Code Review Post Commit, Self-Hosted
The Modern JetBrains Upsource Alternative
Commits piling up unreviewed. Diffs that don't show what actually changed. Reviewers who forget. Code that can't go to the cloud. Codeveira solves all of it — a self-hosted code review platform that deploys in minutes and automatically opens a review on every push, with move-detection diffs, AI reviewer, and IDE integration for GitLab, GitHub, Gitea, Forgejo, Bitbucket, Azure DevOps and Gerrit.
Click to zoom
Code review shouldn't feel like this
Every team has the same problems. Here's what Codeveira fixes.
"Who's reviewing this?"
Commits go unreviewed because no one knows whose turn it is. Reviews pile up. Bugs reach production.
→ Codeveira: auto-creates a CR on every push, assigns reviewers, sends notifications.
"It's been sitting open for a week"
Reviews stall. Context is lost. The developer has moved on to three other things by the time feedback arrives.
→ Codeveira: stale CR badges, cycle time metrics, Slack/email nudges — reviewers don't forget.
"The diff is unreadable"
Moved code shows as a sea of red and green. Reviewers can't tell what actually changed versus what was just relocated.
→ Codeveira: move detection highlights relocated blocks in purple — zero false noise.
"Our code can't leave the building"
SaaS review tools are off the table. Compliance, security policy, or air-gapped infrastructure means cloud is not an option.
→ Codeveira: fully self-hosted on your own servers. Your code never touches external services.
Code Review Post Commit Features:
Diff Engine, AI Reviewer & Integrations
From automated CR creation to advanced diff visualization — Codeveira covers the full code review post commit lifecycle.
Smart Diff Visualization
Advanced diff engine with move detection, token-level inline highlighting, long-line wrapping, and per-file side-by-side view. Syntax highlighting for 30+ languages — Ruby, JS, TS, Python, Go, Java, PHP, C#, SQL, YAML and more — coloured server-side with Rouge, theme-safe inline styles.
8-Platform Integration
Connect repositories from GitLab, GitHub, Gitea, Forgejo, Bitbucket Cloud, Bitbucket Server, Azure DevOps or Gerrit with an access token. Live commit and diff fetching via each platform's API. Webhook-powered automatic CR creation on every push.
Inline Comments & Threads
Comment on any diff line — added, removed, or modified. Reply threads keep discussions organized. Emoji reactions (👍 👎 🎉 and 12 more) let reviewers acknowledge comments at a glance. Watchers (Standard+) follow a review without being assigned — they get all notifications but don't have to approve. Attach a one-click-appliable suggested fix to any comment, or flag it Nitpick to signal a non-blocking nit instead of a real blocker.
Labels & Resolution
Categorize comments with custom color-coded labels — create them per repository. Mark comments as resolved with a single click; resolved comments gray out so reviewers focus on what's still open.
Review Workflow
Assign multiple reviewers per CR. Each reviewer independently approves or rejects. The CR auto-transitions to approved when all reviewers agree. Email notifications and real-time in-app alerts at every step. Save a CR as a draft to assign reviewers and trigger AI/CI feedback without notifying anyone — click Mark ready for review when it's time to notify reviewers.
Dashboard & Analytics
Live statistics: open, approved, pending reviews. Fully configurable layout — every element is a draggable, resizable tile on a free-form 2D grid. Drag tiles anywhere, resize by pulling edges or corners, add or remove tiles via the Add widget panel, and reset to the default at any time. Eight available tiles: Overview, Repositories, Commits, All Code Reviews, My Assigned Reviews (pending review queue for the current user), Needs Your Response (your own open reviews with an unresolved comment waiting on your reply), Recent Activity (chronological feed of new CRs, comments, approvals and rejections), and Favorites (auto-ranked top repositories by recent code review activity — each with a 12-week mini commit bar chart showing total commits in gray and commits in open CRs in blue). Layout is saved per user. Filter CRs by status, reviewer, time range, label, or stale flag — all client-side with no page reload. Open CRs older than 7 days get an amber stale badge automatically. Reviewer read-progress bars on every review show how many diff files each reviewer has read — updated in real time via WebSocket.
Repository README
View a repository's README.md rendered as formatted HTML — directly from the repository page or via a hover icon on the dashboard. Markdown is fetched live from HEAD and rendered with syntax-highlighted code blocks, tables, autolinks, and strikethrough. Works across all 8 supported platforms.
