Languages	Language-agnostic

• Indexes entire codebase for architecture-aware reviews
• Custom review rules
• Slack integration

Comparison Summary

OSS = Open Source Software

Tool	Free for OSS	AI-Powered	All OpenCue Languages	Auto-Review	Line Comments	PR Summary	Self-Hostable
CodeRabbit	Yes	Yes	Yes	Yes	Yes	Yes	No
Gemini Code Assist	Yes	Yes	Yes	Yes	Yes	Yes	No
Qodo Merge	Yes (self-hosted)	Yes	Yes	Yes	Yes	Yes	Yes
Sourcery AI	Yes	Yes	Python only	Yes	Yes	Yes	No
DeepSource	Yes	Partial	Yes	Yes	Yes	No	No
SonarCloud	Yes	No	Yes	Yes	Yes	No	No
Claude Code Actions	No	Yes	Yes	Yes	Yes	Yes	No
GitHub Copilot	No	Yes	Yes	On request	Yes	No	No
Greptile	No	Yes	Yes	Yes	Yes	Yes	No

[ramonfigueiredo]

The CodeRabbit has been activated on the OpenCue project.