Review Setup

Connect your Git provider, choose repositories and get your first AI review on a pull or merge request in about ten minutes.

Connect your Git provider once, pick the repositories to watch, and every new pull request (PR) or merge request (MR) in them gets a review with no manual trigger. New to Review? Read the overview first.

Prerequisites

• A CloudThinker workspace where you’re a workspace Admin. Developers and Viewers can see reviews but can’t run setup. See roles.
• An account on GitHub, GitLab, Bitbucket Cloud, Azure DevOps or AWS CodeCommit that can install apps, create access tokens or create IAM roles for the repositories you want reviewed.
• About ten minutes. GitLab, Azure DevOps and CodeCommit need one extra webhook step.
• Self-hosted GitLab only: CloudThinker must be able to reach your GitLab URL over HTTPS, and your GitLab instance must be able to reach the webhook URL the wizard shows.

Each workspace connects one Git provider. If your team uses two, set up Review in a separate workspace for each.

Connect a provider and repositories

1. Open Review

   Click Review in the left navigation. Before setup, the page shows Review smarter. Ship faster.

2. Start the setup wizard

   Click Get Started with Review. The Review Setup dialog opens with these steps: Provider, Connect, Events, Repositories and Learnings. GitHub and Bitbucket skip Events because their webhooks register automatically.

3. Choose a provider

   Under Review Provider, select GitLab, GitHub, Bitbucket, Azure DevOps or AWS CodeCommit, then click Next.

4. Connect your account

   Authenticate the way your provider allows:

   Provider	How you connect
   GitHub	Install GitHub App
   GitLab	OAuth tab (Connect to GitLab, GitLab.com only) or Access Token tab
   Bitbucket	OAuth tab (Connect to Bitbucket) or Access Token tab
   Azure DevOps	Personal access token, then Validate PAT and Connect
   AWS CodeCommit	IAM Role (recommended) or Access Keys

   Not sure which to pick? Use a project, group, workspace or repository access token for a team setup, so comments come from a bot user. Use OAuth for a quick trial on GitLab.com or Bitbucket. Provider authentication has the exact scopes and steps for each one.

   Access tokens and PATs expire. Note the expiry date when you create one, and replace it before then with Update token.

   Success state: the dialog shows Connected and moves to the next step.

5. Add the webhook (GitLab, Azure DevOps, CodeCommit)

   The Events step shows what to set up, then you click Mark as Configured:

   • GitLab and Azure DevOps: add the webhook URL and Secret token in your provider, with the triggers the step lists.
   • AWS CodeCommit: copy the script the step shows and run it. It already contains the URL and secret.

   Configure webhooks has the steps for each one.

   Without this webhook, CloudThinker never hears about new MRs or PRs and no review runs.

   To see the URL and secret token again later, open Review → Settings, and in the Connection section click Webhook.

6. Select repositories

   Under Select Repositories, check each repository to review, then click Next. Use Search repositories… to find one in a long list. Only repositories your connection can see are listed. On GitHub, a repository must also be granted in the app’s repository access first (see GitHub).

   Repositories you create on your provider later don’t appear on their own: add them with Add repository in Review → Settings → Repositories.

7. Learnings

   Two switches decide what reviews learn from. Both start on.

   Switch	When on	Change it later
   Learn from resolved findings	Each week, CloudThinker turns recurring patterns from resolved findings into Learnings for future reviews	On the Learnings page
   Repository conventions	CloudThinker detects convention files, such as AGENTS.md, CLAUDE.md and .cursor/rules/, and follows them in every review. They refresh before each review. See the full list	Review → Settings → Repositories, the row’s actions menu (⋯) → Learning sources

   Click Complete.

   Success state: the Review Overview page loads, and your repositories appear under Review → Settings → Repositories. While CloudThinker clones a repository, its row shows Cloning and its Review switch reads Setting up. If a clone fails, the row shows Setup failed; see repository problems. The workspace starts on the Fast review mode.

