@theihtisham/review-agent 1.0.0 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.editorconfig +12 -0
- package/.github/ISSUE_TEMPLATE/bug_report.yml +43 -0
- package/.github/ISSUE_TEMPLATE/feature_request.yml +33 -0
- package/.github/PULL_REQUEST_TEMPLATE.md +18 -0
- package/.github/dependabot.yml +16 -0
- package/.github/workflows/ci.yml +24 -0
- package/CODE_OF_CONDUCT.md +27 -0
- package/Dockerfile +8 -0
- package/README.md +65 -299
- package/SECURITY.md +22 -0
- package/package.json +53 -46
package/.editorconfig
ADDED
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
name: Bug Report
|
|
2
|
+
description: Report a bug or unexpected behavior
|
|
3
|
+
labels: [bug]
|
|
4
|
+
body:
|
|
5
|
+
- type: textarea
|
|
6
|
+
id: description
|
|
7
|
+
attributes:
|
|
8
|
+
label: Bug Description
|
|
9
|
+
description: What happened?
|
|
10
|
+
placeholder: "When I run agent-memory..."
|
|
11
|
+
validations:
|
|
12
|
+
required: true
|
|
13
|
+
|
|
14
|
+
- type: textarea
|
|
15
|
+
id: steps
|
|
16
|
+
attributes:
|
|
17
|
+
label: Steps to Reproduce
|
|
18
|
+
description: How can we reproduce this?
|
|
19
|
+
placeholder: "1. Install...\n2. Configure...\n3. Run..."
|
|
20
|
+
validations:
|
|
21
|
+
required: true
|
|
22
|
+
|
|
23
|
+
- type: textarea
|
|
24
|
+
id: expected
|
|
25
|
+
attributes:
|
|
26
|
+
label: Expected Behavior
|
|
27
|
+
description: What should have happened?
|
|
28
|
+
validations:
|
|
29
|
+
required: true
|
|
30
|
+
|
|
31
|
+
- type: textarea
|
|
32
|
+
id: environment
|
|
33
|
+
attributes:
|
|
34
|
+
label: Environment
|
|
35
|
+
description: Node version, OS, etc.
|
|
36
|
+
placeholder: "Node 20.11.0, macOS 14, agent-memory 1.0.0"
|
|
37
|
+
|
|
38
|
+
- type: textarea
|
|
39
|
+
id: logs
|
|
40
|
+
attributes:
|
|
41
|
+
label: Relevant Logs
|
|
42
|
+
description: Paste any relevant log output
|
|
43
|
+
render: shell
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
name: Feature Request
|
|
2
|
+
description: Suggest a new feature or enhancement
|
|
3
|
+
labels: [enhancement]
|
|
4
|
+
body:
|
|
5
|
+
- type: textarea
|
|
6
|
+
id: problem
|
|
7
|
+
attributes:
|
|
8
|
+
label: Problem
|
|
9
|
+
description: What problem does this feature solve?
|
|
10
|
+
placeholder: "I'm frustrated when..."
|
|
11
|
+
validations:
|
|
12
|
+
required: true
|
|
13
|
+
|
|
14
|
+
- type: textarea
|
|
15
|
+
id: solution
|
|
16
|
+
attributes:
|
|
17
|
+
label: Proposed Solution
|
|
18
|
+
description: How should it work?
|
|
19
|
+
validations:
|
|
20
|
+
required: true
|
|
21
|
+
|
|
22
|
+
- type: dropdown
|
|
23
|
+
id: type
|
|
24
|
+
attributes:
|
|
25
|
+
label: Feature Type
|
|
26
|
+
options:
|
|
27
|
+
- New Tool/Resource
|
|
28
|
+
- Performance Improvement
|
|
29
|
+
- Developer Experience
|
|
30
|
+
- Documentation
|
|
31
|
+
- Other
|
|
32
|
+
validations:
|
|
33
|
+
required: true
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
## Description
|
|
2
|
+
|
|
3
|
+
<!-- Brief description of changes -->
|
|
4
|
+
|
|
5
|
+
## Type of Change
|
|
6
|
+
|
|
7
|
+
- [ ] Bug fix
|
|
8
|
+
- [ ] New feature
|
|
9
|
+
- [ ] Breaking change
|
|
10
|
+
- [ ] Documentation update
|
|
11
|
+
- [ ] Refactor / cleanup
|
|
12
|
+
|
|
13
|
+
## Checklist
|
|
14
|
+
|
|
15
|
+
- [ ] Tests pass (`npm test`)
|
|
16
|
+
- [ ] Type checks pass (`npm run lint`)
|
|
17
|
+
- [ ] No secrets or credentials introduced
|
|
18
|
+
- [ ] Commit messages follow [conventional commits](https://www.conventionalcommits.org/)
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
version: 2
|
|
2
|
+
updates:
|
|
3
|
+
- package-ecosystem: npm
|
|
4
|
+
directory: /
|
|
5
|
+
schedule:
|
|
6
|
+
interval: weekly
|
|
7
|
+
day: monday
|
|
8
|
+
open-pull-requests-limit: 5
|
|
9
|
+
commit-message:
|
|
10
|
+
prefix: chore
|
|
11
|
+
include: scope
|
|
12
|
+
|
|
13
|
+
- package-ecosystem: github-actions
|
|
14
|
+
directory: /
|
|
15
|
+
schedule:
|
|
16
|
+
interval: monthly
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [main, master]
|
|
6
|
+
pull_request:
|
|
7
|
+
branches: [main, master]
|
|
8
|
+
|
|
9
|
+
jobs:
|
|
10
|
+
build-and-test:
|
|
11
|
+
runs-on: ubuntu-latest
|
|
12
|
+
strategy:
|
|
13
|
+
matrix:
|
|
14
|
+
node-version: [18, 20, 22]
|
|
15
|
+
steps:
|
|
16
|
+
- uses: actions/checkout@v4
|
|
17
|
+
- uses: actions/setup-node@v4
|
|
18
|
+
with:
|
|
19
|
+
node-version: ${{ matrix.node-version }}
|
|
20
|
+
cache: npm
|
|
21
|
+
- run: npm ci
|
|
22
|
+
- run: npm run lint
|
|
23
|
+
- run: npm test
|
|
24
|
+
- run: npm run build
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# Contributor Covenant Code of Conduct
|
|
2
|
+
|
|
3
|
+
## Our Pledge
|
|
4
|
+
|
|
5
|
+
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone.
|
|
6
|
+
|
|
7
|
+
## Our Standards
|
|
8
|
+
|
|
9
|
+
Examples of behavior that contributes to a positive environment:
|
|
10
|
+
- Demonstrating empathy and kindness toward other people
|
|
11
|
+
- Being respectful of differing opinions, viewpoints, and experiences
|
|
12
|
+
- Giving and gracefully accepting constructive feedback
|
|
13
|
+
- Accepting responsibility and apologizing to those affected by our mistakes
|
|
14
|
+
|
|
15
|
+
Examples of unacceptable behavior:
|
|
16
|
+
- The use of sexualized language or imagery
|
|
17
|
+
- Trolling, insulting or derogatory comments
|
|
18
|
+
- Public or private harassment
|
|
19
|
+
- Publishing others' private information without explicit permission
|
|
20
|
+
|
|
21
|
+
## Enforcement
|
|
22
|
+
|
|
23
|
+
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to **Theihtisham@outlook.com**.
|
|
24
|
+
|
|
25
|
+
## Attribution
|
|
26
|
+
|
|
27
|
+
This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1.
