PR-Agent — AI PR Reviews via GitHub Action

Practical Notes

• Verified adoption signal: uses a single LLM call per tool run (~30 seconds per README claim)
• Docker image namespace migration note: 0.34.2+ uses pragent/pr-agent (README)

How to Run It Safely

PR review bots are only useful when you can trust when they run and what they can access.

Practical guardrails:

• Keep the workflow limited to pull_request (not pull_request_target) unless you fully understand the security implications.
• Use GitHub Action permissions narrowly; PR-Agent needs a token that can post comments, not write to the repo.
• Start with one automation (for example: review summary) and add more once the team agrees on the format.

If you prefer local iteration, the README also documents a CLI flow:

pip install pr-agent
export OPENAI_KEY=your_key_here
pr-agent --pr_url https://github.com/owner/repo/pull/123 review

That pattern is useful for testing prompt tweaks before you bake them into CI.

FAQ

Q: Is PR-Agent free? A: Yes. It’s open-source under an SPDX license; your main cost is the LLM API usage.

Q: Does it work without GitHub Actions? A: Yes. The project also supports a local CLI mode for a single PR URL.

Q: What’s the minimum permission set? A: Typically: read repo contents + write PR comments; avoid broader scopes until needed.