{"slug": "how-our-technical-pm-uses-claude-code-to-review-a-pr-fix-it-and-ship-it", "title": "How Our Technical PM Uses Claude Code to Review a PR, Fix It and Ship It", "summary": "A technical project manager at Utah Tech Labs demonstrated using Claude Code to review a pull request by running it in an isolated Docker container, uncovering that only two of the new API endpoints worked as documented and flagging a SQL injection vulnerability and an apostrophe-input crash. Claude Code then posted the findings as a categorized GitHub PR comment, fixed the issues, and generated a GitHub Actions workflow (docker-publish.yml) that builds and publishes the container image to GitHub Container Registry on merge. The PM stressed that reviewers should watch and understand every change the agent makes to their repository.", "body_md": "*Originally published on the [Utah Tech Labs blog](https://www.utahtechlabs.com/blog/claude-code-pull-request-review-ci-cd).*\n\nA pull request can look clean and still be broken. The summary reads well, the commit list is short and GitHub says there are no conflicts with main. None of that tells you whether the code runs.\n\nSamprit, a Technical Project Manager at Utah Tech Labs, spends a large part of his week on exactly this gap. He reviews code from other developers, makes sure nothing breaks in any environment, checks that the tests pass, and then writes the deployment scripts that get the work into a target environment. In this 15-minute walkthrough he shows how Claude Code handles most of that loop, from a first local run to a published container image.\n\nThe demo uses a simulated repository called golden bot, with three commits from a junior developer waiting to be merged into main. Here is what happens, step by step.\n\nThe pull request has a detailed summary: new API endpoints, a changelog, and the number of tests the developer ran on his own machine. There are three commits and no conflicts with the base branch. On paper, it is ready.\n\nSamprit's point is that a review on paper is not enough. Tests that pass on one laptop prove little about the next environment. So instead of approving, he runs the branch himself, in isolation.\n\nWith the repository cloned, he opens a new Claude Code session. He uses the VS Code extension, though the CLI and the web version work the same way. He pastes the PR link and asks Claude Code to check every change listed in the PR by running it inside a Docker container on his machine. He also asks it to create a Dockerfile, a `.dockerignore` and test files to validate the changes.\n\nClaude Code pulls the PR details, works out what the project needs to run, and writes the Docker files. The first run fails: the container runs as a non-root user, but the app hard-codes a path it can't write to. Claude Code finds the root cause, fixes it, and gets the container up and healthy. It then writes a pytest suite that gives each test its own temporary database.\n\nOne habit Samprit stresses: watch what it does. Claude Code is changing files in your repository, and you should understand every change it makes on your machine.\n\nWith the app running, Claude Code tests each endpoint and gives a verdict on every one. Only two of the routes work the way the changelog says they should. It also flags two security issues: a SQL injection vulnerability, and a crash when input contains an apostrophe.\n\nThis is the gap the PR summary hid. The developer reported passing tests, and the code still failed most of its own spec.\n\nNext, Samprit asks Claude Code to post everything it found as a comment on the pull request. A minute later the comment appears on GitHub, grouped into critical, major and minor issues, plus a short list of what the changes got right. The developer gets specific, reproducible feedback instead of a one-line \"doesn't work\".\n\nHe then tells Claude Code to fix all the issues, re-run the project and test every endpoint again. It works through the list, rebuilds the container and repeats the tests. This time every endpoint returns the expected response and the test suite passes.\n\nSamprit is clear that in a real team, the developer who owns the PR should make these fixes. He does it himself here only to show the full loop in one video.\n\nThe last prompt asks Claude Code to create a deployment pipeline that builds the image on merge, pushes it to GitHub Container Registry, and commits the files to the current branch. It writes a GitHub Actions workflow (`docker-publish.yml`) and pushes two new commits.\n\nThe CI run on the PR passes: the image builds and the health check succeeds. Samprit merges with a merge commit to keep the full commit history. The workflow then runs on main: lint and tests, image build, a smoke test, login to the registry, metadata extraction, and finally publishing the tagged image. Every stage goes green. Samprit wrote none of the workflow file himself; he only told Claude Code what it needed to do.\n\nThe value here is not that Claude Code writes code. The review that actually matters, running the branch and testing it in a clean environment, usually gets skipped because setting it up takes longer than reading the diff. Claude Code removes that setup cost. Building the environment, testing the endpoints, writing up the feedback, fixing the bugs and writing the pipeline each became one plain-English instruction.\n\nThree things still need a person:\n\nThis is one of many ways our team uses Claude Code day to day. It's the same approach we bring to client teams: engineers who work inside your codebase and set up AI-assisted workflows that hold up in production.\n\nWant this kind of review and deployment workflow running on your own codebase? [See how UTL's forward-deployed engineers work with your team](https://www.utahtechlabs.com/forward-deployed-engineering?utm_source=devto&utm_medium=referral&utm_campaign=claude-code-pr-review).", "url": "https://wpnews.pro/news/how-our-technical-pm-uses-claude-code-to-review-a-pr-fix-it-and-ship-it", "canonical_source": "https://dev.to/utl/how-our-technical-pm-uses-claude-code-to-review-a-pr-fix-it-and-ship-it-3h4c", "published_at": "2026-11-09 12:05:47+00:00", "updated_at": "2026-11-09 12:23:58.577978+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-products"], "entities": ["Claude Code", "Utah Tech Labs", "Samprit", "GitHub", "GitHub Container Registry", "Docker", "VS Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-our-technical-pm-uses-claude-code-to-review-a-pr-fix-it-and-ship-it", "markdown": "https://wpnews.pro/news/how-our-technical-pm-uses-claude-code-to-review-a-pr-fix-it-and-ship-it.md", "text": "https://wpnews.pro/news/how-our-technical-pm-uses-claude-code-to-review-a-pr-fix-it-and-ship-it.txt", "jsonld": "https://wpnews.pro/news/how-our-technical-pm-uses-claude-code-to-review-a-pr-fix-it-and-ship-it.jsonld"}}