Get your first review

1. Open a pull or merge request

   Push a branch to a selected repository and open a PR or MR against it. Don’t open it as a draft: drafts are skipped until you mark them ready for review.

   A PR that arrives while the repository is still cloning gets a “setting up” note and is reviewed once the clone finishes.

2. Read the findings on the PR

   CloudThinker posts a progress comment first, then replaces it with a summary. Inline comments land on the exact lines, each with a severity (Critical, High, Medium or Low), an explanation and a suggested fix.

   Success state: a summary comment appears on the PR, with a link back to the change in CloudThinker.

   Comments come from the identity you connected with:

   How you connected	Comments appear as
   GitHub App	The CloudThinker GitHub App
   GitLab or Bitbucket access token	The token’s bot user
   GitLab or Bitbucket OAuth	The person who connected
   Azure DevOps PAT	The person who owns the PAT
   CodeCommit	The IAM role or user the setup script created

3. Follow up from the PR

   Reply in a finding’s thread to dispute it, or mention the bot in a PR comment:

   @cloudthinker-ai why is this query a problem?
   @cloudthinker-ai review
   @cloudthinker-ai autofix
   

   On AWS CodeCommit, only questions and @cloudthinker-ai help work. CodeCommit ignores review, autofix and replies in a finding’s thread. To review a CodeCommit PR again, push a new commit to its source branch.

   To skip review on one PR, put @cloudthinker:ignore anywhere in the PR description. See mention commands for the full list.

You can also open every reviewed change, with its findings and status, under Review → Reviews. See review workspace.

Choose a review mode

The review mode applies to every repository in the workspace. Change it under Review → Settings → General → Review mode. New workspaces start on Fast.

Review Settings: connected provider, review mode, and Add repository

Mode	What it does	Use it when
Fast	One reviewer reads the change. Quick analysis, lower cost	Most repositories, small PRs, fast feedback
Auto	Picks Fast for small changes and Advanced for complex ones. Shown when it’s available in your workspace; to get it, contact CloudThinker support	Repositories with a mix of small and large changes
Advanced	Splits the change across parallel reviewers for the deepest analysis, at the highest cost	Critical services where a missed defect is expensive

Other workspace settings

These sit in the same General section of Review → Settings and are off until you turn them on.

Setting	What it does
Pipeline analysis	Explains each failed pipeline run and suggests a fix. Each analysis is an agent run and uses credits. See pipelines
Auto-resolve conflicts	Opens a follow-up MR/PR that resolves merge conflicts. Each resolution is an agent run and uses credits. See auto-resolve conflicts
Analyze new release tags	Starts a release risk report when a tag is pushed. Each report uses credits like a review; see usage and credits and releases

For repository switches, Atlas branches and bulk changes, see Manage Review Repositories. To change summary sections, tone or language, see Review Personalization.

Filter which PRs get reviewed

Each repository can have filters, so CloudThinker skips PRs you don’t want reviewed, such as bot dependency bumps.

1. Open the repository's filters

   Go to Review → Settings → Repositories, open the repository’s actions menu (⋯), and click Configure filters.

2. Add rules

   Click Add Filter Rule, pick the filter type, Include or Exclude, and the values. Then click Save Filters.

Filter	Matches
Authors	The PR author’s username, exact match, not case-sensitive. No wildcards. For example dependabot[bot]
Branches	The target branch (the one being merged into). Glob patterns work, for example release/*. Case-sensitive
Labels	PR or MR labels, exact match, not case-sensitive. For example needs-review

How rules combine:

• Exclude rules are checked first. A PR that matches any exclude rule is skipped.
• Every include rule must then pass. Within one rule, matching any of its values is enough.

Put several branches in one Branches rule. Two separate Branches include rules must both match the same target branch, so almost every PR is skipped.

