aireview 0.1.0

data/lib/aireview/jira_client.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+require 'base64'
+require 'json'
+require_relative 'utils'
+
+module Aireview
+  class JiraClient
+    ISSUE_KEY = /\b([A-Z][A-Z0-9]+-\d+)\b/
+    OPEN_TIMEOUT = 10
+    READ_TIMEOUT = 30
+
+    def self.extract_issue_key(text)
+      match = ISSUE_KEY.match(text.to_s)
+      match && match[1]
+    end
+
+    def initialize(base_url:, login:, password:, logger: Logger.new($stderr))
+      require 'faraday'
+
+      raise ConfigError, 'Jira base URL is required' if Aireview::Utils.blank?(base_url)
+      raise ConfigError, 'Jira login is required' if Aireview::Utils.blank?(login)
+      raise ConfigError, 'Jira password is required' if Aireview::Utils.blank?(password)
+
+      @logger = logger
+      @connection = Faraday.new(url: base_url) do |builder|
+        builder.request :json
+        builder.options.open_timeout = OPEN_TIMEOUT
+        builder.options.timeout = READ_TIMEOUT
+        builder.adapter Faraday.default_adapter
+      end
+      @authorization = "Basic #{Base64.strict_encode64("#{login}:#{password}")}"
+    end
+
+    def fetch_issue(key)
+      payload = get_json("/rest/api/2/issue/#{key}", fields: 'summary,description,comment')
+
+      {
+        'key' => payload['key'],
+        'summary' => payload.dig('fields', 'summary'),
+        'description' => plain_text(payload.dig('fields', 'description')),
+        'comments' => extract_comments(payload.dig('fields', 'comment', 'comments'))
+      }
+    end
+
+    private
+
+    def get_json(path, params = {})
+      response = @connection.get(path, params, headers)
+      body = response.body.to_s
+      status = response.status.to_i
+
+      return JSON.parse(body) if status.between?(200, 299)
+
+      raise ApiError, "Jira API error #{status}: #{body}"
+    rescue Faraday::Error => e
+      raise ApiError, "Jira API request failed: #{e.message}"
+    rescue JSON::ParserError
+      raise ApiError, "Jira API returned invalid JSON: #{body}"
+    end
+
+    def headers
+      {
+        'Accept' => 'application/json',
+        'Authorization' => @authorization
+      }
+    end
+
+    def extract_comments(comments)
+      Array(comments).last(3).map do |comment|
+        author = comment.dig('author', 'displayName') || 'Unknown'
+        body = plain_text(comment['body'])
+        "#{author}: #{body}".strip
+      end.reject(&:empty?)
+    end
+
+    def plain_text(value)
+      case value
+      when String
+        value
+      when Array
+        value.map { |item| plain_text(item) }.join("\n")
+      when Hash
+        hash_to_text(value)
+      else
+        value.to_s
+      end
+    end
+
+    def hash_to_text(value)
+      if value['type'] == 'text'
+        value['text'].to_s
+      elsif value.key?('content')
+        value['content'].map { |item| plain_text(item) }.reject(&:empty?).join("\n")
+      else
+        value.values.map { |item| plain_text(item) }.reject(&:empty?).join("\n")
+      end
+    end
+  end
+end

data/lib/aireview/mr_parser.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+require 'uri'
+
+module Aireview
+  class MrParser
+    Result = Struct.new(:url, :base_url, :project_path, :project_id, :iid, keyword_init: true)
+
+    MR_PATH = %r{\A/(?<project>.+)/-/merge_requests/(?<iid>\d+)\z}
+
+    def self.parse(url)
+      uri = URI.parse(url.to_s)
+      raise ParseError, 'Merge request URL must include http:// or https://' unless uri.is_a?(URI::HTTP)
+
+      match = MR_PATH.match(uri.path)
+      raise ParseError, "Unsupported merge request URL: #{url}" unless match
+
+      project_path = match[:project]
+
+      Result.new(
+        url: url,
+        base_url: "#{uri.scheme}://#{uri.host}#{":#{uri.port}" if uri.port && ![80, 443].include?(uri.port)}",
+        project_path: project_path,
+        project_id: URI.encode_www_form_component(project_path),
+        iid: match[:iid].to_i
+      )
+    rescue URI::InvalidURIError => e
+      raise ParseError, "Invalid merge request URL: #{e.message}"
+    end
+  end
+end