Compare Files & Repos
Two modes in one tab. Single file: pick any file from any two repos via searchable dropdown, select a branch from a live branch list for each side, and view a side-by-side diff with full syntax highlighting. Full repository: select two repos and branches to see which files exist only in A, only in B, or in both — with a direct Compare link for any file. Accessible from the Compare tab in the navbar (Standard+).
Source Badges
Every repository, commit and code review displays a colour-coded platform badge — so your team always knows at a glance which of the 8 supported platforms the code comes from. The repository list also lets you filter by platform, status, and whether there are open CRs — all client-side with no reload.
Language Detection
Every commit and code review displays a GitHub-style language bar — a proportional breakdown of programming languages detected from the diff. Powered by file extension mapping with GitHub's official language colors.
AI Reviewer
Add an AI bot as a reviewer on any code review. It analyzes the diff, detects programming languages, and posts inline comments with language-specific feedback. Works with Claude (Anthropic), OpenAI, DeepSeek, Gemini, Qwen, or any local model — Ollama, LM Studio, vLLM and other OpenAI-compatible servers. Each bot can run automatically on every commit or on-demand only.
Custom AI Prompts
Define and manage system prompt templates for your AI reviewer bots. Use {{languages}} and {{guidelines}} placeholders to inject language-specific guidelines automatically. Assign a different prompt to each bot — security-focused, style-only, or anything in between.
Webhook Delivery Log
Every incoming push event from every platform is logged in Settings → Webhook Deliveries — source, event type, status, timestamp, and error details. Failed deliveries can be retried with one click, re-enqueuing the original payload for reprocessing.
Slack, Teams, Email, Webhook & SMS Notifications
Send review events to Slack, Microsoft Teams, email, a global outgoing webhook, or via SMS (any HTTP API provider — SMSAPI, Twilio, Vonage, MessageBird, Infobip). Configure all channels in Settings → Notifications. Per-channel event toggles, fully customisable message templates with {{cr_id}}, {{title}}, {{status}}, {{repository}}, {{author}} variables, and HMAC-SHA256 signature on webhook payloads.
Audit Log
Every significant action is recorded in Settings → Audit Log — review status changes, comment operations, user management, repository changes, and settings updates. Each entry captures actor name, target, structured details, and real client IP (X-Forwarded-For aware). Filterable by actor and action category. Enterprise: export the filtered log to CSV or JSON (up to 10 000 events) and forward every event in real-time to Logstash, Elasticsearch, Splunk HEC, Datadog, or any SIEM via configurable HTTP webhook.
CI Status Badge
Enterprise — display live CI build status on every review. Any CI system (Jenkins, GitHub Actions, GitLab CI, CircleCI…) can POST a simple JSON payload to /webhooks/ci with a secret token and a commit SHA; Codeveira updates the badge in real-time via Turbo Streams. Configure the token and see example code under Settings → CI Integration.
Code Coverage Overlay
Enterprise — upload a coverage report from your CI test run and Codeveira overlays it directly on the diff view: a green stripe on covered lines, red on uncovered, in both combined and side-by-side views. Auto-detects lcov (JS/TS, C/C++), JaCoCo (Java/Kotlin), Cobertura (also from Python's coverage.py, PHPUnit), SimpleCov (Ruby), or Go's own cover profile. Codeveira never runs your tests or compiles anything — pure ingest and display of a report CI already produced.
Architectural Lint & Duplicate Code Detection
Standard+ — two checks, both off by default. Architectural Lint runs a small fixed rule set on every push: Ruby (raw-SQL string interpolation) and TypeScript (explicit any) use the same tree-sitter parse the symbol indexer already does, while Go (golangci-lint), Python (Pylint), PHP (PHP_CodeSniffer + a security-audit standard covering SQL injection, eval()/exec(), and more), Java (PMD), Kotlin (detekt), Ruby (RuboCop's Security department), and JavaScript (ESLint) run in a dedicated, isolated container — fully offline, no dependency resolution, no code execution. Duplicate Code Detection flags a changed method that's near-identical to another method anywhere in the repository — every function/method-sized definition already gets a body-only, whitespace-normalized fingerprint during indexing, so a duplicate is just a lookup against existing data, no external tool required. Both post inline review comments from their own dedicated bot account.
