Complete Guide to AI Code Review in GitHub Actions

February 21, 2026·10 min read·Arunachalam Kalimuthu

GitHub Actions is the most popular CI platform for open-source and many enterprise teams. Merlin AI Code Review integrates seamlessly as a workflow step — no custom Actions, no marketplace dependencies, just a binary download and run. This guide covers everything from basic setup to advanced production workflows.

Basic setup (2 minutes)

.github/workflows/merlin-review.yml

yaml

on:
  pull_request:
    types: [opened, synchronize]
jobs:
  merlin-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - run: |
          curl -L https://github.com/Arunachalamkalimuthu/merlin-ai-code-review/releases/latest/download/merlin-linux-amd64 -o merlin
          chmod +x merlin && ./merlin review
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Set ANTHROPIC_API_KEY in your repository secrets (Settings → Secrets and variables → Actions). GITHUB_TOKEN is provided automatically.

Adding security scanning

Run a dedicated security pass alongside the standard review:

yaml

      - run: |
          ./merlin review
          ./merlin run /security
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Multi-step workflow with describe and labels

.github/workflows/merlin-full.yml

yaml

on:
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  merlin:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      issues: write      # needed for label creation
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Download Merlin AI Code Review
        run: |
          curl -L https://github.com/Arunachalamkalimuthu/merlin-ai-code-review/releases/latest/download/merlin-linux-amd64 -o merlin
          chmod +x merlin
      - name: AI Review
        run: ./merlin review
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      - name: Security Scan
        run: ./merlin run /security
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      - name: Generate Labels
        run: ./merlin run /generate_labels
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Webhook bot mode (enable PR comment commands)

Allow PR commenters to trigger commands like @merlin /review by running Merlin in webhook mode:

.github/workflows/merlin-bot.yml

yaml

on:
  issue_comment:
    types: [created]
jobs:
  merlin-bot:
    if: github.event.issue.pull_request != null
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -L https://github.com/Arunachalamkalimuthu/merlin-ai-code-review/releases/latest/download/merlin-linux-amd64 -o merlin
          chmod +x merlin && ./merlin webhook
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          FERRET_GITHUB_SECRET: ${{ secrets.FERRET_GITHUB_SECRET }}

Caching the binary

Cache the Merlin AI Code Review binary across workflow runs to save ~5 seconds on each run:

yaml

      - name: Cache Merlin AI Code Review binary
        uses: actions/cache@v4
        with:
          path: merlin
          key: merlin-${{ runner.os }}-latest
      - name: Download Merlin AI Code Review (if not cached)
        run: |
          if [ ! -f merlin ]; then
            curl -L https://github.com/Arunachalamkalimuthu/merlin-ai-code-review/releases/latest/download/merlin-linux-amd64 -o merlin
            chmod +x merlin
          fi

Using a custom config

Add merlin.toml to your repo root to customize review behavior without touching the workflow:

merlin.toml

toml

[ai]
provider    = "anthropic"
model       = "claude-sonnet-4-6"
[review]
focus        = ["bugs", "security", "performance"]
max_comments = 20
reflect      = true

View all platform guides →← Back to Blog

TutorialGetting Started

Complete Guide to AI Code Review in GitHub Actions

Basic setup (2 minutes)

Adding security scanning

Multi-step workflow with describe and labels

Webhook bot mode (enable PR comment commands)

Caching the binary

Using a custom config

Related articles

Ship Better Code in 5 Minutes with Merlin AI Code Review

AI Code Review for GitLab CI: Cloud and Self-Hosted

Integrating AI Code Review into Your CI/CD Pipeline