Quality assurance · Production

PayPay builds GBB RiskBot: RAG-enhanced LLM code review system using historical incident data

The problem

PayPay's code review relied entirely on individual reviewer knowledge and ad-hoc knowledge sharing, with no automated system to systematically prevent recurring incidents across services. Knowledge silos, team turnover, and varying reviewer experience led to inconsistent risk assessment.

Workflow diagram · grounded in source
1
PR opened triggers bot
trigger
“When a developer opens a pull request, the bot automatically analyzes the code changes against our historical incident database to identify potential risks”
2
Cron job ingests incident data
integration
“a cron job in Github Actions to continuously detect newly created incident data from multiple sources”
3
Incidents embedded into VectorDB
ai_action
“use OpenAI embeddings wrapped by LangChain to create searchable vectors, stored in VectorDB (ChromaDB)”
4
PR similarity search
ai_action
“PR changes triggers similarity searches against the knowledge base”
5
RAG comment generated
output
“RAG response generation: given the facts and code change, feed it to ChatGPT (gpt-4o-mini) with a prompt template to generate Github comment”
6
Developer emoji feedback collected
feedback_loop
“Based on GitHub emoji reactions, developers can react to the analysis to give feedback. A daily automated workflow collects reactions from the past 7 days, storing detailed metrics in our analytics database for trend analysis”
Reported outcome

GBB RiskBot operates across 12 repositories with 380+ total bot runs, at a total cost of $0.59 USD for the measured month, described as very cost-effective compared to the potential cost of production incidents.
The system educates developers and democratizes knowledge across the organization.

Reported metrics
Database initialization cost (47 incidents)$0.001852
per-PR analysis cost (1 file change)$0.000350
Monthly running cost (12 repositories)$0.59 USD
Total bot runs in measured month380+
Show all 5 reported metrics
database initialization cost (47 incidents)$0.001852
per-PR analysis cost (1 file change)$0.000350
monthly running cost (12 repositories)$0.59 USD
total bot runs in measured month380+
repositories covered12
Reported stack
GBB RiskBotGitHub ActionsOpenAI embeddingsLangChainChromaDBChatGPTgpt-4o-minitext-embedding-ada-002RAGGitHub
Source
https://blog.paypay.ne.jp/en/turning-historical-incidents-into-ai-insights-rag-enhanced-llm-approach-to-code-review/
Read source ↗

Frequently asked questions

What did this team achieve with this AI workflow?

GBB RiskBot operates across 12 repositories with 380+ total bot runs, at a total cost of $0.59 USD for the measured month, described as very cost-effective compared to the potential cost of production incidents.

What tools did this team use?

GBB RiskBot, GitHub Actions, OpenAI embeddings, LangChain, ChromaDB, ChatGPT, gpt-4o-mini, text-embedding-ada-002, RAG, GitHub.

What results were reported?

Database initialization cost (47 incidents): $0.001852; per-PR analysis cost (1 file change): $0.000350; Monthly running cost (12 repositories): $0.59 USD; Total bot runs in measured month: 380+ (source-reported, not independently verified).

How is this quality assurance AI workflow structured?

PR opened triggers bot → Cron job ingests incident data → Incidents embedded into VectorDB → PR similarity search → RAG comment generated → Developer emoji feedback collected.