How to Set Up a GitHub PR Review Bot in 5 Minutes (Step-by-Step)
You've read about automated code review. You know it catches bugs your team misses. You want to add it to your GitHub workflow.
But "setting up a bot" sounds complicated. Webhooks, config files, API tokens, deployment...
It's not. A modern GitHub PR review bot takes five minutes to install — literally.
This guide walks you through installing CodeHawk, an AI code reviewer that automatically reviews every pull request and posts inline comments. No backend setup, no deployment, no maintenance.
What You'll Get in 5 Minutes
After following these steps, every PR opened in your GitHub repo will automatically receive AI-powered code review comments flagging:
- Bugs (null references, unhandled errors, off-by-one mistakes)
- Security issues (SQL injection, hardcoded secrets, auth bypasses)
- Logic errors (race conditions, missing error handling, timing bugs)
Comments appear inline on the exact lines with problems — no vague summary, no false positives. Your team approves PRs faster because obvious bugs are already caught.
Step 1: Open CodeHawk on GitHub Marketplace (30 seconds)
Go to: CodeHawk on GitHub Marketplace
You'll see the app listing with details about what CodeHawk does.
Click the "Install" button.
(The app is live — click Install to get started.)
Step 2: Choose Your Installation Scope (1 minute)
GitHub will ask you to select which account to install CodeHawk on:
- Your personal account
- A GitHub Organization
Choose your organization (this is usually where your team's repos live).
Then you'll see a list of your repositories. You can:
- Install on all repos — CodeHawk will review every pull request across your entire organization
- Install on specific repos — Select just the ones you want to test on first (recommended for teams trying this out)
If you're testing, pick one or two repos. You can always add more later.
Click "Install" to confirm.
Step 3: Authorize CodeHawk (1 minute)
GitHub shows you the permissions CodeHawk requests:
CodeHawk will have access to:
- Read pull request content and diffs
- Post review comments
- See commit history
CodeHawk will NOT have access to:
- Write to your code
- Delete anything
- Change repository settings
- Access other organizations
This is the minimal set of permissions a code reviewer needs. Read the permissions, then click "Authorize CodeHawk by CrossGen AI".
GitHub will redirect you back to CodeHawk's site. You're done with setup.
Step 4: Open a Pull Request and Watch It Work (2 minutes)
Make a change to your code in one of the repos where you installed CodeHawk.
Push a branch and open a pull request (PR) on GitHub.
CodeHawk starts automatically. You don't need to do anything. Within 5-30 seconds, CodeHawk will post inline comments on your PR.
You'll see comments like:
- Error: SQL injection vulnerability — "User input from
req.queryis embedded directly into a SQL query on line 15. Use parameterized queries instead." - Warning: Unhandled promise rejection — "This Promise could reject but you're not awaiting it or catching errors."
- Info: Missing error handling — "The API call on line 22 could fail. Consider adding error handling."
Each comment includes:
- The severity (Error, Warning, or Info)
- The line of code
- An explanation of the issue
- A suggestion for how to fix it
Step 5: Respond to the Comments (1-2 minutes)
Read CodeHawk's feedback. You have three options for each comment:
Option A: Fix It
If you agree the comment points to a real issue, fix it. Most CodeHawk suggestions take 30 seconds to address.
// CodeHawk flagged this:
const email = user.email.toLowerCase();
// You fix it by adding a null check:
if (!user) throw new Error('User not found');
return user.email.toLowerCase();
Option B: Dismiss It
If you disagree or the comment doesn't apply to your code, click "Dismiss" on that comment. CodeHawk learns over time which feedback your team values.
Option C: Discuss It
If you're unsure, leave a reply asking for clarification or explaining your reasoning. Other developers can chime in.
Then merge your PR.
That's It — You Have Automated Code Review
Your next PR will be automatically reviewed by CodeHawk. And the next one. And the next one.
Over time, you'll notice:
- Fewer bugs in production
- Code review comments focus on architecture instead of "did you handle null?"
- PRs merge faster because the mechanical review is done
- New developers write safer code (they learn from CodeHawk comments)
Optional: Customize CodeHawk (For Advanced Teams)
CodeHawk works great with zero configuration. But if you want to customize behavior, create a .codehawk.yml file in your repository root:
# Only flag critical issues
severity_threshold: error
# Don't review these paths
ignore_paths:
- "*.lock"
- "dist/"
- "build/"
- "vendor/"
- "*.generated.ts"
- "node_modules/"
# Focus on specific issue types
focus_areas:
- security # SQL injection, hardcoded secrets, auth bypasses
- error_handling # Missing try/catch, unhandled promises
- logic_errors # Null references, off-by-one, race conditions
If you don't create this file, CodeHawk uses sensible defaults that work for most teams.
Common Questions
Does CodeHawk have access to my code? CodeHawk reads the PR diff to analyze the code. The diff is sent to Claude (Anthropic's AI) for analysis and is not retained or used for training. Your source code is never stored.
How long does a review take? Usually 5-30 seconds from PR open to comments posted. Larger PRs might take longer.
Can I turn it off for certain repos? Yes. Go to GitHub Settings → Installed GitHub Apps → CodeHawk → and select which repos it can access. You can uninstall it entirely with one click if you want to stop using it.
What if CodeHawk is wrong?
Dismiss the comment. You can also use .codehawk.yml to configure CodeHawk to focus on specific issue types or ignore certain paths. And if you find a pattern that's generating false positives, you can report it so it gets better.
Is CodeHawk free? CodeHawk is free during the beta period. After beta, pricing will be available (currently $79/month per organization, with a free tier of 3 reviews/month for open source projects).
Can I use it on private repos? Yes. CodeHawk works on private repos, public repos, and organization repos.
Why This Matters
Code review catches bugs before they ship. But human code review is slow and inconsistent — especially for teams reviewing dozens of PRs per day.
Automated code review handles the mechanical layer: the obvious bugs, the security issues, the logic errors that type checkers miss. Your human reviewers focus on architecture, design, and team standards.
This split of labor means:
- Fewer production bugs
- Faster PR reviews
- More time for actual code design discussion
Get Started Today
You just learned that setting up automated code review is genuinely simple.
Install CodeHawk on GitHub now. Your next PR will be reviewed by AI.
Then your team will wonder how you ever reviewed code without it.
Free during beta. No credit card required. Takes 5 minutes.