Best free code review bot for open-source projects on GitHub

Alright, let's cut through the marketing fog. Everyone's tripping over themselves to shove an "AI-powered" bot into their PRs, promising the moon while delivering a deluge of false positives and architectural nonsense. For an open-source project, you need something that doesn't require a PhD in YAML to configure, doesn't drown your volunteers in noise, and crucially, doesn't cost a dime.

After wrestling with more of these than I care to admit, here's the pragmatic breakdown for a GitHub-hosted OSS project.

**The Contenders & The Reality**

* **GitHub's own CodeQL:** This is the heavyweight, but not in the way you think. It's a static analysis security tool, not a general-purpose style nitpicker. Its value is in finding real, exploitable vulnerabilities (like SQLi, XSS) in a codebase. For a free OSS project, you get advanced security scanning on par with enterprise offerings.
* **The Catch:** It's not going to comment on your code structure or tell you a function is too complex. It's laser-focused on security. Setup involves committing a config file to your repo. If you're not prioritizing actual security flaws, look elsewhere.

* **SonarCloud (Free Tier):** The old guard, now with a sprinkle of AI glitter. It's comprehensive to a fault. You'll get everything from bug detection, code smells, to duplications and coverage.
* **The Over-Engineering Alert:** This is where the "noise" problem becomes critical. Out of the box, it will flag *everything*. You **must** spend time tuning the quality profile, disabling rules that don't align with your project's style (e.g., "Cognitive Complexity" can be a rabbit hole). The free tier is generous for public repos, but prepare for an initial onslaught of issues that will demoralize newcomers if not curated.

* **CodeRabbit:** They have a solid free plan for public repos. Their differentiator is the "changelog" summary and inline comments that are sometimes more conversational.
* **The Hype Check:** It's still an LLM under the hood. You will get "suggestions" that are, frankly, wrong or inappropriate. I've seen it propose breaking a simple, cohesive class into three microservices because it "violated the Single Responsibility Principle." You need a strong lead to review *the bot's comments* for sanity.

**The Config Tuning Imperative**

This is the non-negotiable step everyone forgets. Throwing an untuned bot at your PRs is like handing a megaphone to a pedant. Here's a minimal `sonar-project.properties` starter to avoid the worst of the noise:

```properties
sonar.projectKey=your_project_name
sonar.organization=your_github_org

# Critical exclusions for a sane life
sonar.exclusions=**/*.min.js,**/vendor/**,**/node_modules/**,**/dist/**,**/coverage/**
sonar.cpd.exclusions=**/*.test.js,**/*.spec.js

# Turn off the most opinionated rules for starters
sonar.issue.ignore.multicriteria=e1,e2
sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S4323
sonar.issue.ignore.multicriteria.e1.resourceKey=**/*
sonar.issue.ignore.multicriteria.e2.ruleKey=javascript:S117
sonar.issue.ignore.multicriteria.e2.resourceKey=**/*
```

**My Take:** If your primary concern is **security**, GitHub CodeQL is a no-brainer freebie. If you want **general code quality** and have the bandwidth to aggressively curate the ruleset, SonarCloud's free tier is powerful. If you want something lighter and are willing to vet its occasionally unhinged architectural advice, CodeRabbit's free plan is worth a trial.

But remember, no bot replaces a human understanding context. These tools are good at finding *what* is written, but clueless on *why*. The moment they start suggesting architectural changes based on a 10-line diff, you've entered the realm of cargo-culting automation.