@theihtisham/review-agent 1.0.0 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/.editorconfig ADDED
@@ -0,0 +1,12 @@
1
+ root = true
2
+
3
+ [*]
4
+ charset = utf-8
5
+ end_of_line = lf
6
+ indent_style = space
7
+ indent_size = 2
8
+ insert_final_newline = true
9
+ trim_trailing_whitespace = true
10
+
11
+ [*.md]
12
+ trim_trailing_whitespace = false
@@ -0,0 +1,43 @@
1
+ name: Bug Report
2
+ description: Report a bug or unexpected behavior
3
+ labels: [bug]
4
+ body:
5
+ - type: textarea
6
+ id: description
7
+ attributes:
8
+ label: Bug Description
9
+ description: What happened?
10
+ placeholder: "When I run agent-memory..."
11
+ validations:
12
+ required: true
13
+
14
+ - type: textarea
15
+ id: steps
16
+ attributes:
17
+ label: Steps to Reproduce
18
+ description: How can we reproduce this?
19
+ placeholder: "1. Install...\n2. Configure...\n3. Run..."
20
+ validations:
21
+ required: true
22
+
23
+ - type: textarea
24
+ id: expected
25
+ attributes:
26
+ label: Expected Behavior
27
+ description: What should have happened?
28
+ validations:
29
+ required: true
30
+
31
+ - type: textarea
32
+ id: environment
33
+ attributes:
34
+ label: Environment
35
+ description: Node version, OS, etc.
36
+ placeholder: "Node 20.11.0, macOS 14, agent-memory 1.0.0"
37
+
38
+ - type: textarea
39
+ id: logs
40
+ attributes:
41
+ label: Relevant Logs
42
+ description: Paste any relevant log output
43
+ render: shell
@@ -0,0 +1,33 @@
1
+ name: Feature Request
2
+ description: Suggest a new feature or enhancement
3
+ labels: [enhancement]
4
+ body:
5
+ - type: textarea
6
+ id: problem
7
+ attributes:
8
+ label: Problem
9
+ description: What problem does this feature solve?
10
+ placeholder: "I'm frustrated when..."
11
+ validations:
12
+ required: true
13
+
14
+ - type: textarea
15
+ id: solution
16
+ attributes:
17
+ label: Proposed Solution
18
+ description: How should it work?
19
+ validations:
20
+ required: true
21
+
22
+ - type: dropdown
23
+ id: type
24
+ attributes:
25
+ label: Feature Type
26
+ options:
27
+ - New Tool/Resource
28
+ - Performance Improvement
29
+ - Developer Experience
30
+ - Documentation
31
+ - Other
32
+ validations:
33
+ required: true
@@ -0,0 +1,18 @@
1
+ ## Description
2
+
3
+ <!-- Brief description of changes -->
4
+
5
+ ## Type of Change
6
+
7
+ - [ ] Bug fix
8
+ - [ ] New feature
9
+ - [ ] Breaking change
10
+ - [ ] Documentation update
11
+ - [ ] Refactor / cleanup
12
+
13
+ ## Checklist
14
+
15
+ - [ ] Tests pass (`npm test`)
16
+ - [ ] Type checks pass (`npm run lint`)
17
+ - [ ] No secrets or credentials introduced
18
+ - [ ] Commit messages follow [conventional commits](https://www.conventionalcommits.org/)
@@ -0,0 +1,16 @@
1
+ version: 2
2
+ updates:
3
+ - package-ecosystem: npm
4
+ directory: /
5
+ schedule:
6
+ interval: weekly
7
+ day: monday
8
+ open-pull-requests-limit: 5
9
+ commit-message:
10
+ prefix: chore
11
+ include: scope
12
+
13
+ - package-ecosystem: github-actions
14
+ directory: /
15
+ schedule:
16
+ interval: monthly
@@ -0,0 +1,24 @@
1
+ name: CI
2
+
3
+ on:
4
+ push:
5
+ branches: [main, master]
6
+ pull_request:
7
+ branches: [main, master]
8
+
9
+ jobs:
10
+ build-and-test:
11
+ runs-on: ubuntu-latest
12
+ strategy:
13
+ matrix:
14
+ node-version: [18, 20, 22]
15
+ steps:
16
+ - uses: actions/checkout@v4
17
+ - uses: actions/setup-node@v4
18
+ with:
19
+ node-version: ${{ matrix.node-version }}
20
+ cache: npm
21
+ - run: npm ci
22
+ - run: npm run lint
23
+ - run: npm test
24
+ - run: npm run build
@@ -0,0 +1,27 @@
1
+ # Contributor Covenant Code of Conduct
2
+
3
+ ## Our Pledge
4
+
5
+ We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone.
6
+
7
+ ## Our Standards
8
+
9
+ Examples of behavior that contributes to a positive environment:
10
+ - Demonstrating empathy and kindness toward other people
11
+ - Being respectful of differing opinions, viewpoints, and experiences
12
+ - Giving and gracefully accepting constructive feedback
13
+ - Accepting responsibility and apologizing to those affected by our mistakes
14
+
15
+ Examples of unacceptable behavior:
16
+ - The use of sexualized language or imagery
17
+ - Trolling, insulting or derogatory comments
18
+ - Public or private harassment
19
+ - Publishing others' private information without explicit permission
20
+
21
+ ## Enforcement
22
+
23
+ Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to **Theihtisham@outlook.com**.
24
+
25
+ ## Attribution
26
+
27
+ This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1.
package/Dockerfile ADDED
@@ -0,0 +1,8 @@
1
+ FROM node:20-slim
2
+
3
+ WORKDIR /app
4
+ COPY package*.json ./
5
+ RUN npm ci --production
6
+ COPY dist/ ./dist/
7
+
8
+ ENTRYPOINT ["node", "dist/index.js"]
package/README.md CHANGED
@@ -1,352 +1,118 @@
1
- # ReviewAgent
1
+ <div align="center">
2
2
 
3
- **Your senior dev in a GitHub Action AI reviews every PR with line-by-line comments, catches bugs and security holes before merge.**
3
+ <img width="100%" height="180" src="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 960 180'%3E%3Cdefs%3E%3ClinearGradient id='g' x1='0%25' y1='0%25' x2='100%25' y2='100%25'%3E%3Cstop offset='0%25' stop-color='%23f43f5e'/%3E%3Cstop offset='100%25' stop-color='%23f97316'/%3E%3C/linearGradient%3E%3C/defs%3E%3Crect width='960' height='180' fill='%230a0a1a' rx='16'/%3E%3Crect x='2' y='2' width='956' height='176' fill='none' stroke='url(%23g)' stroke-width='2' rx='15'/%3E%3Ctext x='480' y='75' text-anchor='middle' fill='white' font-family='system-ui' font-size='38' font-weight='bold'%3E%F0%9F%9B%A1 Review Agent%3C/text%3E%3Ctext x='480' y='115' text-anchor='middle' fill='%23a5a5c0' font-family='system-ui' font-size='18'%3EAI-Powered Code Review with Line-by-Line Comments%3C/text%3E%3Ctext x='480' y='148' text-anchor='middle' fill='%236b6b88' font-family='monospace' font-size='13'%3EGitHub Action %C2%B7 OpenAI %C2%B7 Bug Detection %C2%B7 Security Scan %C2%B7 Performance%3C/text%3E%3C/svg%3E" alt="Review Agent Banner"/>
4
4
 
5
- [![GitHub Action](https://img.shields.io/badge/GitHub-Action-blue?logo=github)](https://github.com/features/actions)
6
- [![TypeScript](https://img.shields.io/badge/TypeScript-Strict-3178C6?logo=typescript)](https://www.typescriptlang.org/)
7
- [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
8
- [![Vitest](https://img.shields.io/badge/Tested%20with-Vitest-6E9F18?logo=vitest)](https://vitest.dev/)
5
+ [![CI](https://img.shields.io/github/actions/workflow/status/theihtisham/review-agent/ci.yml?style=for-the-badge&label=CI)](https://github.com/theihtisham/review-agent/actions/workflows/ci.yml)
6
+ [![npm version](https://img.shields.io/npm/v/@theihtisham/review-agent.svg?style=for-the-badge&color=FF6D00)](https://www.npmjs.com/package/@theihtisham/review-agent)
7
+ [![npm downloads](https://img.shields.io/npm/dt/@theihtisham/review-agent?style=for-the-badge&color=0A9D2A)](https://www.npmjs.com/package/@theihtisham/review-agent)
8
+ [![GitHub stars](https://img.shields.io/github/stars/theihtisham/review-agent?style=for-the-badge&color=FFD700)](https://github.com/theihtisham/review-agent/stargazers)
9
+ [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge)](https://opensource.org/licenses/MIT)
9
10
 
10
- ---
11
-
12
- ## What It Does
13
-
14
- ReviewAgent watches every pull request and automatically posts a **line-by-line code review** using AI. It catches bugs, security vulnerabilities, performance issues, and style violations — then posts them as GitHub review comments on the exact lines that need attention.
15
-
16
- ### The Review
17
-
18
- Every review includes:
11
+ **AI-powered code review GitHub Action with line-by-line PR comments.** Detects bugs, security vulnerabilities, and performance issues with configurable severity levels and auto-approve support.
19
12
 
20
- | Category | What It Catches |
21
- |----------|----------------|
22
- | **Bugs** | Null/undefined access, off-by-one errors, race conditions, unhandled edge cases, logic errors |
23
- | **Security** | SQL injection, XSS, hardcoded secrets, eval() usage, command injection, OWASP Top 10 |
24
- | **Performance** | N+1 queries, memory leaks, inefficient algorithms, unnecessary re-renders |
25
- | **Style** | Naming, formatting, readability, code organization |
26
- | **Convention** | Violations of your repo's own patterns and naming styles |
13
+ [Quick Start](#-quick-start) · [Architecture](#-architecture) · [Configuration](#-configuration)
27
14
 
28
- ### The Output
29
-
30
- Each review produces:
31
-
32
- - **Line-by-line comments** on the exact lines with issues
33
- - **Severity tags** — critical / warning / info
34
- - **Category labels** — bug / security / performance / style / convention
35
- - **Overall quality score** (0-100)
36
- - **Summary comment** with breakdown table
15
+ </div>
37
16
 
38
17
  ---
39
18
 
40
- ## Demo
41
-
42
- Here's what a ReviewAgent review looks like on a real PR:
43
-
44
- ### PR introduces a login endpoint with security issues:
45
-
46
- ```typescript
47
- // src/auth.ts
48
- const API_KEY = "sk-1234567890abcdef";
49
-
50
- function login(req: Request, res: Response) {
51
- const query = "SELECT * FROM users WHERE name = '" + req.body.username + "'";
52
- db.query(query);
53
- if (req.body.password === ADMIN_PASSWORD) {
54
- res.redirect(req.query.returnUrl);
55
- }
56
- }
57
- ```
58
-
59
- ### ReviewAgent posts these inline comments:
60
-
61
- > **Line 2** — `[Security] (critical)` Hardcoded secret detected. Move this to an environment variable or secret manager.
62
- > *OWASP: A07:2021-Identification and Authentication Failures*
63
-
64
- > **Line 5** — `[Security] (critical)` Potential SQL injection: avoid string concatenation in queries. Use parameterized queries instead.
65
- > *OWASP: A03:2021-Injection*
66
-
67
- > **Line 7** — `[Security] (critical)` Potential open redirect. Validate and whitelist redirect targets.
68
- > *OWASP: A01:2021-Broken Access Control*
69
-
70
- ### And a summary comment:
71
-
72
- ```
73
- ## 🔴 ReviewAgent Code Review Summary
74
-
75
- **Score: 25/100** — Poor
76
-
77
- Critical security issues found: SQL injection, hardcoded secrets, and open redirect.
78
-
79
- | Category | Count |
80
- |----------|-------|
81
- | 🐛 Bug | 1 |
82
- | 🔒 Security | 3 |
83
- | ⚡ Performance | 0 |
84
- | 🎨 Style | 1 |
19
+ ## Architecture
85
20
 
86
- ### Stats
87
- - **Files reviewed:** 3
88
- - **Comments posted:** 5
21
+ ```mermaid
22
+ graph TD
23
+ PR[Pull Request] --> DIFF[Diff Fetcher<br/>@actions/github]
24
+ DIFF --> FILTER[File Filter<br/>minimatch glob]
25
+ FILTER --> CHUNK[Code Chunker<br/>Context-Aware Splitting]
26
+ CHUNK --> LLM[LLM Analyzer<br/>OpenAI API]
27
+ LLM --> PARSE[Result Parser<br/>Structured Findings]
28
+ PARSE --> SEVERITY[Severity Classifier<br/>info → critical]
29
+ SEVERITY --> COMMENTS[Inline Comments<br/>Line-by-Line]
30
+ SEVERITY --> SUMMARY[Review Summary<br/>PR Description]
31
+
32
+ style LLM fill:#f43f5e,color:#fff
33
+ style SEVERITY fill:#f97316,color:#fff
34
+ style COMMENTS fill:#34d399,color:#000
89
35
  ```
90
36
 
91
37
  ---
92
38
 
93
- ## Installation
94
-
95
- Add ReviewAgent to any repository in **5 lines of YAML**:
39
+ ## Quick Start
96
40
 
97
41
  ```yaml
98
42
  # .github/workflows/review.yml
99
- name: AI Code Review
100
- on: [pull_request]
43
+ name: AI Review
44
+ on:
45
+ pull_request:
46
+ types: [opened, synchronize]
47
+
101
48
  jobs:
102
49
  review:
103
50
  runs-on: ubuntu-latest
51
+ permissions:
52
+ pull-requests: write
53
+ contents: read
104
54
  steps:
105
- - uses: actions/checkout@v4
106
- - uses: reviewagent/review-agent@v1
55
+ - uses: theihtisham/review-agent@v1
107
56
  with:
108
57
  github-token: ${{ secrets.GITHUB_TOKEN }}
109
- llm-api-key: ${{ secrets.OPENAI_API_KEY }}
58
+ api-key: ${{ secrets.OPENAI_API_KEY }}
110
59
  ```
111
60
 
112
- That's it. Every PR now gets an AI code review.
113
-
114
61
  ---
115
62
 
116
63
  ## Configuration
117
64
 
118
- ### Action Inputs
119
-
120
- | Input | Default | Description |
121
- |-------|---------|-------------|
122
- | `github-token` | *required* | GitHub token for API access (`secrets.GITHUB_TOKEN` or a PAT) |
123
- | `llm-provider` | `openai` | LLM provider: `openai`, `anthropic`, or `ollama` |
124
- | `llm-api-key` | `""` | API key for the LLM (omit for Ollama) |
125
- | `llm-model` | `gpt-4o` | Model name (e.g., `gpt-4o`, `claude-sonnet-4-20250514`, `llama3.1`) |
126
- | `llm-base-url` | auto | Custom API endpoint (required for self-hosted models) |
127
- | `config-path` | `.reviewagent.yml` | Path to config file in the repo |
128
- | `severity` | `warning` | Minimum severity to report: `critical`, `warning`, `info` |
129
- | `max-comments` | `50` | Maximum review comments per PR |
130
- | `review-type` | `comment` | GitHub review type: `approve`, `request-changes`, `comment` |
131
- | `language-hints` | `""` | Comma-separated languages (e.g., `typescript,python`) |
132
- | `learn-conventions` | `true` | Learn repo conventions from existing code |
133
-
134
- ### Using with OpenAI
135
-
136
- ```yaml
137
- - uses: reviewagent/review-agent@v1
138
- with:
139
- github-token: ${{ secrets.GITHUB_TOKEN }}
140
- llm-provider: openai
141
- llm-api-key: ${{ secrets.OPENAI_API_KEY }}
142
- llm-model: gpt-4o
143
- ```
144
-
145
- ### Using with Anthropic
146
-
147
- ```yaml
148
- - uses: reviewagent/review-agent@v1
149
- with:
150
- github-token: ${{ secrets.GITHUB_TOKEN }}
151
- llm-provider: anthropic
152
- llm-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
153
- llm-model: claude-sonnet-4-20250514
154
- ```
155
-
156
- ### Using with Ollama (Free, Self-Hosted)
157
-
158
- ```yaml
159
- - uses: reviewagent/review-agent@v1
160
- with:
161
- github-token: ${{ secrets.GITHUB_TOKEN }}
162
- llm-provider: ollama
163
- llm-model: llama3.1
164
- llm-base-url: http://your-ollama-host:11434/v1
165
- ```
166
-
167
- No API key needed. Run Ollama on any machine with a GPU and point the action at it.
65
+ | Input | Required | Default | Description |
66
+ |-------|----------|---------|-------------|
67
+ | `github-token` | Yes | | GitHub token |
68
+ | `api-key` | Yes | — | OpenAI API key |
69
+ | `api-base` | No | `https://api.openai.com/v1` | API endpoint |
70
+ | `model` | No | `gpt-4o` | AI model |
71
+ | `max-comments` | No | `20` | Max comments per review |
72
+ | `severity-threshold` | No | `info` | Min: info/warning/error/critical |
73
+ | `review-types` | No | `bug,security,performance,quality` | Review categories |
74
+ | `ignore-paths` | No | | Glob patterns to skip |
75
+ | `auto-approve` | No | `false` | Auto-approve clean PRs |
76
+ | `fail-on-critical` | No | `false` | Fail on critical issues |
168
77
 
169
78
  ---
170
79
 
171
- ## Custom Rules (`.reviewagent.yml`)
172
-
173
- Create a `.reviewagent.yml` file in your repo root to customize ReviewAgent:
174
-
175
- ```yaml
176
- # .reviewagent.yml
177
-
178
- # Custom review rules
179
- rules:
180
- - name: "no-console-log"
181
- pattern: "console\\.log"
182
- message: "Use the logger module instead of console.log"
183
- severity: warning
184
- category: convention
185
-
186
- - name: "no-any-type"
187
- pattern: ":\\s*any\\b"
188
- message: "Avoid 'any' type. Use a specific type or 'unknown'."
189
- severity: warning
190
- category: convention
191
-
192
- - name: "require-error-boundary"
193
- pattern: "export\\s+default\\s+function\\s+\\w+"
194
- message: "Top-level components should be wrapped in an ErrorBoundary."
195
- severity: info
196
- category: convention
197
-
198
- # Additional paths to ignore
199
- ignore:
200
- paths:
201
- - "proto/**"
202
- - "**/*.generated.ts"
203
- extensions:
204
- - ".proto"
205
- ```
206
-
207
- ### Rule Fields
208
-
209
- | Field | Required | Description |
210
- |-------|----------|-------------|
211
- | `name` | Yes | Unique rule identifier |
212
- | `pattern` | Yes | Regex pattern to match in changed lines |
213
- | `message` | Yes | Message shown in the review comment |
214
- | `severity` | Yes | `critical`, `warning`, or `info` |
215
- | `category` | Yes | `bug`, `security`, `performance`, `style`, or `convention` |
216
-
217
- ---
80
+ ## Docker
218
81
 
219
- ## Architecture
220
-
221
- ```
222
- PR opened/updated
223
- |
224
- v
225
- GitHub Action triggered
226
- |
227
- v
228
- Parse action inputs + .reviewagent.yml
229
- |
230
- v
231
- Fetch PR diff (only changed files)
232
- |
233
- v
234
- Filter out ignored files
235
- (node_modules, generated, binaries, etc.)
236
- |
237
- +--> Static Security Scanner (local, fast)
238
- | - 14 OWASP-aware patterns
239
- | - Custom regex rules from config
240
- |
241
- +--> LLM Deep Review (AI-powered)
242
- | - Per-file analysis with diff context
243
- | - Repo conventions injected in prompt
244
- | - JSON-structured response
245
- |
246
- v
247
- Merge & deduplicate findings
248
- |
249
- v
250
- Sort by severity (critical first)
251
- |
252
- v
253
- Post GitHub Review
254
- (inline comments + summary + score)
82
+ ```bash
83
+ docker build -t review-agent .
84
+ docker run review-agent
255
85
  ```
256
86
 
257
- ### Key Design Decisions
258
-
259
- - **Diff-aware**: Only reviews lines that changed. No noise from untouched code.
260
- - **Two-pass review**: Fast static scan for known patterns, then deep LLM analysis for nuanced issues.
261
- - **Convention learning**: Reads your existing codebase to learn naming styles and patterns before reviewing.
262
- - **Rate limiting**: Built-in rate limiter prevents API abuse (configurable concurrency and intervals).
263
- - **Fallback**: If inline review fails (e.g., outdated diff), posts as a regular PR comment.
264
-
265
- ---
266
-
267
- ## Security
268
-
269
- ReviewAgent takes security seriously:
270
-
271
- - **Never logs code content** — all diffs are sanitized before logging
272
- - **API keys via secrets only** — keys are masked in all GitHub Actions output
273
- - **Input validation** — all action inputs are validated before use
274
- - **No data storage** — code is sent to the LLM provider for analysis and not stored
275
- - **Secret redaction** — log sanitizer catches accidental secret leaks in output
276
-
277
- ### Recommendations
278
-
279
- - Use `secrets.GITHUB_TOKEN` (automatic) or a fine-grained PAT with minimal permissions
280
- - Store LLM API keys in GitHub Secrets, never in workflow files
281
- - For self-hosted Ollama, use a private network or VPN
282
-
283
87
  ---
284
88
 
285
89
  ## Development
286
90
 
287
91
  ```bash
288
- # Install dependencies
289
92
  npm install
290
-
291
- # Run tests
93
+ npm run build
292
94
  npm test
293
-
294
- # Run tests with coverage
295
95
  npm run test:coverage
296
-
297
- # Type check
298
- npm run lint
299
-
300
- # Build for production
301
- npm run build
302
-
303
- # Full check (lint + test + build)
304
- npm run all
305
96
  ```
306
97
 
307
- ### Project Structure
98
+ ---
308
99
 
309
- ```
310
- 11-review-agent/
311
- src/
312
- main.ts # Action entry point
313
- config.ts # Input parsing, config building
314
- types.ts # TypeScript type definitions
315
- github.ts # GitHub API client (reviews, diffs)
316
- llm-client.ts # LLM client (OpenAI, Anthropic, Ollama)
317
- reviewer.ts # Core review orchestrator
318
- conventions.ts # Repo convention learning
319
- reviewers/
320
- security.ts # Static security pattern scanner
321
- utils/
322
- diff-parser.ts # Patch parsing, line extraction
323
- rate-limiter.ts # Rate limiting and retry logic
324
- security.ts # Sanitization, formatting utilities
325
- __tests__/
326
- config.test.ts
327
- diff-parser.test.ts
328
- security.test.ts
329
- rate-limiter.test.ts
330
- security-utils.test.ts
331
- llm-client.test.ts
332
- fixtures/
333
- mock-data.ts
334
- action.yml # GitHub Action definition
335
- package.json
336
- tsconfig.json
337
- vitest.config.ts
338
- LICENSE
339
- README.md
340
- ```
100
+ ## Trending Tags
101
+
102
+ `code-review` `github-action` `ai` `security` `bug-detection` `performance` `openai` `automation` `developer-tools`
341
103
 
342
104
  ---
343
105
 
344
106
  ## License
345
107
 
346
- [MIT](LICENSE) use it however you want.
108
+ MIT License — see [LICENSE](LICENSE) for details.
347
109
 
348
110
  ---
349
111
 
350
- <p align="center">
351
- <strong>ReviewAgent</strong> — Ship better code, faster.
352
- </p>
112
+ <div align="center">
113
+
114
+ **Built by [theihtisham](https://github.com/theihtisham)**
115
+
116
+ [GitHub](https://github.com/theihtisham) · [npm](https://www.npmjs.com/~theihtisham) · [Email](mailto:Theihtisham@outlook.com)
117
+
118
+ </div>
package/SECURITY.md ADDED
@@ -0,0 +1,22 @@
1
+ # Security Policy
2
+
3
+ ## Supported Versions
4
+
5
+ | Version | Supported |
6
+ | ------- | --------- |
7
+ | 1.x | Yes |
8
+
9
+ ## