跪拜 Guibai
← All articles
AI Programming · OpenAI · AIGC

A Pre-Commit AI Review Workflow That Catches What Local Tests Miss

By 全栈弄潮儿 ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Local test passes and green CI pipelines create false confidence — they rarely exercise missing auth checks, parameterized-query gaps, or error-message leaks. Adding a structured AI review step before human review catches those classes of bugs at the cheapest moment, and the diff-based approach keeps the model focused on what actually changed instead of re-litigating the whole codebase.

Summary

Running code without errors does not mean it is correct. A Node.js/Express user-registration endpoint that starts fine can still carry SQL injection, plain-text passwords, role-escalation holes, and raw database errors leaked to the frontend. Feeding the full requirements, business rules, and a git diff to an LLM before commit catches those problems early, when fixes are cheap.

The workflow centers on a detailed prompt that specifies project background, business constraints, and a structured output format — problem location, severity, impact, and a suggested fix — without letting the model rewrite the whole file. After the AI returns findings, the developer triages them into high (injection, auth bypass, data loss), medium (missing validation, unclear errors), and low (naming, style) buckets, then fixes and re-tests before pushing for human review.

A companion pre-commit checklist covers functionality, security, and engineering hygiene: verifying requirements, handling nulls and duplicates, checking for committed secrets, deleting debug logs, and confirming no unrelated files slipped into the change. The core rule is that AI finds candidates; the developer decides what is real, what matters, and how to fix it.

Takeaways
A pre-commit AI review catches logic errors, SQL/XSS injection, plain-text secrets, missing input validation, and boundary conditions that local runs often skip.
The prompt must include project background, concrete business rules, and a structured output format — problem location, severity, impact, fix suggestion, and verification method — while forbidding the model from rewriting the entire file.
Triage AI findings into high (injection, auth bypass, data loss), medium (incomplete validation, unclear errors), and low (naming, style) priorities; fix and re-test before pushing.
Submitting a git diff instead of raw files focuses the review on what changed and flags unrelated modifications, missing tests, or documentation gaps.
The correct sequence: clarify requirements → make a small change → run and test locally → AI review of code or diff → triage → fix and re-test → commit and wait for human review.
A pre-commit checklist covers functionality (requirements, nulls, duplicates, regression), security (injection, XSS, permissions, secrets, error exposure), and engineering (tests, docs, debug code, unrelated files, style compliance).
AI review is an assistant, not a gatekeeper; security, permissions, data handling, and core business logic still require manual confirmation by the developer and team.
Conclusions

The biggest value of pre-commit AI review is not finding clever bugs but surfacing omissions — the empty-username case, the missing hash, the role field the client shouldn't control — that a passing local run never exercises.

Forbidding the model from rewriting the whole file is a practical safeguard: it keeps the developer in the decision loop and avoids blindly adopting AI-generated code that may not fit the project's actual database driver or error codes.

The diff-based approach solves a real failure mode of AI code review — models that re-analyze unchanged code and drown the developer in noise — by constraining attention to the exact lines that changed.

The triage buckets (high/medium/low) mirror what senior reviewers do instinctively; making them explicit gives junior developers a rubric for deciding which AI findings actually block a commit.

Concepts & terms
Parameterized query
A SQL query where user-supplied values are passed as separate parameters (e.g., `?` placeholders) rather than concatenated into the query string, preventing SQL injection by ensuring input is never interpreted as SQL code.
Git diff review
Instead of sending an entire file to an AI reviewer, sending only the output of `git diff` — the lines that were added, removed, or changed — so the model focuses on the actual modification and flags unrelated file changes or scope creep.
Role escalation via request body
A security flaw where a client can submit a `role` field (e.g., `"admin"`) in a POST body and the server trusts it, allowing any user to self-assign elevated privileges that should be set server-side.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