Skip to content

Weekly codebase review report

Once a week it reviews the whole repo, focusing on what changed since last time. It tracks each finding as new, still open or fixed, and nothing blocks on it.

EngineeringWorks with Claude Code · OpenAI Agents SDK+1Community example
Build your promptSee requirements

What it does

  • Reads the week's commits and changed files
  • Reads last week's report
  • Reviews the code and marks findings as new, still open or fixed
  • Writes the report as a file for the team

Your approval boundaries

Approval required

These actions always wait for your yes:

  • Posting the report as an issue
  • Any code change, branch or pull request

You decide what happens next.

More about this workflow

This setup is for developers and small engineering teams who want fewer chores. It takes a repeat chore off your plate and hands back something you can check quickly.

First, it reads the week's commits and changed files. Next, it reads last week's report. Then it reviews the code and marks findings as new, still open or fixed. Finally, it writes the report as a file for the team. It works with your git host and CI, each on its own login with limited access.

You get the prep work done and waiting for you. The agent stops and asks for your yes before posting the report as an issue and any code change, branch or pull request, and says plainly if a step cannot be undone.

“The report is advisory. Nothing blocks on it.”
ivargr ivargr on GitHub · Sep 22, 2026
Before you startGit host · CI accessScoped permissionsClaude Code or OpenAI Agents SDK
Explore required tools and model recommendations

Tools and access

  • GitHub

    Handles the git host and ci part of this job. Grant a fine-grained token, read code and write comments.

    API required: Yes. Needs a GitHub App or a fine-grained personal access token scoped to the repos it needs.

    Sign up: Create a GitHub account

Official links only. Not sponsored, no affiliate links.

Model recommendations

Best pick

Claude Opus 5.5

Its maker points to it for long running coding work.

$4 per million input tokens, $20 per million output tokens.

Anthropic docs as of October 11, 2026

Cheaper backup

Claude Sonnet 5.5

Half the price per token and still strong for reviews and docs.

$2 per million input tokens, $10 per million output tokens.

Anthropic docs as of October 11, 2026

Our own picks. Not sponsored, no affiliate links.

Build your prompt

Add your details, then copy the prompt into your tool.

1Your details

Fill these in and the prompt updates as you type.

day and time

deliberate design choices

issue label or folder

2Your prompt

4 of 4 still empty
Fill these in before you run it: [YOUR REPO] [WHEN TO RUN: day and time] [THINGS IT SHOULD NOT FLAG: deliberate design choices] [WHERE THE REPORT GOES: issue label or folder] You are the Weekly codebase review report agent. Once a week it reviews the whole repo, focusing on what changed since last time. It tracks each finding as new, still open or fixed, and nothing blocks on it. Use only the details filled in above. If any [BRACKETED] item is still blank or unclear, stop and ask for it first. Do not guess. What you do on your own: - Reads the week's commits and changed files - Reads last week's report - Reviews the code and marks findings as new, still open or fixed - Writes the report as a file for the team What you must never do without a yes from a person: - Posting the report as an issue - Any code change, branch or pull request Rules: - Before any step on the list above, stop and ask. Say in plain words what you want to do, who it affects, and whether it can be undone. - If something cannot be undone, say so first, in one short line. - Write drafts, not final actions. A person sends, pays, posts, or deletes. - Keep a short log of every action you took and every source you read. - If you are unsure, ask instead of guessing.
View run instructionsPaste into: Claude Code, OpenAI Agents SDK, Cursor

Your answers stay in this browser only.

Run your workflow

Connect your tools with only the access this setup needs, then follow these steps.

Steps

Do these in order. Test on old data before it touches live work.

  1. 1Connect GitHub with its own login, not yours. Grant a fine-grained token, read code and write comments.
  2. 2Paste the prompt where your harness takes instructions. See the note under the Copy button.
  3. 3Do a dry run on old or test data first. Check every draft and every stop point by hand before you let it near live work.
  4. 4Read its log after the first real run. Only widen access once a week of runs looks clean.

Safeguards and trust score

The score describes this example setup’s access, approval boundaries, ability to undo changes, and scope.

Access18 / 30

Can draft things that send or spend, so it sits close to risky actions.

Human approval30 / 30

Waits for a yes on: posting the report as an issue, any code change, branch or pull request.

Undo and logs14 / 20

Proposes changes to live records, so the setup needs a change log and a way back.

Scope18 / 20

Runs on its own login across 2 tools. Fewer connections means a smaller blast radius.

How to raise it

  • Access: Take away its ability to send, post or spend. Let it only write drafts, and have a person press send or pay from their own account +6
  • Undo and logs: Stop it from editing live records. Have it write the change as a proposal you apply, and keep a log of every change with a way to roll it back +3
  • Scope: Run it on one tool only, with its own login that can see just what this job needs +2

Do all of these to reach 91, up from 80.

Want help getting there? Get an AI Trust Audit from Pixeldesigns

Reviewed by Trustcase (example setup). How scoring works

Embed badge

Show this trust score on your site or README. It links back here.

Trustcase trust score badge
Markdown
[![Trustcase trust score for Weekly codebase review report](https://trustcase.dev/badge/weekly-codebase-review-report.svg)](https://trustcase.dev/use-cases/weekly-codebase-review-report)
HTML
<a href="https://trustcase.dev/use-cases/weekly-codebase-review-report"><img src="https://trustcase.dev/badge/weekly-codebase-review-report.svg" alt="Trustcase trust score for Weekly codebase review report" height="20"></a>

More engineering workflows

  • Small fix pull requests

    Runs on a schedule and opens one small pull request per fix, each proven by a test that failed before and passes after. Changes collect on a dev branch and you decide when they ship.

  • New issue intake sorter

    Reads each new issue on your repo and sorts it as ready to work, needs more info, or too big. You get a clean queue and reporters get asked for missing details.

  • Merged changes digest

    Reads every pull request merged since the last run and writes a short digest of what changed. Each change is sorted by who it matters to and how big it is.

  • Morning QA report

    Runs a set of read-only checks on your codebase each morning and files one report issue. It starts as an observer and only gets more power when you grant it.