This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady
What I Built
It was 8:45 PM on a Wednesday. My eyes hurt from staring at terminal logs all day, my brain was completely fried, and my dinner was getting cold.
Then came the Slack notification:
"Hey! Just opened a quick PR for user auth and DB pooling. Only 380 lines. Mind doing a fast review before tomorrow's release?"
We've all been there. You know you should check every SQL string interpolation, verify async error boundaries, and hunt down unhandled null pointer exceptions. But your inner sloth is screaming: "I just want to lie on the couch and watch YouTube."
In previous years, being lazy meant either rubber-stamping the PR with a blind "LGTM, ship it" (and getting woken up by PagerDuty at 3 AM when production explodes), or spending an exhausting hour nitpicking code when you'd rather be resting.
So for Hacktoberfest Week 3 (Slow & Steady / International Sloth Day), I channeled my inner sloth and built SlothMerge: The Ghost PR Reviewer.
Code
Ganeshpatel404
/
slothmerge
Local open-source AI agent for auditing PR diffs using Gemma 2 and Sentry Agent Tracing
SlothMerge: The Ghost PR Reviewer
"Build something with open-weight models that rewards laziness."
SlothMerge is an open-source AI agent powered by Google Gemma 2 and instrumented with Sentry Agent Tracing. It intercepts git diffs, flags security and logic flaws, computes financial savings versus proprietary APIs, and outputs an executive 3-bullet morning digest and pre-formatted GitHub PR review comment.
01. Why Open Innovation Matters Here
- Zero Source Code Leaks: Proprietary diffs, database schemas, and business logic stay on your laptop or inside your private VPC. No source code ever touches external AI providers.
-
Zero Recurring API Costs: Instead of paying $0.03 to $0.15 per multi-file PR review on closed APIs, SlothMerge runs on open-weight Google Gemma 2 models (
gemma2:2borgemma2:9b) costing $0.00. - Deterministic & Local: Works completely offline on an airplane or when network connectivity is down.
02. Architecture & Pipeline
[ Git Diff / PRHow I Built It
SlothMerge is built around three core pillars:
- Open-Weight Foundation: Google Gemma 2 I used Gemma 2 (gemma2:2b and gemma2:9b). Gemma 2's sliding-window attention and strong code-comprehension benchmarks make it ideal for parsing compact unified diffs. The prompt uses Gemma's structured turn syntax:
text
user
You are SlothMerge...
model
SlothMerge supports running directly on local hardware via Ollama (http://localhost:11434) as well as an optimized fallback pipeline when running in containerized or offline environments.
- Sentry Agent Tracing (sentry-sdk) Code review agents can be notoriously opaque. SlothMerge uses Sentry Agent Tracing to track every operation into distinct spans:
diff.parse: Extracting changed files, line numbers, and hunks.
ai.inference: Prompt construction, model latency, and token throughput.
output.format: Markdown serialization and clipboard formatting.
Why Does Open Innovation Matter?
Why Does Open Innovation Matter?
Why not just hook up a commercial closed API like GPT-4o or Claude 3.5 Sonnet to a GitHub webhook?
Here is why open innovation made SlothMerge possible in ways a closed API could not:
Zero Code Leakage (Total IP Protection)
Your company's unreleased source code, proprietary algorithms, database schemas, and internal API endpoints should never be sent to a third-party closed API server. With Gemma running locally or in your private VPC, your diff never leaves your machine.Zero Recurring API Costs
A busy engineering team might open 40–80 PRs a day. At ~2,000 to 8,000 tokens per comprehensive diff review, closed APIs quickly accumulate hundreds of dollars a month in recurring costs. Running open-weight Gemma 2 costs exactly $0.00.Reliable Offline Operation
SlothMerge works on an airplane, on a train, or during an internet outage. When the Wi-Fi drops, your code review pipeline doesn't stop
The Lazy Payoff
The Lazy Payoff
Here is the real math behind the sloth approach:
Average PR review time for a human engineer: 25–40 minutes.
SlothMerge audit latency: ~350 milliseconds.
Energy expended by human: 0 calories.
This week alone, SlothMerge audited 3 candidate PRs:
Caught an accidental personal access token commit that would have required revoking credentials.
Flagged an unescaped SQL query that would have introduced a SQL injection vulnerability into user authentication.
Approved a routine string helper refactor instantly, freeing the author to merge without waiting 18 hours for someone to get around to reading their code.
Top comments (1)
the string helper one is what i’d worry about. those diffs look tiny but the risk is in whoever calls it, and that never shows up in the hunks. could grep the changed function names and feed the callers into the prompt. that’s kinda what a PRI (Production Reliability Index) score per change does, looks at the code around the diff. also is the 350ms on the 2b?