ci: add pr review bot

Author: carlh98

.github/PULL_REQUEST_TEMPLATE.md

@@ -38,7 +38,8 @@ No matter your changes, these checks always apply.
   - If you create a new header, it aligns with the **Impact on version** section and matches what is generated in the build pipeline.
 - [ ] Documentation files were updated according with the changes.
   - Update `README.md` and `src/cli/CLI.md` if you made changes to **templating**.
-  - Update `AzurePipelines.md` and `src/app/README.md` if you made changes to **pipelines**.
+  - Update `AzurePipelines.md` and `src/app/README.md` if you made changes to **Azure Pipelines**.
+  - Update `GitHubActions.md` if you made changes to **GitHub Actions workflows**.
   - Update `Diagnostics.md` if you made changes to **diagnostic tools**.
   - Update `Architecture.md` and its diagrams if you made **architecture decisions** or if you introduced new **recipes**.
   - ...and so forth: Make sure you update the documentation files associated to the recipes you changed. Review the topics by looking at the content of the `doc/` folder.

.github/workflows/pr-review.yml

@@ -0,0 +1,29 @@
+name: PR Review Bot
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Run Pull Request Bot
+        uses: nventive/pull-request-bot@v2
+        with:
+          api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+          config-path: "./pull-request-bot.json"

CONTRIBUTING.md

@@ -81,6 +81,11 @@ use GitHub pull requests for this purpose. Consult [GitHub
 Help](https://help.github.com/articles/about-pull-requests/) for more
 information on using pull requests.
 
+> 💡 Pull requests are automatically reviewed by an **AI-powered PR Review Bot**
+> in addition to human reviewers. The bot may post review comments and suggest
+> fixes on your pull request. See [GitHubActions.md](doc/GitHubActions.md) for
+> details on how this is configured.
+
 ## Community Guidelines
 
 This project follows [Google's Open Source Community

README.md

@@ -53,6 +53,11 @@ Please read [CONTRIBUTING](CONTRIBUTING.md) for details on the process for contr
 
 Be mindful of our [Code of Conduct](CODE_OF_CONDUCT.md).
 
+## CI/CD & Automation
+
+- [Azure Pipelines](doc/AzurePipelines.md) — Build, test, and release pipelines.
+- [GitHub Actions](doc/GitHubActions.md) — Pull request automation (conventional commits validation, AI-powered code review).
+
 ### Application Template
 
 To debug the app from within the template, run the following commands:

doc/GitHubActions.md

@@ -0,0 +1,50 @@
+# GitHub Actions
+
+This project uses [GitHub Actions](https://docs.github.com/en/actions) workflows for pull request automation. These are separate from the [Azure Pipelines](AzurePipelines.md) which handle the build, test, and release CI/CD process.
+
+All workflow files are located under [`.github/workflows/`](../.github/workflows/).
+
+## Workflows
+
+### Conventional Commits ([conventional-commits.yml](../.github/workflows/conventional-commits.yml))
+
+This workflow validates that all commit messages in a pull request follow the [Conventional Commits](https://www.conventionalcommits.org/) specification. It runs [Commitsar](https://commitsar.aevea.ee/) via Docker on every pull request.
+
+This ensures consistent commit history and enables automated versioning based on commit types.
+
+### PR Review Bot ([pr-review.yml](../.github/workflows/pr-review.yml))
+
+This workflow provides **AI-powered code review** on pull requests using the [`nventive/pull-request-bot`](https://github.com/nventive/pull-request-bot) action.
+
+#### Triggers
+
+The bot runs automatically when a pull request is:
+- **Opened**
+- **Synchronized** (new commits pushed)
+- **Reopened**
+
+#### Permissions
+
+The workflow requires the following permissions:
+- `contents: read` — to read the repository code.
+- `pull-requests: write` — to post review comments and update the PR description.
+
+#### Configuration
+
+The bot behavior is configured in [`src/pull-request-bot.json`](../src/pull-request-bot.json):
+
+| Setting | Value | Description |
+|-|-|-|
+| Model | Claude Opus | The AI model used for code review. |
+| Excluded patterns | `tests/**`, `**/*.test.js` | Files excluded from review. |
+| Max file size | 320 KB | Files larger than this are skipped. |
+| Auto-fix enabled | Yes | The bot can suggest automatic fixes. |
+| Confidence threshold | 85% | Minimum confidence required for auto-fix suggestions. |
+| Max fixes per file | 5 | Maximum number of auto-fix suggestions per file. |
+| PR description mode | Append | The bot appends a summary to the PR description. |
+
+#### Required Secret
+
+| Secret | Description |
+|-|-|
+| `ANTHROPIC_API_KEY` | API key for the Anthropic Claude model used by the PR Review Bot. This must be configured in the repository's [GitHub Actions secrets](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions). |

pull-request-bot.json

@@ -0,0 +1,18 @@
+{
+  "claude_code": {
+    "model": "opus"
+  },
+  "file_filter": {
+    "exclude_patterns": ["tests/**", "**/*.test.js"],
+    "max_file_size": 327680
+  },
+  "auto_fix": {
+    "enabled": true,
+    "confidence_threshold": 0.85,
+    "max_fixes_per_file": 5
+  },
+  "pr_description": {
+    "enabled": true,
+    "mode": "append"
+  }
+}

src/cli/CHANGELOG.md

@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 Prefix your items with `(Template)` if the change is about the template and not the resulting application.
 
+## 0.26.3
+- Add PR bot to check PRs in GitHub.
+
 ## 0.26.2
 - Fix issue with dispose in VM.
 - Fix errors in documentation.