|
package/Dockerfile
ADDED
package/README.md
CHANGED
|
@@ -1,352 +1,118 @@
|
|
|
1
|
-
|
|
1
|
+
<div align="center">
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
<img width="100%" height="180" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 960 180'%3E%3Cdefs%3E%3ClinearGradient id='g' x1='0%25' y1='0%25' x2='100%25' y2='100%25'%3E%3Cstop offset='0%25' stop-color='%23f43f5e'/%3E%3Cstop offset='100%25' stop-color='%23f97316'/%3E%3C/linearGradient%3E%3C/defs%3E%3Crect width='960' height='180' fill='%230a0a1a' rx='16'/%3E%3Crect x='2' y='2' width='956' height='176' fill='none' stroke='url(%23g)' stroke-width='2' rx='15'/%3E%3Ctext x='480' y='75' text-anchor='middle' fill='white' font-family='system-ui' font-size='38' font-weight='bold'%3E%F0%9F%9B%A1 Review Agent%3C/text%3E%3Ctext x='480' y='115' text-anchor='middle' fill='%23a5a5c0' font-family='system-ui' font-size='18'%3EAI-Powered Code Review with Line-by-Line Comments%3C/text%3E%3Ctext x='480' y='148' text-anchor='middle' fill='%236b6b88' font-family='monospace' font-size='13'%3EGitHub Action %C2%B7 OpenAI %C2%B7 Bug Detection %C2%B7 Security Scan %C2%B7 Performance%3C/text%3E%3C/svg%3E" alt="Review Agent Banner"/>
|
|
4
4
|
|
|
5
|
-
[](https://github.com/theihtisham/review-agent/actions/workflows/ci.yml)
|
|
6
|
+
[](https://www.npmjs.com/package/@theihtisham/review-agent)
|
|
7
|
+
[](https://www.npmjs.com/package/@theihtisham/review-agent)
|
|
8
|
+
[](https://github.com/theihtisham/review-agent/stargazers)
|
|
9
|
+
[](https://opensource.org/licenses/MIT)
|
|
9
10
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
## What It Does
|
|
13
|
-
|
|
14
|
-
ReviewAgent watches every pull request and automatically posts a **line-by-line code review** using AI. It catches bugs, security vulnerabilities, performance issues, and style violations — then posts them as GitHub review comments on the exact lines that need attention.
|
|
15
|
-
|
|
16
|
-
### The Review
|
|
17
|
-
|
|
18
|
-
Every review includes:
|
|
11
|
+
**AI-powered code review GitHub Action with line-by-line PR comments.** Detects bugs, security vulnerabilities, and performance issues with configurable severity levels and auto-approve support.
|
|
19
12
|
|
|
20
|
-
|
|
21
|
-
|----------|----------------|
|
|
22
|
-
| **Bugs** | Null/undefined access, off-by-one errors, race conditions, unhandled edge cases, logic errors |
|
|
23
|
-
| **Security** | SQL injection, XSS, hardcoded secrets, eval() usage, command injection, OWASP Top 10 |
|
|
24
|
-
| **Performance** | N+1 queries, memory leaks, inefficient algorithms, unnecessary re-renders |
|
|
25
|
-
| **Style** | Naming, formatting, readability, code organization |
|
|
26
|
-
| **Convention** | Violations of your repo's own patterns and naming styles |
|
|
13
|
+
[Quick Start](#-quick-start) · [Architecture](#-architecture) · [Configuration](#-configuration)
|
|
27
14
|
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
Each review produces:
|
|
31
|
-
|
|
32
|
-
- **Line-by-line comments** on the exact lines with issues
|
|
33
|
-
- **Severity tags** — critical / warning / info
|
|
34
|
-
- **Category labels** — bug / security / performance / style / convention
|
|
35
|
-
- **Overall quality score** (0-100)
|
|
36
|
-
- **Summary comment** with breakdown table
|
|
15
|
+
</div>
|
|
37
16
|
|
|
38
17
|
---
|
|
39
18
|
|
|
40
|
-
##
|
|
41
|
-
|
|
42
|
-
Here's what a ReviewAgent review looks like on a real PR:
|
|
43
|
-
|
|
44
|
-
### PR introduces a login endpoint with security issues:
|
|
45
|
-
|
|
46
|
-
```typescript
|
|
47
|
-
// src/auth.ts
|
|
48
|
-
const API_KEY = "sk-1234567890abcdef";
|
|
49
|
-
|
|
50
|
-
function login(req: Request, res: Response) {
|
|
51
|
-
const query = "SELECT * FROM users WHERE name = '" + req.body.username + "'";
|
|
52
|
-
db.query(query);
|
|
53
|
-
if (req.body.password === ADMIN_PASSWORD) {
|
|
54
|
-
res.redirect(req.query.returnUrl);
|
|
55
|
-
}
|
|
56
|
-
}
|
|
57
|
-
```
|
|
58
|
-
|
|
59
|
-
### ReviewAgent posts these inline comments:
|
|
60
|
-
|
|
61
|
-
> **Line 2** — `[Security] (critical)` Hardcoded secret detected. Move this to an environment variable or secret manager.
|
|
62
|
-
> *OWASP: A07:2021-Identification and Authentication Failures*
|
|
63
|
-
|
|
64
|
-
> **Line 5** — `[Security] (critical)` Potential SQL injection: avoid string concatenation in queries. Use parameterized queries instead.
