Building AI-Powered Code Review Systems with Spring Boot and OpenAI API

<!-- pom.xml dependencies -->
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.kafka</groupId>
        <artifactId>spring-kafka</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-webflux</artifactId>
    </dependency>
    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
    </dependency>
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
    </dependency>
</dependencies>

# application.yml
spring:
  datasource:
    url: jdbc:mysql://localhost:3306/code_review_db
    username: ${DB_USERNAME}
    password: ${DB_PASSWORD}
  kafka:
    bootstrap-servers: localhost:9092
    consumer:
      group-id: code-review-group
      auto-offset-reset: earliest

openai:
  api:
    key: ${OPENAI_API_KEY}
    url: https://api.openai.com/v1/chat/completions
    model: gpt-4-turbo-preview
    timeout: 45000
    max-tokens: 2000

github:
  webhook:
    secret: ${GITHUB_WEBHOOK_SECRET}
  api:
    token: ${GITHUB_PAT}
    url: https://api.github.com

@Service
@Slf4j
public class OpenAIService {

    @Value("${openai.api.key}")
    private String apiKey;

    @Value("${openai.api.url}")
    private String apiUrl;

    @Value("${openai.api.model}")
    private String model;

    private final WebClient webClient;

    public OpenAIService(WebClient.Builder webClientBuilder) {
        this.webClient = webClientBuilder
            .baseUrl(apiUrl)
            .defaultHeader("Authorization", "Bearer " + apiKey)
            .defaultHeader("Content-Type", "application/json")
            .build();
    }

    public Mono<CodeReviewResponse> reviewCode(String codeDiff, String language) {
        String systemPrompt = """
            You are an expert code reviewer specializing in %s.
            Analyze the following code diff and provide:
            1. Critical issues (bugs, security vulnerabilities)
            2. Performance improvements
            3. Best practice violations
            4. Code style suggestions

            Format: JSON with severity, line_number, category, and suggestion.
            Be concise but actionable. Focus on high-impact issues.
            """.formatted(language);

        Map<String, Object> requestBody = Map.of(
            "model", model,
            "messages", List.of(
                Map.of("role", "system", "content", systemPrompt),
                Map.of("role", "user", "content", codeDiff)
            ),
            "temperature", 0.3,
            "max_tokens", 2000,
            "response_format", Map.of("type", "json_object")
        );

        return webClient.post()
            .bodyValue(requestBody)
            .retrieve()
            .onStatus(HttpStatusCode::is4xxClientError,
                response -> Mono.error(new OpenAIException("Client error")))
            .onStatus(HttpStatusCode::is5xxServerError,
                response -> Mono.error(new OpenAIException("Server error")))
            .bodyToMono(OpenAIResponse.class)
            .map(this::parseReviewResponse)
            .retryWhen(Retry.backoff(3, Duration.ofSeconds(2))
                .filter(throwable -> throwable instanceof OpenAIException))
            .timeout(Duration.ofSeconds(45));
    }

    private CodeReviewResponse parseReviewResponse(OpenAIResponse response) {
        String content = response.getChoices().get(0).getMessage().getContent();
        // Parse JSON content into structured review findings
        return objectMapper.readValue(content, CodeReviewResponse.class);
    }
}

@RestController
@RequestMapping("/api/webhooks")
@Slf4j
public class GitHubWebhookController {

    @Value("${github.webhook.secret}")
    private String webhookSecret;

    private final KafkaTemplate<String, CodeReviewEvent> kafkaTemplate;
    private final GitHubService githubService;

    @PostMapping("/github")
    public ResponseEntity<String> handleWebhook(
            @RequestHeader("X-Hub-Signature-256") String signature,
            @RequestHeader("X-GitHub-Event") String event,
            @RequestBody String payload) {

        // Verify webhook signature
        if (!verifySignature(payload, signature)) {
            log.warn("Invalid webhook signature received");
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body("Invalid signature");
        }

        // Only process pull_request events
        if (!"pull_request".equals(event)) {
            return ResponseEntity.ok("Event ignored");
        }

        try {
            PullRequestPayload prPayload = parsePayload(payload);

            // Only trigger on opened or synchronized (new commits) actions
            if (!List.of("opened", "synchronize").contains(prPayload.getAction())) {
                return ResponseEntity.ok("Action ignored");
            }

            // Fetch diff from GitHub
            String diff = githubService.getPullRequestDiff(
                prPayload.getRepository().getFullName(),
                prPayload.getNumber()
            );

            // Publish to Kafka for async processing
            CodeReviewEvent event = CodeReviewEvent.builder()
                .repository(prPayload.getRepository().getFullName())
                .prNumber(prPayload.getNumber())
                .author(prPayload.getPullRequest().getUser().getLogin())
                .diff(diff)
                .language(detectLanguage(prPayload))
                .timestamp(Instant.now())
                .build();

            kafkaTemplate.send("code-review-requests", event);

            log.info("Review request queued for PR #{}", prPayload.getNumber());
            return ResponseEntity.ok("Review queued");

