Z.ai Code Bot

Open source · Cloudflare Workers

AI code review,
one comment away.

Z.ai Code Bot listens for /zai comments on your GitHub pull requests and answers with a full-context review written by Z.ai models — or writes the PR description for you. Durable jobs, marker-idempotent comments, zero servers to babysit.

Installation guide Source on GitHub ↗

01 — Commands

Three commands, no ceremony

Type them as a plain comment on any pull request. Only repository collaborators may run them.

/zai review

Runs a full-context review of the pull request — files, commits, and discussion — and posts one consolidated review comment, updated in place on every rerun.

/zai describe

Synthesizes a clean pull-request description from the commit history and rewrites only its own marked section of the PR body — never touching what you wrote.

/zai help

Lists the available commands. Answered instantly by the webhook worker — no queue, no waiting, no job created.

02 — Under the hood

A pipeline built for reliability

  1. GitHub sends a webhook

    Pull-request events and comments hit the main worker's URL. The HMAC-SHA256 signature is verified with Web Crypto before anything else happens.

  2. Authorization, then a durable job

    Commenters must be collaborators of the repository. The command becomes a job in D1 — the single source of truth for all state.

  3. An opaque queue message

    Only { schemaVersion, jobId } travels through the Queue. No secrets, no patches, nothing sensitive in transit.

  4. The heavy worker claims the job

    A private Queue consumer — with no public route and no service binding endpoint — leases the job and starts the real work.

  5. Bounded context goes to Z.ai

    Gathered PR context (files, commits, comments — stored in R2) is assembled into strictly size-capped prompts before it reaches the model.

  6. Results are published idempotently

    One marker-owned review comment per PR; describe updates only its own section of the PR body. Reruns never duplicate output.

03 — Built for production

Small bot, serious engineering

Durable by default

D1 is authoritative. A scheduled sweep recovers expired leases and replays unpublished results after failures.

Idempotent output

Marker-owned comments and PR-body sections mean safe reruns and no duplicated review noise.

Security first

Webhook signature verification, collaborator authorization, and sanitized user-facing errors. Secrets never leave Cloudflare.

Bounded context

Prompts are built from per-file patches with strict size limits — the model sees what matters, not everything.

No public AI endpoint

The worker that talks to Z.ai is reachable only through the Queue. There is nothing to probe or abuse.

Configurable model

Pick any Z.ai model for reviews and descriptions with a single ZAI_MODEL variable.