# Setup guide — Production-Grade AI Code Review Agent

## 1. Get the agent from its bundle

Download this kit's bundle from its AgentKits page, then create an isolated Python environment.

```
# Download this kit's bundle from its AgentKits page, then:
unzip code-review-assistant.zip && cd code-review-assistant
python -m venv .venv && source .venv/bin/activate
```

## 2. Configure models, keys, and tools

Set model keys and point the agent at your repo's existing linters/type-checkers/SAST so its findings are grounded in real tools.

```
cp .env.example .env
ANTHROPIC_API_KEY=sk-ant-...
OPENAI_API_KEY=sk-...
GITHUB_TOKEN=ghp_...
STATIC_ANALYSIS="ruff,mypy,semgrep"
MAX_FILES=40
MAX_DIFF_LINES=1500
```

## 3. Set the review policy

Declare protected areas, ignore globs, and severity gating in config — not in the prompt — so the rules are enforced deterministically.

```
# .codereview.yml
protected_paths:
  - "**/auth/**"
  - "**/payments/**"
  - "**/*crypto*"
  - "migrations/**"
  - "infra/**"
ignore:
  - "**/*.lock"
  - "**/generated/**"
  - "vendor/**"
run_tests: false        # enable only with a sandbox
fail_on: ["BLOCKER", "CRITICAL"]
```

## 4. Try it locally on a diff

Run a review against the current branch's diff before wiring CI, and read the JSON/inline output.

```
git fetch origin main
codereview-agent review --base origin/main --head HEAD --explain
# prints summary, verdict, risk_score, and inline comments
```

## 5. Add it to CI as a PR check

Run on every pull request and post inline comments plus a status check. Start non-blocking, then turn on fail_on once false-positive rates are low.

```
# .github/workflows/code-review.yml
name: AI Code Review
on: pull_request
jobs:
  review:
    runs-on: ubuntu-latest
    permissions: { contents: read, pull-requests: write, checks: write }
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: pipx install codereview-agent
      - run: codereview-agent review --base ${{ github.event.pull_request.base.sha }} --head ${{ github.sha }} --post
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```
