How are you using AI/LLMs for automated SRE code reviews on GitHub PRs?
I'm looking into building an automated SRE-focused code reviewer for our infrastructure repositories, and I'm curious how other teams are approaching this.
The idea is that whenever a PR is opened or updated, something automatically reviews the diff from an SRE/platform perspective and adds inline comments to the PR, ideally classifying findings by severity, such as:
- 🔴 Critical
- 🟡 Warning
- 🔵 Info
The review would focus on things like Terraform, Kubernetes, Helm, AWS, IAM, networking, databases, reliability, availability, security, observability, FinOps, and potentially destructive infrastructure changes.
For example, detecting things such as:
- reducing production replicas from 3 to 1;
- disabling Multi-AZ or deletion protection on a database;
- overly permissive IAM policies;
- public exposure of infrastructure;
- missing PDBs, probes, resource requests/limits;
- questionable HPA configurations;
- potentially expensive infrastructure changes;
- Terraform changes that could cause data loss or downtime.
I'm considering something along the lines of:
GitHub PR -> GitHub Actions/GitHub App -> collect diff/context -> LLM -> structured findings -> GitHub Review API -> inline comments
Potentially combining the LLM with deterministic tools like Checkov, TFLint, Trivy, Conftest/OPA, kubeconform, etc.
For those who have already implemented something similar:
- Are you using an existing tool/product or did you build your own?
- Which LLM/provider are you using?
- Are you sending only the PR diff to the model, or also repository/context files?
- How do you handle false positives and hallucinations?
- Do you allow AI findings to block merges, or are they advisory only?
- How do you manage company-specific SRE/platform rules and standards?
- Did you implement it as a GitHub Action, GitHub App, external service, or something else?
- What worked well, and what would you do differently if you were implementing it today?
I'm especially interested in real-world implementations rather than just tooling recommendations.