Semantic Search
Standard+ — natural-language code search ("where do we handle JWT tokens") right in ⌘K/Ctrl+K search, alongside repos, reviews, and commits. Every function/method the tree-sitter indexer already extracts gets embedded via a self-hosted Ollama instance you configure — no code ever leaves your infrastructure, no pgvector extension, no separate vector database. An upgrade to search, not a replacement for Find Usages/Go to Declaration.
Semantic Analysis (Go, TypeScript, Python, Java, Kotlin, PHP, C# & Ruby)
Enterprise — real, type-resolved semantic analysis, not name-matching: drives the actual gopls Go language server, typescript-language-server, pyright, Eclipse JDT Language Server, kotlin-language-server, Psalm's psalm-language-server, OmniSharp-Roslyn, or ruby-lsp with RuboCop (pick one per repository) against your repository on every push, so you get real compiler diagnostics and type-resolved definitions alongside the existing tree-sitter symbol index. Off by default, opt-in per repository. Rails is the only thing that ever talks to your git host — it fetches the repository archive itself and streams it to an isolated per-language analysis container, each reaching the internet only through its own dedicated egress allow-list proxy (Go's scoped to the Go module proxy's domains, TypeScript's scoped to the npm registry, Python's scoped to PyPI, Java's and Kotlin's scoped to Maven Central, PHP's scoped to Packagist and GitHub's package-download hosts, C#'s scoped to NuGet, Ruby's scoped to RubyGems). Each language also keeps a persistent, shared dependency-install cache, so a package already downloaded once isn't re-fetched on every push. Every diagnostic is posted straight into the diff as a real inline comment from a dedicated bot account as soon as a run completes — no separate panel to check, and when a repository has this enabled, Find Usages and Go to Declaration automatically prefer these real, type-resolved results over the tree-sitter index. A review-page panel still shows run status, diagnostic/definition counts, and a staleness warning. Go, TypeScript (.ts/.tsx/.js/.jsx), Python (.py), Java (.java, Maven only), Kotlin (.kt/.kts, Maven only), PHP (.php, diagnostics only — no definitions), C# (.cs, both diagnostics and definitions), and Ruby (.rb, RuboCop-derived lint diagnostics, not compiler type errors, plus real definitions) — all eight originally-scoped languages now ship.
Cycle Time Metrics
Per-repository analytics at Repository → Metrics. Track how long code reviews take from creation to approval. See median, p90, and average cycle times; a distribution chart bucketed from <1h to >7d; and per-reviewer response time tables. Filter by 7d, 30d, 90d, or 1y.
Repository Analytics
Seven-tab analytics page per repository with a breadcrumb header linking back to the repo. Commit Activity — bar chart + per-author dot timeline, 4 time ranges. Code Review — CR stats and reviewer response times. Project Treemap — squarified SVG treemap of directories sized by commit frequency. File History — sortable, filterable table of every changed file. Reviewers Graph — author × reviewer matrix with colour-coded intensity. Hotspots — files ranked by churn × usage, so you see what's both actively changing and widely depended on. Tech Debt — open lint-violation and duplicate-code counts plus a coverage-% trend, aggregated from data Architectural Lint and Code Coverage already produce. Charts use a locally bundled Chart.js — no CDN required — with full dark mode support.
Prometheus Metrics & Grafana
Expose system health at GET /metrics in Prometheus text format — scrapeable directly by Grafana, Prometheus, or Grafana Agent. Create a service account in Settings, copy its token once, and configure it as a Bearer header in your datasource. Covers open/stale reviews, cycle times, webhook failures, comment activity and more.
IDE Integration — VS Code & JetBrains
Review comments appear as squiggles directly in your editor — no browser needed. A global LSP server (one Docker container) serves all developers simultaneously over TCP: no Node.js to install locally, no per-developer setup. The VS Code extension adds a sidebar with open CRs, commit picker to create CRs from the editor, inline comment creation, and Quick Fix actions to resolve comments or apply AI suggestions with one click.
