---
title: "Auto PR Review"
description: "Automatically review pull requests when opened."
section: "automation"
url: "https://forkline.dev/docs/automation/auto-pr-review"
markdown: "https://forkline.dev/docs/automation/auto-pr-review.md"
source: "src/content/docs/automation/auto-pr-review.mdx"
---

# Auto PR Review

Automatically review pull requests when they are opened.

## Overview

Auto PR review gives you a consistent first-pass review before a human reviewer arrives. It works best when you already know what you want the agent to prioritize.

_Interactive figure (AutoPrReviewDiagram) — see the HTML version of this page._

> **Info**: Auto PR review requires pull request or merge request opened events.

## Enabling Auto PR Review

1. Navigate to **Repositories**
2. Find your repository
3. Click **Settings** on the repository card
4. Select the **Automation** tab
5. Find **Auto PR Review**
6. Set the mode to **Enable**
7. Configure scope and action
8. Click **Save**

## Configuration Options

### Scope

Choose which pull requests get automatic review:

| Scope | Reviews |
|-------|---------|
| Forkline-authored PRs only | PRs created by `@forkline-bot` from automation flows |
| All PRs | Every PR in the repository |

> **Tip**: Start with Forkline-authored PRs only if you want signal without review noise.

### Action

Choose how feedback is delivered:

| Action | Description |
|--------|-------------|
| Comment | Post a review comment with findings |
| Commit | Push suggested changes directly to the PR branch |

## Custom Prompts

Define what the AI should focus on during reviews.

### Security-Focused Review

```markdown
Focus on security vulnerabilities:
- SQL injection risks
- XSS vulnerabilities
- Hardcoded secrets
- Authentication issues

Prioritize critical issues. Ignore style suggestions.
```

### Performance Review

```markdown
Check for performance issues:
- N+1 queries
- Memory leaks
- Unnecessary loops
- Missing caching

Focus on database queries and API endpoints.
```

### Documentation Review

```markdown
Check for documentation issues:
- Missing README sections
- Undocumented public APIs
- Unclear function comments

Ignore internal helpers and test files.
```

### Payment Integration Example

```markdown
This PR adds a new payment integration. Focus on:
1. Security: PCI compliance, no hardcoded credentials, proper encryption
2. Error handling: Network failures, timeouts, retries
3. Testing: Happy path, error cases, edge cases

Provide severity ratings (Critical/High/Medium/Low) for each finding.
```

## Skip Conditions

Auto PR review is skipped when:

- The PR is a draft
- The PR has the `no-auto-review` label
- The PR is a **cross-repository PR** (the head branch comes from a different repository)

### Cross-repository PRs

Automations are blocked on cross-repository PRs for security — the code comes from a repository
outside your control. This applies even if your repository is itself a GitHub fork. For example,
if your repo `your-org/project` is a fork of `upstream/project`:

- **Internal PRs** (branch within `your-org/project` → main of `your-org/project`) are reviewed
  normally — the code is in a repo you control
- **Cross-repo PRs** (from an external contributor's fork) are not auto-reviewed

You can still manually request a review on a cross-repo PR by mentioning `@forkline-bot`.

## Example Review

```markdown
🔍 Auto PR Review

## Summary

This PR adds user authentication. Good implementation with a few suggestions.

## Findings

### Security
- ⚠️ Password is logged in debug mode (src/auth/login.ts:45)
- ✅ Using bcrypt for password hashing

### Performance
- 💡 Consider caching user sessions (src/auth/middleware.ts:23)

### Suggestions

1. Remove debug logging of sensitive data
2. Add rate limiting to login endpoint

---
*This is an automated review. Validate all suggestions before applying.*
```

## Next Steps

- [Configure webhooks](https://forkline.dev/docs/automation/webhooks)
- [Learn about CI auto-fix](https://forkline.dev/docs/automation/ci-auto-fix)