        } catch (Exception e) {
            log.error("Error processing webhook", e);
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                .body("Processing error");
        }
    }

    private boolean verifySignature(String payload, String signature) {
        try {
            Mac mac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secret = new SecretKeySpec(
                webhookSecret.getBytes(StandardCharsets.UTF_8),
                "HmacSHA256"
            );
            mac.init(secret);
            byte[] hash = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
            String expected = "sha256=" + Hex.encodeHexString(hash);
            return MessageDigest.isEqual(
                expected.getBytes(),
                signature.getBytes()
            );
        } catch (Exception e) {
            log.error("Signature verification failed", e);
            return false;
        }
    }
}

@Service
@Slf4j
public class CodeReviewConsumer {

    private final OpenAIService openAIService;
    private final GitHubService githubService;
    private final ReviewRepository reviewRepository;

    @KafkaListener(topics = "code-review-requests", groupId = "code-review-group")
    public void processReviewRequest(CodeReviewEvent event) {
        log.info("Processing review for PR #{} in {}",
            event.getPrNumber(), event.getRepository());

        try {
            // Chunk large diffs (>4000 tokens)
            List<String> chunks = chunkDiff(event.getDiff());
            List<ReviewFinding> allFindings = new ArrayList<>();

            // Process each chunk
            for (String chunk : chunks) {
                CodeReviewResponse response = openAIService
                    .reviewCode(chunk, event.getLanguage())
                    .block();

                if (response != null && response.getFindings() != null) {
                    allFindings.addAll(response.getFindings());
                }
            }

            // Deduplicate and prioritize findings
            List<ReviewFinding> uniqueFindings = deduplicateFindings(allFindings);
            List<ReviewFinding> prioritized = prioritizeFindings(uniqueFindings);

            // Post comments to GitHub (limit to top 10 to avoid spam)
            for (ReviewFinding finding : prioritized.stream().limit(10).toList()) {
                githubService.postReviewComment(
                    event.getRepository(),
                    event.getPrNumber(),
                    finding.getLineNumber(),
                    formatComment(finding)
                );
            }

            // Store review in database
            saveReviewRecord(event, prioritized);

            log.info("Review completed: {} findings posted", prioritized.size());

        } catch (Exception e) {
            log.error("Review processing failed for PR #{}", event.getPrNumber(), e);
            notifyFailure(event, e);
        }
    }

    private List<String> chunkDiff(String diff) {
        // Split diff into chunks of ~3000 tokens (rough estimate)
        List<String> chunks = new ArrayList<>();
        String[] lines = diff.split("\n");
        StringBuilder currentChunk = new StringBuilder();
        int tokenEstimate = 0;

        for (String line : lines) {
            int lineTokens = line.length() / 4; // Rough approximation
            if (tokenEstimate + lineTokens > 3000 && currentChunk.length() > 0) {
                chunks.add(currentChunk.toString());
                currentChunk = new StringBuilder();
                tokenEstimate = 0;
            }
            currentChunk.append(line).append("\n");
            tokenEstimate += lineTokens;
        }

        if (currentChunk.length() > 0) {
            chunks.add(currentChunk.toString());
        }

        return chunks;
    }

    private String formatComment(ReviewFinding finding) {
        return String.format("""
            🤖 **AI Code Review** - %s

            **Category:** %s
            **Severity:** %s

            %s

            ---
            *Powered by DevMetrix AI Review System*
            """,
            finding.getTitle(),
            finding.getCategory(),
            finding.getSeverity(),
            finding.getSuggestion()
        );
    }
}

@Component
public class SecurityFilter {

    private static final List<Pattern> SENSITIVE_PATTERNS = List.of(
        Pattern.compile("(?i)(api[_-]?key|apikey)\s*[:=]\s*['\"]?[\w-]+['\"]?"),
        Pattern.compile("(?i)(password|passwd|pwd)\s*[:=]\s*['\"]?[\w-]+['\"]?"),
        Pattern.compile("(?i)(secret|token)\s*[:=]\s*['\"]?[\w-]+['\"]?"),
        Pattern.compile("(?i)jdbc:.*password=[^;\s]+"),
        Pattern.compile("-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----")
    );

    public String sanitizeDiff(String diff) {
        String sanitized = diff;

        for (Pattern pattern : SENSITIVE_PATTERNS) {
            Matcher matcher = pattern.matcher(sanitized);
            sanitized = matcher.replaceAll("[REDACTED]");
        }

        return sanitized;
    }

    public boolean containsSensitiveData(String diff) {
        return SENSITIVE_PATTERNS.stream()
            .anyMatch(pattern -> pattern.matcher(diff).find());
    }
}

public Flux<ReviewFinding> processInParallel(List<String> chunks, String language) {
    return Flux.fromIterable(chunks)
        .parallel()
        .runOn(Schedulers.boundedElastic())
        .flatMap(chunk -> openAIService.reviewCode(chunk, language))
        .flatMap(response -> Flux.fromIterable(response.getFindings()))
        .sequential();
}