Find Usages, Go to Declaration & Go to Symbol
Standard+. A tree-sitter symbol index for JavaScript, TypeScript, Ruby, Python, Go, Java, Kotlin and PHP, built incrementally on every push in an isolated indexing container. In the web repository browser, Ctrl+click a symbol for its declaration and Alt+click for every usage across the repo. In VS Code, JetBrains or Neovim it powers native Go to Declaration (F12), Find All References (Shift+F12) and Go to Symbol in File — standard LSP requests, so there's no extra plugin code to install. Click Watch on any symbol in the Find Usages panel to get a Slack/Teams/Email/webhook notification the moment its signature changes on the default branch. With Enterprise's real Semantic Analysis enabled on a repository, results are automatically upgraded to real, type-resolved matches wherever one exists, marked with a small "typed" badge.
Smart Reviewer Suggestions
Standard+ — Codeveira analyses the git history it has already stored in the database — no extra API calls — to identify the developers who know each changed file best. The top 5 suggestions appear on every review page as a "Suggested by code history" panel with name, file count, and commit count. Clicking Add assigns the reviewer instantly via Turbo Stream without a full page reload.
Database Backup & Restore
Schedule automatic pg_dump backups to a dedicated Docker volume with a configurable cron expression and retention count. Backups run as a Sidekiq background job — the application stays fully available during the dump. From the admin UI you can trigger a manual backup, download any snapshot, upload a .dump file (drag & drop or file picker), and restore with a single click. Real-time feedback is shown throughout: backup progress displays a live spinner banner that turns green with the filename on completion; restore shows a full-screen overlay with a spinner, then transitions to a confirmation prompt when done.
Built-in nginx & HTTPS
A reverse proxy container ships out of the box — no separate nginx to install or configure. It fronts the web app and the LSP server on ports 80/443/7777 and boots with a zero-config self-signed certificate, so Codeveira works over HTTPS from the first docker compose up. Point a real domain at it from Settings → Domain & HTTPS: upload your own certificate, or let Codeveira obtain and auto-renew one from Let's Encrypt — over HTTP-01 if port 80 is reachable, or DNS-01 (Cloudflare, AWS Route 53, Google Cloud DNS) if it isn't, with wildcard support. Renewal runs automatically twice a day. Prefer your own reverse proxy instead? That's supported too.
Autofix
Enable Autofix per AI bot in Settings. When the bot posts an inline suggestion, a purple Autofix button appears on the review page. One click enqueues a background job that fetches the file from the platform API, replaces the flagged line with the AI suggestion, and pushes a new commit to the source branch — no IDE required. Supported on GitHub, GitLab, Gitea, Forgejo, Bitbucket Cloud, Bitbucket Server, and Azure DevOps. Human reviewers get the same one-click Autofix button on their own suggestions too — no bot opt-in required, since it's their own text.
Upsource Migration Import
Moving from JetBrains Upsource? Use the built-in 5-step import wizard under Settings → Upsource Import (Enterprise). Codeveira connects to your Upsource server, fetches all projects and Hub users, and lets you map each Upsource project to a Codeveira repository and each user to a local account — with automatic suggestions based on name similarity and email matching. A Test connection button verifies server reachability from the application server before credentials are entered, catching firewall or routing issues early. Reviews, reviewer assignments, and comments are imported as a Sidekiq background job with live progress polling. The import is idempotent: re-running it skips already-imported reviews.
Repository Browser
Browse your repository directly inside Codeveira — no need to switch to GitHub, GitLab, or Gitea. A unified navigation tab bar (README, Browse, Branches, Analytics, Members, Metrics, All Reviews) appears on every repository sub-page so you can jump between sections without going back. Navigate the file tree, open files with syntax highlighting, view branch lists with default/protected badges, inspect line-by-line blame (GitHub & GitLab), and trace file history commit-by-commit. A branch switcher dropdown lets you switch branches instantly — the file tree updates to show only files that exist on the selected branch. Every line gets a #L{n} anchor for shareable deep links.
@Mention Notifications & Daily Digest
Mention any team member in a comment with @username to immediately notify them via in-app alert and email — even if they're not a reviewer or watcher. Users who prefer fewer emails can switch to a Daily digest in their profile, receiving one morning summary of all unread activity grouped by review. Need to reply? Just reply to the notification email — Reply by email (ActionMailbox) posts your message directly to the review.
Comment Checklists & Enforcement
Add interactive task lists to any comment with standard Markdown syntax (- [ ] item, - [x] done). Checkboxes are clickable in the browser and state is saved server-side. In Settings → Checklist admins can require all items to be ticked before a review can be approved or closed — globally, or only for comments with specific labels. Each repository can also override the global policy. When blocked, an amber inline banner explains exactly which comments are still open with scroll-to-comment links.
Review Timeline
Every code review opens on a Timeline tab — a chronological history of all events from oldest to newest: CR creation, commits added, reviewer assignments, every comment (with its text, file path for inline comments), approvals, rejections, and closure. Makes it easy to reconstruct what happened and when without reading through diffs.
Review Templates & Outgoing Webhooks
Speed up review creation with reusable title templates — manage them in Settings and apply with one click from the New Review form. Connect any external tool with outgoing webhooks: configure a global default set for the whole instance in Settings, or opt a specific repository into its own instead. Codeveira POSTs a signed JSON payload on review.opened, review.approved, review.rejected, review.closed, review.reopened, comment.created, and symbol.changed events, including auto-extracted task-tracker ticket_keys and the review URL. Optional HMAC-SHA256 signing via X-Codeveira-Signature. Deliveries are async (Sidekiq) with configurable timeout. For YouTrack, Jira, Mantis, or Bugzilla specifically, the native Task Trackers connector below skips the DIY automation entirely.
Task Trackers — YouTrack, Jira, Mantis & Bugzilla Standard+
Go beyond a raw outbound webhook: connect a real tracker and Codeveira transitions the ticket's status and posts a comment back automatically — no receiving script to write on the tracker's side. Configure a global default under Settings, or opt a repository into its own instance. Map each review lifecycle event to a target status per tracker; Bugzilla's status+resolution pair and Jira's transition-ID lookup are handled natively. A Test Connection check verifies credentials before you rely on it, and a sync failure is logged without ever blocking the review action that triggered it.
Global Search, Diff Stats, Copy Link & Go to File
Press ⌘K / Ctrl+K anywhere to open a fast search overlay — find repositories by name, reviews by title or CR number, and commits by SHA prefix with keyboard navigation. Every review row shows +N / -M diff statistics (pre-computed, no runtime parsing). A ⎘ Copy link button on the review header and commit pages copies the direct URL to clipboard. Every file header in a diff has a "Go to file" button that opens the full syntax-highlighted file in the repository browser at the exact commit SHA.
Built for teams where security isn't optional
Self-hosted means you control everything — the server, the network, the data. Codeveira adds multiple layers on top.
Your infrastructure, your rules
Runs on your own servers. Code, diffs, and comments never leave your network. Works fully air-gapped.
Two-Factor Authentication
TOTP-based 2FA (Google Authenticator, Authy) available on Standard+ plans. Enforce it organisation-wide.
LDAP / Active Directory
Authenticate against your existing corporate directory. Users and roles sync automatically.
Append-only Audit Log
Every action recorded with actor, IP, and target. Export to CSV/JSON or stream to Splunk, Datadog, or any SIEM.
HMAC-SHA256 Webhooks
All outgoing webhook payloads signed with HMAC-SHA256. Verify authenticity on the receiving end.
SSRF Protection
Import and webhook endpoints validate against RFC-1918 ranges and loopback addresses. No internal network probing.
Have specific compliance requirements?
We can discuss deployment architecture, data isolation, and custom hardening for your environment.
How Code Review Post Commit Works:
From Push to Approval in Four Steps
Codeveira automates the entire code review post commit lifecycle — your team focuses on the code, not the process.
Push to any Git platform
Developer pushes a branch. The code review post commit process starts immediately — GitLab, GitHub, Gitea, Forgejo or Bitbucket fires a webhook to Codeveira automatically, or select commits manually from the live commit list.
CR Created Instantly
Codeveira fetches commits and diffs from the API, creates a Code Review, assigns reviewers from the repository team, sends email notifications.
Review & Discuss
Reviewers browse the diff, leave inline comments, add labels, reply to threads, mark issues as resolved.
Approve & Close
All reviewers approve → the code review post commit CR transitions automatically to Approved. Author gets notified and can close or merge.
Code Review Post Commit Diff Engine — Move Detection, Syntax Highlighting, Side-by-Side View
Most diff tools show moved code as deleted + added. Codeveira's best_match_offset algorithm detects that the code was relocated and pairs it correctly — with token-level change highlighting. Every file also has a side-by-side toggle to compare old and new side by side, and long lines wrap cleanly instead of scrolling off-screen.
