# How the Code Review Process Is Initiated in Open-Code-Review: CLI Pipeline Explained

> Initiate the code review process in Open-Code-Review using the `ocr review` CLI command. Discover the 12-step pipeline that validates, configures LLM, and analyzes diffs.

- Repository: [Alibaba/open-code-review](https://github.com/alibaba/open-code-review)
- Tags: how-to-guide
- Published: 2026-08-04

---

**The code review process in Open-Code-Review is initiated by executing the `ocr review` CLI command, which orchestrates a twelve-step pipeline that validates options, configures the LLM runtime, registers tools, and delegates execution to an agent that analyzes repository diffs.**

Open-Code-Review by Alibaba automates code analysis through a command-line interface that transforms Git diffs into LLM-generated feedback. Understanding exactly how the code review process is initiated requires examining the Cobra command definition in [`cmd/opencodereview/review_cmd.go`](https://github.com/alibaba/open-code-review/blob/main/cmd/opencodereview/review_cmd.go) and the subsequent initialization sequence that prepares the runtime environment.

## The Entry Point: ocr review Command

The review lifecycle begins when a user invokes **`ocr review`** (or its alias **`ocr r`**). This command is registered with the Cobra framework in [`cmd/opencodereview/review_cmd.go`](https://github.com/alibaba/open-code-review/blob/main/cmd/opencodereview/review_cmd.go) at lines 49-55. Upon invocation, the command handler executes a deterministic sequence of initialization steps before any LLM interaction occurs.

The command supports multiple operation modes:
- **Standard diff review**: Analyzes staged, unstaged, or committed changes
- **Branch range review**: Compares `--from` and `--to` references
- **Single commit review**: Targets a specific `--commit` hash
- **Preview mode**: Lists files without LLM processing (`--preview`)

## Step-by-Step Execution Pipeline

The `ocr review` command implements a rigorous twelve-stage initialization pipeline defined in the command's `RunE` function.

### Option Validation and Security

First, **`validateReviewOptions`** inspects CLI flags including `--from`, `--to`, `--commit`, and exclusion patterns (lines 90-92). Immediately after, **`validateReviewRefs`** sanitizes Git references to prevent ref-option injection attacks (lines 38-45). This security layer ensures malformed references cannot execute arbitrary Git commands.

### Context Initialization

The pipeline then calls **`loadCommonContext`**, which constructs a `commonContext` struct containing:
- Repository root path
- Rule set configuration
- File filter patterns
- Git runner instance

This context ensures all subsequent operations target the correct Git tree state. If `--background` or `--background-file` flags are present, the system reads and merges this supplementary context into the review scope.

For interrupted sessions, **`loadReviewResumeState`** restores previous execution state using a session ID, enabling fault-tolerant long-running reviews.

### LLM and Tool Configuration

Before analysis begins, the system initializes the AI infrastructure:

1. **`loadLLMRuntime`** builds a runtime (`rt`) that configures the LLM provider, model selection, and tool configuration paths
2. **`buildToolRegistry`** registers built-in tools including `file_read`, `file_find`, `file_read_diff`, and `code_search` through `tool.NewRegistry` and `reg.Register`
3. **`initMCPClients`** optionally connects to external Micro-Code-Provider (MCP) servers, extending the toolset with custom capabilities

### Agent Execution and Result Emission

The final stage constructs the review engine. **`agent.New`** receives an `Args` struct containing:
- Repository location
- Diff range parameters (`from`, `to`, `commit`)
- LLM client instance
- Tool registry
- Telemetry settings
- Concurrency limits
- Background context and resume state

The agent's **`Run`** method executes the core review logic, invoking the LLM for each file or diff chunk. Upon completion, **`emitRunResult`** formats the output as JSON, plain text, or agent-mode format, propagating any errors to the caller.

## Practical Usage Examples

The following commands demonstrate how to initiate reviews under different scenarios:

```bash

# Review all changes in the current workspace (staged, unstaged, untracked)

ocr review

# Review a specific branch range using merge-base comparison

ocr review --from master --to develop

# Analyze a single commit by hash

ocr review --commit a1b2c3d

# Preview which files would be reviewed without LLM processing

ocr review --preview

# Exclude generated files and test data

ocr review --exclude '**/generated/*,**/testdata/*'

# Include background context from a requirements document

ocr review --background-file ./docs/requirements.md

# Resume an interrupted session using the session ID

ocr review --resume 2023-09-12-abcdef

```

## Key Source Files and Architecture

Understanding the initiation flow requires familiarity with these critical components:

| File | Role |
|------|------|
| [`cmd/opencodereview/review_cmd.go`](https://github.com/alibaba/open-code-review/blob/main/cmd/opencodereview/review_cmd.go) | Defines the Cobra command structure and orchestrates the end-to-end pipeline |
| [`internal/agent/agent.go`](https://github.com/alibaba/open-code-review/blob/main/internal/agent/agent.go) | Implements the `Agent` type that executes the LLM-driven review logic |
| [`internal/llm/runtime.go`](https://github.com/alibaba/open-code-review/blob/main/internal/llm/runtime.go) | Manages LLM provider configuration and runtime initialization |
| [`internal/tool/registry.go`](https://github.com/alibaba/open-code-review/blob/main/internal/tool/registry.go) | Registers built-in tools available to the LLM during analysis |
| [`internal/mcp/client.go`](https://github.com/alibaba/open-code-review/blob/main/internal/mcp/client.go) | Handles MCP server connections for extended tool capabilities |
| [`internal/session/run_manifest.go`](https://github.com/alibaba/open-code-review/blob/main/internal/session/run_manifest.go) | Captures and persists review results for output formatting and resume functionality |

## Summary

- The **`ocr review`** CLI command serves as the sole entry point for initiating automated code reviews in the alibaba/open-code-review repository.
- The initiation pipeline validates security constraints through **`validateReviewRefs`** before executing any Git operations.
- The system constructs a **`commonContext`** to maintain repository state, then initializes LLM runtimes and tool registries.
- An **Agent** instance orchestrates the actual diff analysis, utilizing registered tools like `file_read` and `code_search` to provide context to the LLM.
- Support for **resume functionality**, **background context**, and **preview mode** ensures robust enterprise workflows.

## Frequently Asked Questions

### What CLI command initiates a code review in Open-Code-Review?

The **`ocr review`** command (aliased as **`ocr r`**) initiates the review process. Defined in [`cmd/opencodereview/review_cmd.go`](https://github.com/alibaba/open-code-review/blob/main/cmd/opencodereview/review_cmd.go), this command accepts flags for commit ranges, exclusion patterns, and background context to customize the analysis scope.

### How does Open-Code-Review prevent security issues when processing Git references?

Before executing Git commands, the system calls **`validateReviewRefs`** (lines 38-45 in [`review_cmd.go`](https://github.com/alibaba/open-code-review/blob/main/review_cmd.go)) to sanitize and validate all Git refs provided via `--from`, `--to`, or `--commit` flags. This prevents ref-option injection attacks that could execute arbitrary shell commands.

### Can I preview which files will be reviewed without running the LLM analysis?

Yes. The **`--preview`** flag triggers `runPreview` mode, which generates a file list showing exactly which repository files match the current diff criteria and exclusion patterns without invoking any LLM processing or consuming API tokens.

### What happens if a review session is interrupted or fails?

The system captures session state through **`loadReviewResumeState`**, assigning a unique session ID (formatted as `YYYY-MM-DD-abcdef`). Users can resume incomplete reviews by passing this ID to the **`--resume`** flag, preventing redundant LLM API calls and preserving progress on large codebases.