data/lib/aireview/output_schemas.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+require 'ruby_llm/schema'
+
+module Aireview
+  module OutputSchemaValues
+    CATEGORIES = %w[
+      task_mismatch
+      bug
+      regression
+      security
+      performance
+      data_loss
+      edge_case
+      test_gap
+      maintainability
+    ].freeze
+    SEVERITIES = %w[critical major minor].freeze
+    DECISIONS = %w[keep reject].freeze
+  end
+
+  class GenerateOutputSchema < RubyLLM::Schema
+    string :summary
+    array :candidates, max_items: 3 do
+      object do
+        string :id
+        string :file
+        any_of :line do
+          integer
+          null
+        end
+        string :quoted_code
+        string :problem
+        string :why
+        string :suggestion
+        string :category, enum: OutputSchemaValues::CATEGORIES
+        string :severity, enum: OutputSchemaValues::SEVERITIES
+      end
+    end
+  end
+
+  class CritiqueOutputSchema < RubyLLM::Schema
+    array :verdicts do
+      object do
+        string :id
+        string :decision, enum: OutputSchemaValues::DECISIONS
+        string :reason
+        object :refinement, required: false do
+          string :problem
+          string :why
+          string :suggestion
+          string :category, enum: OutputSchemaValues::CATEGORIES
+          string :severity, enum: OutputSchemaValues::SEVERITIES
+        end
+      end
+    end
+  end
+end

data/lib/aireview/prompts/critique.txt

@@ -0,0 +1,57 @@
+You are doing the second pass of a merge request review.
+
+You are given the diff, the MR description, the Jira context and the candidates
+from the first pass. For every candidate return a verdict with decision=keep
+or reject.
+
+Be a strict filter:
+- when in doubt, choose reject;
+- keep only the most important and well-supported findings;
+
+Keep a candidate only if the problem is directly confirmed by the diff, Jira or
+the changed control/data flow and can lead to a real defect, regression,
+security/performance issue or a mismatch with the task.
+
+For category=task_mismatch apply a separate criterion: keep the candidate only
+if the diff contains a concrete artifact: debug code (puts, p, binding.pry,
+byebug, console.log, debugger), commented-out blocks, unused
+debug/test/helper methods, temporary TODO/HACK/FIXME/DEBUG markers from this
+diff, disabled tests (skip, xit, pending) without an explanation, or a change
+that directly contradicts the MR/Jira.
+
+Implementation details (config flags, deploy settings, new fields, helper
+methods), accompanying refactoring and any changes whose relation to the task
+is plausible are NOT task_mismatch. Reject such candidates.
+
+Reject a candidate if it:
+- is not confirmed by the diff or Jira;
+- is based on an assumption about code outside the diff;
+- contradicts the diff;
+- duplicates another candidate;
+- is not actionable;
+- boils down to "may be redundant", "may conflict", "may be unnecessary"
+  or "worth checking" without a clear sign of breakage. This rule applies
+  to all categories, including task_mismatch.
+
+If several candidates describe the same problem, keep only the strongest one
+and reject the rest as duplicates.
+
+Do not add new findings. Do not change id.
+Do not change file, line, quoted_code. They do not need to be reinvented.
+Use refinement only when it makes a keep finding more precise.
+
+The answer must be a valid JSON object only, without markdown and without any
+text outside the JSON.
+
+All free-text fields must be written in the language given in the
+"Response language" instruction. Do not mix languages.
+
+Rules:
+- verdicts: a verdict for every id from the input list.
+- decision: keep or reject.
+- reason: a short explanation of the decision.
+- refinement: optional, only for keep.
+- refinement.category: one of task_mismatch, bug, regression, security, performance, data_loss, edge_case, test_gap, maintainability.
+- refinement.severity: one of critical, major, minor.
+
+If there are no confirmed findings, return reject for every id.

data/lib/aireview/prompts/generate.txt

@@ -0,0 +1,58 @@
+You are doing the first pass of a merge request review.
+
+Look only at the diff, the MR description and the Jira context, if present.
+Do not draw conclusions about code outside the diff.
+
+Look only for the most important and well-supported findings:
+- bugs, regressions, data loss;
+- security and performance risks;
+- task_mismatch, only when one of the artifacts listed below is present;
+- a missing test only when the diff changes risky logic.
+
+Return task_mismatch only when the diff contains one of these concrete
+artifacts:
+- debug code in production: puts, p, binding.pry, byebug, console.log,
+  debugger;
+- commented-out blocks of code without an explanation;
+- unused debug/test/helper methods, for example
+  `def test; puts 'debug'; end`;
+- temporary TODO/HACK/FIXME/DEBUG markers added in this diff;
+- disabled tests (skip, xit, pending) without an explanation;
+- a change that directly contradicts the MR description or Jira.
+
+task_mismatch is NOT:
+- implementation details that Jira does not name verbatim
+  (config flags, deploy settings, new fields, helper methods);
+- accompanying refactoring or configuration that supports the main feature;
+- changes whose relation to the task is plausible, even if not proven.
+
+Jira describes product requirements, not names in the code. If you are not
+sure the change is really unrelated, do not return task_mismatch.
+
+If several changes relate to the same problem, return one finding rather than
+several similar ones.
+
+Return at most 3 candidates. It is better to return 0-2 strong candidates than
+a long list of weak ones.
+
+The answer must be a valid JSON object only, without markdown and without any
+text outside the JSON.
+
+All free-text fields must be written in the language given in the
+"Response language" instruction. Do not mix languages.
+
+Rules:
+- summary: a brief summary of the MR changes.
+- candidates: at most 3 of the most important findings.
+- id: C1, C2, C3 in order.
+- file: file path from the diff.
+- line: line of the new file when it can be determined, otherwise null.
+- quoted_code: an exact short quote from the changed code.
+- category: one of task_mismatch, bug, regression, security, performance, data_loss, edge_case, test_gap, maintainability.
+- severity: one of critical, major, minor.
+- problem, why, suggestion: only a concrete defect or a concrete verifiable breakage.
+  For category=task_mismatch, a concrete reference to a debug/leftover
+  artifact from the list above or an explicit contradiction with the task.
+
+If there are no strong findings, return the summary and an empty candidates
+array.