|
|
65
|
-
> *OWASP: A03:2021-Injection*
|
|
66
|
-
|
|
67
|
-
> **Line 7** — `[Security] (critical)` Potential open redirect. Validate and whitelist redirect targets.
|
|
68
|
-
> *OWASP: A01:2021-Broken Access Control*
|
|
69
|
-
|
|
70
|
-
### And a summary comment:
|
|
71
|
-
|
|
72
|
-
```
|
|
73
|
-
## 🔴 ReviewAgent Code Review Summary
|
|
74
|
-
|
|
75
|
-
**Score: 25/100** — Poor
|
|
76
|
-
|
|
77
|
-
Critical security issues found: SQL injection, hardcoded secrets, and open redirect.
|
|
78
|
-
|
|
79
|
-
| Category | Count |
|
|
80
|
-
|----------|-------|
|
|
81
|
-
| 🐛 Bug | 1 |
|
|
82
|
-
| 🔒 Security | 3 |
|
|
83
|
-
| ⚡ Performance | 0 |
|
|
84
|
-
| 🎨 Style | 1 |
|
|
19
|
+
## Architecture
|
|
85
20
|
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
21
|
+
```mermaid
|
|
22
|
+
graph TD
|
|
23
|
+
PR[Pull Request] --> DIFF[Diff Fetcher<br/>@actions/github]
|
|
24
|
+
DIFF --> FILTER[File Filter<br/>minimatch glob]
|
|
25
|
+
FILTER --> CHUNK[Code Chunker<br/>Context-Aware Splitting]
|
|
26
|
+
CHUNK --> LLM[LLM Analyzer<br/>OpenAI API]
|
|
27
|
+
LLM --> PARSE[Result Parser<br/>Structured Findings]
|
|
28
|
+
PARSE --> SEVERITY[Severity Classifier<br/>info → critical]
|
|
29
|
+
SEVERITY --> COMMENTS[Inline Comments<br/>Line-by-Line]
|
|
30
|
+
SEVERITY --> SUMMARY[Review Summary<br/>PR Description]
|
|
31
|
+
|
|
32
|
+
style LLM fill:#f43f5e,color:#fff
|
|
33
|
+
style SEVERITY fill:#f97316,color:#fff
|
|
34
|
+
style COMMENTS fill:#34d399,color:#000
|
|
89
35
|
```
|
|
90
36
|
|
|
91
37
|
---
|
|
92
38
|
|
|
93
|
-
##
|
|
94
|
-
|
|
95
|
-
Add ReviewAgent to any repository in **5 lines of YAML**:
|
|
39
|
+
## Quick Start
|
|
96
40
|
|
|
97
41
|
```yaml
|
|
98
42
|
# .github/workflows/review.yml
|
|
99
|
-
name: AI
|
|
100
|
-
on:
|
|
43
|
+
name: AI Review
|
|
44
|
+
on:
|
|
45
|
+
pull_request:
|
|
46
|
+
types: [opened, synchronize]
|
|
47
|
+
|
|
101
48
|
jobs:
|
|
102
49
|
review:
|
|
103
50
|
runs-on: ubuntu-latest
|
|
51
|
+
permissions:
|
|
52
|
+
pull-requests: write
|
|
53
|
+
contents: read
|
|
104
54
|
steps:
|
|
105
|
-
- uses:
|
|
106
|
-
- uses: reviewagent/review-agent@v1
|
|
55
|
+
- uses: theihtisham/review-agent@v1
|
|
107
56
|
with:
|
|
108
57
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
109
|
-
|
|
58
|
+
api-key: ${{ secrets.OPENAI_API_KEY }}
|
|
110
59
|
```
|
|
111
60
|
|
|
112
|
-
That's it. Every PR now gets an AI code review.
|
|
113
|
-
|
|
114
61
|
---
|
|
115
62
|
|
|
116
63
|
## Configuration
|
|
117
64
|
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
|
121
|
-
|
|
122
|
-
| `
|
|
123
|
-
| `
|
|
124
|
-
| `
|
|
125
|
-
| `
|
|
126
|
-
| `
|
|
127
|
-
| `
|
|
128
|
-
| `
|
|
129
|
-
| `
|
|
130
|
-
| `review-type` | `comment` | GitHub review type: `approve`, `request-changes`, `comment` |
|
|
131
|
-
| `language-hints` | `""` | Comma-separated languages (e.g., `typescript,python`) |
|
|
132
|
-
| `learn-conventions` | `true` | Learn repo conventions from existing code |
|
|
133
|
-
|
|
134
|
-
### Using with OpenAI
|
|
135
|
-
|
|
136
|
-
```yaml
|
|
137
|
-
- uses: reviewagent/review-agent@v1
|
|
138
|
-
with:
|
|
139
|
-
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
140
|
-
llm-provider: openai
|
|
141
|
-
llm-api-key: ${{ secrets.OPENAI_API_KEY }}
|
|
142
|
-
llm-model: gpt-4o
|
|
143
|
-
```
|
|
144
|
-
|
|
145
|
-
### Using with Anthropic
|
|
146
|
-
|
|
147
|
-
```yaml
|
|
148
|
-
- uses: reviewagent/review-agent@v1
|
|
149
|
-
with:
|
|
150
|
-
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
151
|
-
llm-provider: anthropic
|
|
152
|
-
llm-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
153
|
-
llm-model: claude-sonnet-4-20250514
|
|
154
|
-
```
|
|
155
|
-
|
|
156
|
-
### Using with Ollama (Free, Self-Hosted)
|
|
157
|
-
|
|
158
|
-
```yaml
|
|
159
|
-
- uses: reviewagent/review-agent@v1
|
|
160
|
-
with:
|
|
161
|
-
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
162
|
-
llm-provider: ollama
|
|
163
|
-
llm-model: llama3.1
|
|
164
|
-
llm-base-url: http://your-ollama-host:11434/v1
|
|
165
|
-
```
|
|
166
|
-
|
|
167
|
-
No API key needed. Run Ollama on any machine with a GPU and point the action at it.
|
|
65
|
+
| Input | Required | Default | Description |
|
|
66
|
+
|-------|----------|---------|-------------|
|
|
67
|
+
| `github-token` | Yes | — | GitHub token |
|
|
68
|
+
| `api-key` | Yes | — | OpenAI API key |
|
|
69
|
+
| `api-base` | No | `https://api.openai.com/v1` | API endpoint |
|
|
70
|
+
| `model` | No | `gpt-4o` | AI model |
|
|
71
|
+
| `max-comments` | No | `20` | Max comments per review |
|
|
72
|
+
| `severity-threshold` | No | `info` | Min: info/warning/error/critical |
|
|
73
|
+
| `review-types` | No | `bug,security,performance,quality` | Review categories |
|
|
74
|
+
| `ignore-paths` | No | — | Glob patterns to skip |
|
|
75
|
+
| `auto-approve` | No | `false` | Auto-approve clean PRs |
|
|
76
|
+
| `fail-on-critical` | No | `false` | Fail on critical issues |
|
|
168
77
|
|
|
169
78
|
---
|
|
170
79
|
|
|
171
|
-
##
|
|
172
|
-
|
|
173
|
-
Create a `.reviewagent.yml` file in your repo root to customize ReviewAgent:
|
|
174
|
-
|
|
175
|
-
```yaml
|
|
176
|
-
# .reviewagent.yml
|
|
177
|
-
|
|
178
|
-
# Custom review rules
|
|
179
|
-
rules:
|
|
180
|
-
- name: "no-console-log"
|
|
181
|
-
pattern: "console\\.log"
|
|
182
|
-
message: "Use the logger module instead of console.log"
|
|
183
|
-
severity: warning
|
|
184
|
-
category: convention
|
|
185
|
-
|
|
186
|
-
- name: "no-any-type"
|
|
187
|
-
pattern: ":\\s*any\\b"
|
|
188
|
-
message: "Avoid 'any' type. Use a specific type or 'unknown'."
|
|
189
|
-
severity: warning
|
|
190
|
-
category: convention
|
|
191
|
-
|
|
192
|
-
- name: "require-error-boundary"
|
|
193
|
-
pattern: "export\\s+default\\s+function\\s+\\w+"
|
|
194
|
-
message: "Top-level components should be wrapped in an ErrorBoundary."
|
|
195
|
-
severity: info
|
|
196
|
-
category: convention
|
|
197
|
-
|
|
198
|
-
# Additional paths to ignore
|
|
199
|
-
ignore:
|
|
200
|
-
paths:
|
|
201
|
-
- "proto/**"
|
|
202
|
-
- "**/*.generated.ts"
|
|
203
|
-
extensions:
|
|
204
|
-
- ".proto"
|
|
205
|
-
```
|
|
206
|
-
|
|
207
|
-
### Rule Fields
|
|
208
|
-
|
|
209
|
-
| Field | Required | Description |
|
|
210
|
-
|-------|----------|-------------|
|
|
211
|
-
| `name` | Yes | Unique rule identifier |
|
|
212
|
-
| `pattern` | Yes | Regex pattern to match in changed lines |
|
|
213
|
-
| `message` | Yes | Message shown in the review comment |
|
|
214
|
-
| `severity` | Yes | `critical`, `warning`, or `info` |
|
|
215
|
-
| `category` | Yes | `bug`, `security`, `performance`, `style`, or `convention` |
|
|
216
|
-
|
|
217
|
-
---
|
|
80
|
+
## Docker
|
|
218
81
|
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
PR opened/updated
|
|
223
|
-
|
|
|
224
|
-
v
|
|
225
|
-
GitHub Action triggered
|
|
226
|
-
|
|
|
227
|
-
v
|
|
228
|
-
Parse action inputs + .reviewagent.yml
|
|
229
|
-
|
|
|
230
|
-
v
|
|
231
|
-
Fetch PR diff (only changed files)
|
|
232
|
-
|
|
|
233
|
-
v
|
|
234
|
-
Filter out ignored files
|
|
235
|
-
(node_modules, generated, binaries, etc.)
|
|
236
|
-
|
|
|
237
|
-
+--> Static Security Scanner (local, fast)
|
|
238
|
-
| - 14 OWASP-aware patterns
|
|
239
|
-
| - Custom regex rules from config
|
|
240
|
-
|
|
|
241
|
-
+--> LLM Deep Review (AI-powered)
|
|
242
|
-
| - Per-file analysis with diff context
|
|
243
|
-
| - Repo conventions injected in prompt
|
|
244
|
-
| - JSON-structured response
|
|
245
|
-
|
|
|
246
|
-
v
|
|
247
|
-
Merge & deduplicate findings
|
|
248
|
-
|
|
|
249
|
-
v
|
|
250
|
-
Sort by severity (critical first)
|
|
251
|
-
|
|
|
252
|
-
v
|
|
253
|
-
Post GitHub Review
|
|
254
|
-
(inline comments + summary + score)
|
|
82
|
+
```bash
|
|
83
|
+
docker build -t review-agent .
|
|
84
|
+
docker run review-agent
|
|
255
85
|
```
|
|
256
86
|
|
|
257
|
-
### Key Design Decisions
|
|
258
|
-
|
|
259
|
-
- **Diff-aware**: Only reviews lines that changed. No noise from untouched code.
|
|
260
|
-
- **Two-pass review**: Fast static scan for known patterns, then deep LLM analysis for nuanced issues.
|
|
261
|
-
- **Convention learning**: Reads your existing codebase to learn naming styles and patterns before reviewing.
|
|
262
|
-
- **Rate limiting**: Built-in rate limiter prevents API abuse (configurable concurrency and intervals).
|
|
263
|
-
- **Fallback**: If inline review fails (e.g., outdated diff), posts as a regular PR comment.
|
|
264
|
-
|
|
265
|
-
---
|
|
266
|
-
|
|
267
|
-
## Security
|
|
268
|
-
|
|
269
|
-
ReviewAgent takes security seriously:
|
|
270
|
-
|
|
271
|
-
- **Never logs code content** — all diffs are sanitized before logging
|
|
272
|
-
- **API keys via secrets only** — keys are masked in all GitHub Actions output
|
|
273
|
-
- **Input validation** — all action inputs are validated before use
|
|
274
|
-
- **No data storage** — code is sent to the LLM provider for analysis and not stored
|
|
275
|
-
- **Secret redaction** — log sanitizer catches accidental secret leaks in output
|
|
276
|
-
|
|
277
|
-
### Recommendations
|
|
278
|
-
|
|
279
|
-
- Use `secrets.GITHUB_TOKEN` (automatic) or a fine-grained PAT with minimal permissions
|
|
280
|
-
- Store LLM API keys in GitHub Secrets, never in workflow files
|
|
281
|
-
- For self-hosted Ollama, use a private network or VPN
|
|
282
|
-
|
|
283
87
|
---
|
|
284
88
|
|
|
285
89
|
## Development
|
|
286
90
|
|
|
287
91
|
```bash
|
|
288
|
-
# Install dependencies
|
|
289
92
|
npm install
|
|
290
|
-
|
|
291
|
-
# Run tests
|
|
93
|
+
npm run build
|
|
292
94
|
npm test
|
|
293
|
-
|
|
294
|
-
# Run tests with coverage
|
|
295
95
|
npm run test:coverage
|
|
296
|
-
|
|
297
|
-
# Type check
|
|
298
|
-
npm run lint
|
|
299
|
-
|
|
300
|
-
# Build for production
|
|
301
|
-
npm run build
|
|
302
|
-
|
|
303
|
-
# Full check (lint + test + build)
|
|
304
|
-
npm run all
|
|
305
96
|
```
|
|
306
97
|
|
|
307
|
-
|
|
98
|
+
---
|
|
308
99
|
|
|
309
|
-
|
|
310
|
-
|
|
311
|
-
|
|
312
|
-
main.ts # Action entry point
|
|
313
|
-
config.ts # Input parsing, config building
|
|
314
|
-
types.ts # TypeScript type definitions
|
|
315
|
-
github.ts # GitHub API client (reviews, diffs)
|
|
316
|
-
llm-client.ts # LLM client (OpenAI, Anthropic, Ollama)
|
|
317
|
-
reviewer.ts # Core review orchestrator
|
|
318
|
-
conventions.ts # Repo convention learning
|
|
319
|
-
reviewers/
|
|
320
|
-
security.ts # Static security pattern scanner
|
|
321
|
-
utils/
|
|
322
|
-
diff-parser.ts # Patch parsing, line extraction
|
|
323
|
-
rate-limiter.ts # Rate limiting and retry logic
|
|
324
|
-
security.ts # Sanitization, formatting utilities
|
|
325
|
-
__tests__/
|
|
326
|
-
config.test.ts
|
|
327
|
-
diff-parser.test.ts
|
|
328
|
-
security.test.ts
|
|
329
|
-
rate-limiter.test.ts
|
|
330
|
-
security-utils.test.ts
|
|
331
|
-
llm-client.test.ts
|
|
332
|
-
fixtures/
|
|
333
|
-
mock-data.ts
|
|
334
|
-
action.yml # GitHub Action definition
|
|
335
|
-
package.json
|
|
336
|
-
tsconfig.json
|
|
337
|
-
vitest.config.ts
|
|
338
|
-
LICENSE
|
|
339
|
-
README.md
|
|
340
|
-
```
|
|
100
|
+
## Trending Tags
|
|
101
|
+
|
|
102
|
+
`code-review` `github-action` `ai` `security` `bug-detection` `performance` `openai` `automation` `developer-tools`
|
|
341
103
|
|
|
342
104
|
---
|
|
343
105
|
|
|
344
106
|
## License
|
|
345
107
|
|
|
346
|
-
[
|
|
108
|
+
MIT License — see [LICENSE](LICENSE) for details.
|
|
347
109
|
|
|
348
110
|
---
|
|
349
111
|
|
|
350
|
-
<
|
|
351
|
-
|
|
352
|
-
|
|
112
|
+
<div align="center">
|
|
113
|
+
|
|
114
|
+
**Built by [theihtisham](https://github.com/theihtisham)**
|
|
115
|
+
|
|
116
|
+
[GitHub](https://github.com/theihtisham) · [npm](https://www.npmjs.com/~theihtisham) · [Email](mailto:Theihtisham@outlook.com)
|
|
117
|
+
|
|
118
|
+
</div>
|
package/SECURITY.md
ADDED
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Supported Versions
|
|
4
|
+
|
|
5
|
+
| Version | Supported |
|
|
6
|
+
| ------- | --------- |
|
|
7
|
+
| 1.x | Yes |
|
|
8
|
+
|
|
9
|
+
## Reporting a Vulnerability
|
|
10
|
+
|
|
11
|
+
If you discover a security vulnerability, please report it responsibly:
|
|
12
|
+
|
|
13
|
+
- **Email**: Theihtisham@outlook.com
|
|
14
|
+
- **Subject**: [Security] Vulnerability in ai-agent-memory
|
|
15
|
+
|
|
16
|
+
Please include:
|
|
17
|
+
1. Description of the vulnerability
|
|
18
|
+
2. Steps to reproduce
|
|
19
|
+
3. Potential impact
|
|
20
|
+
4. Suggested fix (if any)
|
|
21
|
+
|
|
22
|
+
We aim to respond within 48 hours and patch critical issues within 7 days.
|
package/package.json
CHANGED
|
@@ -1,46 +1,53 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@theihtisham/review-agent",
|
|
3
|
-
"version": "1.
|
|
4
|
-
"description": "AI-powered code review GitHub Action with line-by-line PR comments",
|
|
5
|
-
"main": "dist/index.js",
|
|
6
|
-
"scripts": {
|
|
7
|
-
"build": "ncc build src/main.ts -o dist --source-map --license licenses.txt",
|
|
8
|
-
"test": "vitest run",
|
|
9
|
-
"test:watch": "vitest",
|
|
10
|
-
"test:coverage": "vitest run --coverage",
|
|
11
|
-
"lint": "tsc --noEmit",
|
|
12
|
-
"all": "npm run lint && npm run test && npm run build"
|
|
13
|
-
},
|
|
14
|
-
"keywords": [
|
|
15
|
-
"github-action",
|
|
16
|
-
"code-review",
|
|
17
|
-
"ai",
|
|
18
|
-
"pull-request",
|
|
19
|
-
"linting",
|
|
20
|
-
"security",
|
|
21
|
-
"automation"
|
|
22
|
-
],
|
|
23
|
-
"author": "
|
|
24
|
-
"license": "MIT",
|
|
25
|
-
"
|
|
26
|
-
"
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
"
|
|
30
|
-
"
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
"
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
"
|
|
37
|
-
"
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
"
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
"
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
1
|
+
{
|
|
2
|
+
"name": "@theihtisham/review-agent",
|
|
3
|
+
"version": "1.1.0",
|
|
4
|
+
"description": "AI-powered code review GitHub Action with line-by-line PR comments",
|
|
5
|
+
"main": "dist/index.js",
|
|
6
|
+
"scripts": {
|
|
7
|
+
"build": "ncc build src/main.ts -o dist --source-map --license licenses.txt",
|
|
8
|
+
"test": "vitest run",
|
|
9
|
+
"test:watch": "vitest",
|
|
10
|
+
"test:coverage": "vitest run --coverage",
|
|
11
|
+
"lint": "tsc --noEmit",
|
|
12
|
+
"all": "npm run lint && npm run test && npm run build"
|
|
13
|
+
},
|
|
14
|
+
"keywords": [
|
|
15
|
+
"github-action",
|
|
16
|
+
"code-review",
|
|
17
|
+
"ai",
|
|
18
|
+
"pull-request",
|
|
19
|
+
"linting",
|
|
20
|
+
"security",
|
|
21
|
+
"automation"
|
|
22
|
+
],
|
|
23
|
+
"author": "theihtisham",
|
|
24
|
+
"license": "MIT",
|
|
25
|
+
"publishConfig": {
|
|
26
|
+
"access": "public"
|
|
27
|
+
},
|
|
28
|
+
"dependencies": {
|
|
29
|
+
"@actions/core": "^1.10.1",
|
|
30
|
+
"@actions/github": "^6.0.0",
|
|
31
|
+
"openai": "^4.67.3",
|
|
32
|
+
"js-yaml": "^4.1.0",
|
|
33
|
+
"minimatch": "^9.0.5"
|
|
34
|
+
},
|
|
35
|
+
"devDependencies": {
|
|
36
|
+
"@types/js-yaml": "^4.0.9",
|
|
37
|
+
"@types/node": "^22.7.9",
|
|
38
|
+
"@vercel/ncc": "^0.38.3",
|
|
39
|
+
"typescript": "^5.6.3",
|
|
40
|
+
"vitest": "^2.1.5",
|
|
41
|
+
"jest": "^29.7.0",
|
|
42
|
+
"ts-jest": "^29.1.0",
|
|
43
|
+
"@types/jest": "^29.5.0"
|
|
44
|
+
},
|
|
45
|
+
"repository": {
|
|
46
|
+
"type": "git",
|
|
47
|
+
"url": "git+https://github.com/theihtisham/review-agent.git"
|
|
48
|
+
},
|
|
49
|
+
"bugs": {
|
|
50
|
+
"url": "https://github.com/theihtisham/review-agent/issues"
|
|
51
|
+
},
|
|
52
|
+
"homepage": "https://github.com/theihtisham/review-agent#readme"
|
|
53
|
+
}
|