Alibaba opens the code reviewer it ran internally for two years
Serguey Asael Shinder2 min readAlibaba has released OpenCodeReview under Apache-2.0 at https://github.com/alibaba/open-code-review. It is a command-line tool written in Go that reads a Git diff, sends the changed files to a configurable model through an agent that can use tools, and returns review comments anchored to individual lines. A second mode, ocr scan, reviews whole files rather than a diff — for auditing a directory nobody has read in a while, or a repository that arrives without one.
The repository states the tool was Alibaba's internal code review assistant for roughly two years before it was published. It is not a weekend release either: the project has been public since May, carries an OpenSSF Best Practices gold badge, and shipped v1.12.7 on 19 September — its third release in three days.
The design decision worth noting is that the agent is not asked to do everything. File selection, bundling and rule matching run as deterministic pipelines; the model is invoked for the part that needs judgement, and it can then read a full file, search the codebase and look at the other files in the same change to get context that a diff alone does not carry. Built-in rulesets cover the usual suspects — null-pointer dereferences, thread safety, XSS, SQL injection — and the endpoint is configurable, with OpenAI- and Anthropic-compatible APIs both supported.
What it means
The hybrid split is the transferable idea, not the tool. Deciding which files to look at is a question with a correct answer that a program can compute; deciding whether this lock is held on the wrong object is not. Systems that hand both to the model pay for tokens on work a git diff already did, and get non-determinism in the one part of the pipeline that should be reproducible. Anyone building review automation in-house can take that boundary and leave the rest.
Two years of internal use is the claim to check, and it is checkable. A tool used across a large engineering org accumulates a rule set shaped by the defects that actually occurred there, which is worth more than the model choice. The rules are in the repository; reading them tells you what a very large Java and Go shop keeps getting wrong, which is a more useful artefact than the review comments.
And line-level anchoring is what decides whether it gets used. A reviewer that produces a paragraph about a pull request gets read once. One that attaches a sentence to the line that will cause the null-pointer dereference gets acted on, because the reader does not have to go looking for what it means. That distinction has nothing to do with models and it is where most of these tools fail.