OpenCodeReview local code review tutorial: model configuration, Git Diff, full file scanning and CI access

This tutorial by OpenCodeReview focuses on the specific task in the title. Code review output only serves as a review trail; diffs must be qualified, secret files excluded, and recommendations validated with testing and human judgment.

Below is a demonstration using a test environment and revocable data. When accounts, keys, machine control, investments or emergency communications are involved, manual confirmation must be done.

The difference between OpenCodeReview and ordinary LLM posted code

This section only deals with “the differences between OpenCodeReview and ordinary LLM posted code”. Save the current state first and then run the minimal test. Do not change multiple conditions at the same time.

1

git diff --stat

For OpenCodeReview, results must be judged with this boundary in mind: code review output must only serve as review leads; diffs must be qualified, secret files excluded, and recommendations validated with testing and human judgment.

If the results are not repeatable, record the version, input, and logs, then narrow the scope of the test.

Fix Python and Git versions before installation

It is recommended to execute in the following order:

Check the actual version and source.
Use a test account, test directory, or test device.
Perform an undoable action.
Save the output, exit code, or screenshot.
Revert the changes and re-verify.

1
2


python --version
git --version

The completion standard is to “fix the Python and Git versions before installation” to obtain verifiable results, rather than the command just not reporting an error.

Model configuration starts with low-cost samples

Check items	Passing criteria	Stop signal
Model configuration starts with low-cost samples	Input, output, and permission scopes are clear	Tools automatically expand the scope of operations
Source	Can return to the official warehouse or original data	Rely on unknown mirrors or second-hand conclusions
Security	No secret value in log	Token, cookie or private data present
Recovery	Ability to return to pre-execution state	No backup or undo methods

1

Get-ChildItem Env: | Select-String -Pattern 'OPENAI|ANTHROPIC'

When a stop signal appears, resume first and do not continue to the next step.

Only review the current Git Diff

This section only deals with “reviewing only the current Git Diff”. Save the current state first and then run the minimal test. Do not change multiple conditions at the same time.

1

git diff -- .

If the results are not repeatable, record the version, input, and logs, then narrow the scope of the test.

Exclude lock files, build artifacts, and key directories

It is recommended to execute in the following order:

Check the actual version and source.
Use a test account, test directory, or test device.
Perform an undoable action.
Save the output, exit code, or screenshot.
Revert the changes and re-verify.

1

git status --short

The completion criterion is to “exclude lock files, build products, and key directories” to obtain verifiable results, rather than the command just not reporting an error.

Select a dozen lines of changes for the first review

Check items	Passing criteria	Stop signal
Select a dozen lines of changes for the first review	Clear input, output and authority scope	The tool automatically expands the scope of operations
Source	Can return to the official warehouse or original data	Rely on unknown mirrors or second-hand conclusions
Security	No secret value in log	Token, cookie or private data present
Recovery	Ability to return to pre-execution state	No backup or undo methods

1

git diff --numstat

When a stop signal appears, resume first and do not continue to the next step.

How to judge whether the suggestion is a real question

This section only deals with the question of how to judge whether a suggestion is true. Save the current state first and then run the minimal test. Do not change multiple conditions at the same time.

1

git diff --check

If the results are not repeatable, record the version, input, and logs, then narrow the scope of the test.

When to switch between full file scan and diff scan

It is recommended to execute in the following order:

Check the actual version and source.
Use a test account, test directory, or test device.
Perform an undoable action.
Save the output, exit code, or screenshot.
Revert the changes and re-verify.

1

git ls-files | Measure-Object

The completion criterion is “when to switch between full file scanning and diff scanning” to obtain verifiable results, not that the command happens to report no errors.

How to check OCR scan command name

Check items	Passing criteria	Stop signal
How to check the OCR scan command name	Clear input, output and permission ranges	The tool automatically expands the scope of operations
Source	Can return to the official warehouse or original data	Rely on unknown mirrors or second-hand conclusions
Security	No secret value in log	Token, cookie or private data present
Recovery	Ability to return to pre-execution state	No backup or undo methods

1

ocr --help

When a stop signal appears, resume first and do not continue to the next step.

Map severity levels to team rules

This section only deals with “mapping severity levels to team rules”. Save the current state first and then run the minimal test. Do not change multiple conditions at the same time.