Rules	Reviewed	Skipped
Include Branches main, release/* (one rule)	PRs into main or any release/ branch	PRs into any other branch
Include Branches main plus Include Branches release/* (two rules)	Nothing	Every PR: no target branch is both main and a release/ branch
Include Branches main plus Include Labels needs-review	PRs into main that carry needs-review	PRs into main without the label, and every PR into another branch

Filters are checked on every new event, so they also apply to MR/PRs CloudThinker already tracks, from their next push. To review one filtered MR/PR anyway, comment @cloudthinker-ai review on it. CodeCommit has no review command, so a filtered CodeCommit PR stays unreviewed until you change the filters and push a new commit.

For example, Exclude Authors dependabot[bot] plus Include Branches main reviews every PR into main except Dependabot’s. A skipped PR is tracked but not reviewed: it shows on Review → Reviews in the All tab with the Ignored verdict. See verdicts.

Troubleshooting

No comment appears on a new PR

Cause: the PR is a draft, the repository isn’t selected or is still cloning, a filter excluded it, or the webhook is missing.

Check: open Review → Settings → Repositories and confirm the repository is On. Then check your provider:

• GitHub: in your organization or account settings, open GitHub Apps, click Configure next to the CloudThinker app, and confirm the repository has access.
• Bitbucket: in Repository settings → Webhooks, confirm the CloudThinker webhook exists and its recent requests succeeded.
• GitLab: in Settings → Webhooks, edit the CloudThinker webhook and check Recent events for failed requests.
• Azure DevOps: in Project Settings → Service hooks, open each CloudThinker subscription and check its History.
• CodeCommit: there’s no webhook log. In Amazon EventBridge, in the repository’s region, confirm the CloudThinker-CodeCommit-* rules exist. If they don’t, re-run the Events script.

Fix: mark the PR ready for review, enable the repository, or re-add the webhook. Then comment @cloudthinker-ai review on the PR to start a review without pushing. On CodeCommit, push a new commit to the PR’s source branch instead.

Review shows Reconnect your Git provider

Cause: the token expired or was revoked, or the OAuth grant was removed.

Fix: the Review page shows an Authentication Error alert. If you connected with OAuth, click Reconnect with GitLab (or Bitbucket) and approve access again. If you used a token, click Update Token (on CodeCommit, Update Credentials), paste the new one and validate it. Your repositories and settings are kept.

A PR opened while the connection was broken may have no review. Comment @cloudthinker-ai review on it to start one, or on CodeCommit, push a new commit to its source branch.

To replace a token before it expires, open Review → Settings, and in the Connection section open the actions menu (⋯) and click Update token.

A review stopped before posting its summary

Check: the progress comment on the PR now reads CloudThinker Review Did Not Finish, and may say why, for example that CloudThinker couldn’t open the repository. In CloudThinker, open the review and use More actions (⋯) → View review conversation to see the run.

Fix: if the repository couldn’t be opened, reconnect it in Review → Settings. Then comment @cloudthinker-ai review on the PR to continue from the last reviewed commit. On CodeCommit, push a new commit to the PR’s source branch instead.

The PR says Code Review Stopped (Quota Exceeded)

Cause: your workspace ran out of its usage quota, so the review couldn’t finish.

Check: Admin Settings → Usage shows the credits your organization has left (the Owner and Admins can open it). A workspace can also hit its own credit limit.

Fix: upgrade your plan or wait for the quota to renew (see usage and credits for when each credit type resets), then comment @cloudthinker-ai review on the PR. On CodeCommit, push a new commit to the PR’s source branch instead.

A repository shows Setup failed or stays on Cloning

Check: in Review → Settings → Repositories, hover Setup failed to see the clone error. It’s often an expired token or missing access to that repository.

Fix: fix the access, then click Retry on the row. If a clone stays on Cloning, click Cancel and confirm Cancel clone. The row shows Setup cancelled; click Retry.

Next steps

Walkthrough: watch Review stop a change that would break production in Catch a risky pull request with Review.

Provider authentication

Token scopes and webhook steps for each Git provider.

Mention commands

Ask questions, re-review and fix findings from a PR comment.

Review workspace

Track every reviewed change and its findings in CloudThinker.

Learnings

Teach reviews the patterns your team keeps fixing.