data/lib/aireview/publisher.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+require_relative 'review_marker'
+
+module Aireview
+  class Publisher
+    PREFIX = '**aireview review**'
+
+    def initialize(gitlab_client:, logger: Logger.new($stderr))
+      @gitlab_client = gitlab_client
+      @logger = logger
+    end
+
+    # Собственная заметка с ревью: {id:, key:} или nil. Метки недостаточно —
+    # её может процитировать кто угодно, поэтому сверяем ещё и автора. Старый
+    # формат без метки подхватываем только если заметки с меткой нет.
+    def existing_review(project_id:, iid:)
+      author_id = current_user_id
+      legacy = nil
+
+      @gitlab_client.fetch_merge_request_notes(project_id, iid).each do |note|
+        next if note['system']
+        next if note.dig('author', 'id') != author_id
+
+        key = ReviewMarker.extract(note['body'])
+        return {id: note['id'], key: key} if key
+
+        legacy ||= {id: note['id'], key: nil} if note['body'].to_s.start_with?(PREFIX)
+      end
+
+      legacy
+    end
+
+    def publish(project_id:, iid:, review_body:, key: nil, existing: nil)
+      body = compose(review_body, key)
+
+      if existing
+        @logger.info("Updating review note #{existing[:id]}")
+        @gitlab_client.update_merge_request_note(project_id, iid, existing[:id], body)
+      else
+        @gitlab_client.post_merge_request_note(project_id, iid, body)
+      end
+    end
+
+    private
+
+    def compose(review_body, key)
+      return "#{PREFIX}\n\n#{review_body}" if Aireview::Utils.blank?(key)
+
+      "#{ReviewMarker.build(key)}\n#{PREFIX}\n\n#{review_body}"
+    end
+
+    # Без надёжного автора матчинг по одной метке небезопасен: процитировать её
+    # может кто угодно, и тогда чужая заметка либо отменит ревью, либо будет
+    # перезаписана. Поэтому ошибку не глушим.
+    def current_user_id
+      return @current_user_id if defined?(@current_user_id)
+
+      id = @gitlab_client.fetch_current_user['id']
+      raise ApiError, 'GitLab did not return the current user id' if Aireview::Utils.blank?(id)
+
+      @current_user_id = id
+    end
+  end
+end

data/lib/aireview/review_marker.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+require 'digest'
+require 'json'
+
+module Aireview
+  # Скрытая метка в теле заметки: по ней ревью находит собственный комментарий
+  # и понимает, менялось ли с прошлого раза то, что влияет на результат.
+  module ReviewMarker
+    PATTERN = /<!--\s*aireview:key=([0-9a-f]+)\s*-->/
+
+    module_function
+
+    def build(key)
+      "<!-- aireview:key=#{key} -->"
+    end
+
+    def extract(body)
+      match = PATTERN.match(body.to_s)
+      match && match[1]
+    end
+
+    # Ключ считается от готовых промптов, а не от одного SHA: так в него сами
+    # собой попадают дифф, описание MR, контекст Jira, инструкции ревью и
+    # ignore_paths. Модели и провайдеры добавляются рядом — на промпт они не
+    # влияют, но на результат влияют.
+    def key(prompts:, config:)
+      source = {
+        'generate' => [
+          config.generate_provider,
+          prompts[:generate_model],
+          prompts[:generate_temperature],
+          prompts[:generate_prompt]
+        ],
+        'critique' => critique_source(prompts, config)
+      }
+
+      Digest::SHA256.hexdigest(JSON.generate(source))[0, 16]
+    end
+
+    # То, что делает результат ревью устаревшим: новый коммит, смена целевой
+    # ветки, перебазирование со сдвигом базы сравнения, а также правка
+    # заголовка или описания — из них берутся требования, с которыми ревью
+    # сверяет код.
+    def state(merge_request)
+      {
+        'sha' => merge_request['sha'],
+        'target_branch' => merge_request['target_branch'],
+        'diff_refs' => merge_request['diff_refs'],
+        'title' => merge_request['title'],
+        'description' => merge_request['description']
+      }
+    end
+
+    def critique_source(prompts, config)
+      return nil unless prompts[:critique_prompt]
+
+      [
+        config.critique_provider,
+        prompts[:critique_model],
+        prompts[:critique_temperature],
+        prompts[:critique_prompt]
+      ]
+    end
+  end
+end