1

# blocker / warning / suggestion

If the results are not repeatable, record the version, input, and logs, then narrow the scope of the test.

Only the summary is published in CI without automatic modification.

It is recommended to execute in the following order:

Check the actual version and source.
Use a test account, test directory, or test device.
Perform an undoable action.
Save the output, exit code, or screenshot.
Revert the changes and re-verify.

1

git diff --exit-code

The completion standard is that “only the summary is published in CI without automatic modification” to obtain verifiable results, rather than the command just not reporting an error.

Fork PR Why can’t I get the production key?

Check items	Passing criteria	Stop signal
Why can’t Fork PR get the production key	Input, output and permission scope are clear	The tool automatically expands the scope of operation
Source	Can return to the official warehouse or original data	Rely on unknown mirrors or second-hand conclusions
Security	No secret value in log	Token, cookie or private data present
Recovery	Ability to return to pre-execution state	No backup or undo methods

1

git remote -v

When a stop signal appears, resume first and do not continue to the next step.

How to reduce noise when the number of comments suddenly increases

This section only deals with “How to reduce noise when the number of comments suddenly increases”. Save the current state first and then run the minimal test. Do not change multiple conditions at the same time.

1

git diff --stat origin/main...HEAD

If the results are not repeatable, record the version, input, and logs, then narrow the scope of the test.

What indicators are used to estimate model costs?

It is recommended to execute in the following order:

Check the actual version and source.
Use a test account, test directory, or test device.
Perform an undoable action.
Save the output, exit code, or screenshot.
Revert the changes and re-verify.

1

git diff --numstat origin/main...HEAD

The completion standard is “which indicators are used to estimate the model cost” to obtain verifiable results, rather than the command just not reporting an error.

Which checks to fall back on when the inspector is unavailable

Check items	Passing criteria	Stop signal
Which checks to fall back on when the inspector is unavailable	Clear input, output, and permission scopes	Tools automatically expand the scope of operations
Source	Can return to the official warehouse or original data	Rely on unknown mirrors or second-hand conclusions
Security	No secret value in log	Token, cookie or private data present
Recovery	Ability to return to pre-execution state	No backup or undo methods

1
2


git diff --check
git status --short

When a stop signal appears, resume first and do not continue to the next step.

Preserve reviewable evidence before merging

This section only deals with “preserving reviewable evidence before merging”. Save the current state first and then run the minimal test. Do not change multiple conditions at the same time.

1

git log -1 --oneline

If the results are not repeatable, record the version, input, and logs, then narrow the scope of the test.

How to exclude binary files and generated files

It is recommended to execute in the following order:

Check the actual version and source.
Use a test account, test directory, or test device.
Perform an undoable action.
Save the output, exit code, or screenshot.
Revert the changes and re-verify.

1

git diff --name-only --diff-filter=ACMRT

The completion standard is “how to exclude binary files and generated files” to obtain verifiable results, rather than the command not reporting an error.

Let review suggestions point to the exact line number

Check items	Passing criteria	Stop signal
Let review suggestions point to accurate line numbers	Input, output, and permission scopes are clear	Tools automatically expand the scope of operations
Source	Can return to the official warehouse or original data	Rely on unknown mirrors or second-hand conclusions
Security	No secret value in log	Token, cookie or private data present
Recovery	Ability to return to pre-execution state	No backup or undo methods

1

git diff --unified=3

When a stop signal appears, resume first and do not continue to the next step.

If you reject a suggestion manually, you must also leave a reason.

This section only deals with “Manually rejecting suggestions and leaving reasons”. Save the current state first and then run the minimal test. Do not change multiple conditions at the same time.

1

git status --short

If the results are not repeatable, record the version, input, and logs, then narrow the scope of the test.

Final check of OpenCodeReview

The versions and sources used are documented.
Test input and formal data have been isolated.
Commands, configurations and actual output can correspond.
The failed path was actively tested at least once.
Keys, accounts and private data do not enter Git or logs.
There are clear actions for upgrading, stopping and resuming.

If you still can’t explain how the results are produced, continue to keep OpenCodeReview in the test environment without extending the permissions or replacing the existing stable process.