* lines (purple) show code that was moved — paired by the move detection algorithm, not shown as deleted + added.
Click to zoom
GitLab, GitHub, Gitea, Forgejo, Bitbucket, Azure DevOps & Gerrit Integrations
No vendor lock-in. Codeveira works with the infrastructure you already have.
GitLab Integration
Webhooks, REST API v4, commit diffs, OAuth 2.0 login — full integration.
LDAP / Active Directory
Corporate directory authentication — no separate password management needed.
Email Notifications
SMTP-based alerts for new CRs, comments, approvals, and rejections. Runs alongside real-time in-app notifications.
Real-time Notifications
Red dot on the nav logo and (N) tab title prefix — updated every 5 s without page reload. Per-CR dots on the dashboard show exactly which reviews have new activity. Cleared automatically when you open the CR.
Slack
Send review events to any Slack channel via an incoming webhook. Configure the URL once in Settings — no restarts needed.
Microsoft Teams
Post review events to a Teams channel via an incoming webhook connector. Messages use the MessageCard format with a direct link to the review.
Self-hosted & Secure
Runs in Docker on your own infrastructure. Your code never leaves your servers.
MCP / Claude Code
Built-in Model Context Protocol server. Connect Claude Code or any MCP client to browse reviews, read diffs, and post comments directly from your editor — authenticated with a per-user API token.
Profile & Themes
Per-user profile page — change password, manage API token, and choose from 4 colour themes: Light, Dark, Dracula, and Nord. Theme persists in localStorage; system colour scheme respected on first visit. Nav bar button cycles through all themes instantly.
VS Code Extension
Review comments as squiggles, CR list sidebar, inline comment creation, Quick Fix to apply AI suggestions. Connects to the global LSP server over TCP — no local Node.js required.
JetBrains Plugin
Inline diagnostics in IntelliJ IDEA, PyCharm, WebStorm and other JetBrains IDEs. Connects to the same global LSP server on port 7777 — download the .zip plugin.
GitHub Integration
Full integration — connect public and private repos via personal access token. Live commit fetching, diff API, webhook-powered auto CR creation on push.
Gitea & Forgejo Integration
Self-hosted lightweight Git service. Gitea-compatible API — connect with a personal access token and instance URL.
Forgejo
Community-driven Gitea fork. Identical API — same setup as Gitea, full commit and diff fetching.
Bitbucket Cloud Integration
Atlassian Bitbucket Cloud. Connect with an app password (workspace:password) — webhooks, commit fetching and diffs supported.
Bitbucket Server & Data Center
Self-hosted Bitbucket Server and Data Center. HTTP access token or Basic auth — supports all on-premises installations.
Azure DevOps Integration
Cloud and on-premises Azure DevOps Server. Authenticate with a PAT (Code: Read) — webhooks via Service Hooks, full diff fetching.
Gerrit Integration
Google's Gerrit code review server. Authenticate with HTTP credentials — uses the Gerrit webhooks plugin for push events and REST API for diffs.
See everything
at a glance
The dashboard shows live statistics across all repositories — open reviews, approvals, pending actions. Filter by status or reviewer. Click any comment count to instantly browse that review's entire discussion without navigating away.
- Defaults to Open — no noise from closed reviews
- Resolved/total comment counter per CR
- Click comments to open a thread browser modal
- Reviewer avatar badges with approval status
Settings, Admin & More
From configurable dashboards to per-user analytics and multi-channel notifications — a closer look at what's inside.
Edit Layout mode — drag any tile by its header, pull edge/corner handles to resize, click × to hide, restore from + Add widget
Notifications — Slack · Teams · Email · Webhook · SMS with per-event toggles & message templates
User Stats — per-user CRs authored, reviews given, approvals, rejections, comments
Repository Analytics — commit activity chart (365d), Code Review stats, Project Treemap, File History, Reviewers Graph
Upsource Import — 5-step migration wizard; imports reviews, participants & comments from JetBrains Upsource
Ready to streamline your
code review process?
Self-hosted, works with GitLab, GitHub, Gitea, Forgejo & Bitbucket — built for teams that care about code quality.