How-to
Post a code review to a pull request
Updated
On this page
Post a finished Zof code review to its pull request on GitHub, as comments and a Zof / Review check. It takes about 2 minutes, and you need a company role granted review access. Members, company admins, and permitted custom roles can post; built-in viewers remain read-only.
A posted review is advice for the people reviewing the pull request. It never blocks a merge.
Start a review
In Code review, choose New review. Browse open pull requests across your connected repositories, or choose a repository to narrow the list. Search loaded PRs by title or number; Load more pull requests continues the list.
Select a PR row, enter its number with a repository selected, or paste its GitHub URL. Zof looks it up automatically and shows the title and current head commit. A newly opened PR can be looked up even before it appears in the loaded list. If Zof has not received it yet, wait briefly and retry.
Choose the primary Review button, which names your PR number, to start. The row's Review shortcut uses the current reviewer choices, focus paths and instructions. If that head already has a review, Open it shows the existing result. Review again explicitly starts another after the previous review finishes. An unavailable history check must be retried before starting another review.
If Review is off and says "Needs a plan." or "Payment is overdue.", billing has paused new reviews for your company. If you manage billing, the message at the top of the form links to Choose a plan, and for an overdue payment it says to see Billing. Otherwise, or when Zof can't tell, it says to ask a company admin. After you choose a plan in another tab, come back: the message clears when a fresh wallet check confirms this company can start. An unavailable check keeps the refusal. If Try again is offered, it clears the local refusal so you can retry; it does not itself refresh billing or start a review. Reviews you already have, their findings and posting stay available. The same applies to Review now and to a finding's Turn into test.
Head updated shows when GitHub updated the tracked head. Update time unavailable means Zof does not have that timestamp. The target branch is the branch the PR merges into. Full commit SHA reviews remain available with a repository selected.
Before you start
- The review has finished. Until then, Post to GitHub is off and says "The review hasn't finished yet."
- The review belongs to a pull request. Otherwise the review has no Post to GitHub button, and its summary says "This review isn't attached to a pull request".
- The Zof GitHub App is installed on the repository. See Connect GitHub.
- Review posting is on. If Post to GitHub is unavailable and says 'Posting status not available yet', review posting isn't on yet. Email support@zofai.com. See What's built.
Post the review
- In the sidebar, open Code review.
- Open the review.
- At the top of the review, click Post to GitHub.
A message says "Posting to GitHub…". The review's summary card has a posting line. It says "Posting…" while the post waits to reach GitHub. It updates on its own, then says "Posted to GitHub:" and how many comments it posted with a summary.
When Post to GitHub is off
The button says why next to it.
| Next to the button | What it means |
|---|---|
| "Checking your permissions…" | Zof is still reading your role. Wait a moment. |
| "Couldn't check your permissions." | Zof couldn't read your role. Reload the page. |
| "The demo is read-only" | You're in the demo. Nothing can be posted from it. |
| "Viewers can't post reviews" | Your company role is viewer. Ask a company admin. |
| "Your role can't do this." | Your company role can't post. Ask a company admin. |
| "The review hasn't finished yet." | Wait for the review to finish. |
| "A post is already queued." | Zof is already posting this review. Wait for the posting line to change. |
| "Checking posting status…" | Zof is still reading the posting status. Wait a moment. |
| "Posting status unavailable" | Zof couldn't read the posting status. Try again in a minute. |
| "Posting status not available yet" | Review posting isn't on yet. Email support@zofai.com. |
What Zof posts
- Comments on the changed lines, for findings on the diff that meet the repository's minimum severity.
- One summary comment on the pull request.
- A
Zof / Reviewcheck. It's always neutral, so it never blocks a merge. An AI finding is a lead, not proof. It never blocks a release on its own.
Under the posting line, Zof counts the findings: how many were posted as comments, how many were below the threshold, how many were off the diff, and how many are in the summary only.
Check that it worked
- On the review's summary card, the posting line starts with "Posted to GitHub:". "Posting…" means the post hasn't reached GitHub yet. Any other line means it wasn't posted; see the table below.
- Under it, click the Summary comment and Zof / Review check links.
- On GitHub, the pull request has Zof's comments and a neutral
Zof / Reviewcheck.
If it wasn't posted
| The posting line says | What to do |
|---|---|
| "Not posted yet" | Click Post to GitHub. |
| "Not posted: the pull request moved on" | The pull request has a newer commit than the review. Click Review now, then post the new review. |
| "Not posted: review doesn't match this head" | The review was made for a different commit. Click Review now, then post the new review. |
| "Not posted: pull request closed" | Nothing to do. Zof doesn't post to a closed pull request. |
| "Waiting for the review to finish" | Post it once it has finished. |
| "Not posted: the GitHub App can't comment on this repository" | Ask an admin to check the GitHub App's permissions for the repository. |
| "Posting isn't set up for this repository" | Ask an admin to add the repository to the Zof GitHub App on GitHub. |
| "Posting isn't set up for this organization" | This part of Zof isn't set up for your company yet; nothing is posted or shown as passing until it is. Email support@zofai.com. |
| "Posting failed" | The post didn't reach GitHub. Click Post to GitHub again. |
| "Save code review settings first" | Zof posts only for a repository whose code review settings are saved with posting on. Ask a company admin to save them, then click Post to GitHub again. |
| "Not posted: the review failed" | The review failed in Verification. Click Review now, then post the new review. |
| "GitHub isn't connected" | The Zof GitHub App isn't connected to your company. A company admin starts Connect GitHub from Integrations. See Connect GitHub. |
| "Posting status unavailable" | Zof couldn't read the posting status. If a Retry button shows under it, click it. Otherwise try again in a minute. |
| "Posting status not available yet" | Review posting isn't on yet. Email support@zofai.com. |
If Zof refuses the post, a message says why, and nothing is posted. For example: "Zof can't post reviews for this company yet. Ask an admin."
Post reviews on their own
New connected repositories start with automatic reviews and posting on. An admin can change this in Code review → Settings: set Review and Post to GitHub on the repository's row, then click Save. Each repository has its own setting, and the same row sets the minimum severity for line comments. Existing saved choices stay in effect.
Connected, active repositories appear even before anyone saves settings. A new repository says "Using defaults" until an admin saves its settings; automatic reviews and posting use the defaults its row shows in the meantime. The list shows up to 50 repositories and tells you when it is incomplete. If one repository's settings cannot be read, its row shows an error.
Draft pull requests are skipped by default. Tick Review draft PRs and click Save to include them in automatic reviews. With the default Every pull request setting, marking a draft ready for review starts a review of its current head.
Saved review opt-outs and the Only on @zof review setting also apply when a release policy requires a review. A review that skips eligible files because of size or budget limits remains incomplete. An incomplete review's page says why it stopped, for example the AI provider was rate limited, and how each reviewer ended.
An admin can also tick Auto-post on a review's summary card. It is the same setting as Post to GitHub in Settings. Reviews post on their own only when Review is also ticked for that repository. Anyone else sees "Auto-post: on" or "Auto-post: off". Until the repository's settings have been saved, the summary-card box is disabled and appears off; save the row in Settings to use that toggle. With Auto-post off and nothing posted yet, the card says nothing reaches GitHub until someone posts, with a link to Review settings. A high or critical finding shows its release decision with "The review explains; tests and policy decide.": the review explains the risk, and the tests and the release policy decide the release.
Fix unresolved findings
Open a completed review and choose Fix. Your saved fix provider is selected in the drawer. Codex is the initial default; you can choose Claude Code, DeepSeek or Kimi with your own API key, unless your admin turned that provider off. Zof uses the current unresolved findings at the reviewed commit. Members, admins and permitted custom roles can request fixes; built-in viewers cannot.
A manual repository review needs a Target branch for the next fix that still points to its reviewed commit. Enter its name and choose Check branch, then explicitly request the fix. PR reviews use the original PR's head branch. The review's comparison base does not choose a target. Backtests and reviews with no actionable findings cannot generate fixes.
When the patch is ready, Zof opens a draft pull request by itself while the panel stays open. If you closed it, choose Fix again, then Open pull request. Review it on GitHub. See Fix a failure with Codex or your own API key for setup, personal keys and publication requirements.
Remove an old review from the list
A company admin can open a review's More actions menu in Code review → Reviews and choose Remove from list. The confirmation names its repository and pull request. Choose Remove to hide that entry from the company's list, including after a reload. Choose Cancel to keep it.
This only changes the list. The review's detail link, findings, evidence, and existing GitHub posts remain available. It does not disconnect the repository or delete anything on GitHub. If removal fails, the entry stays visible and you can try again.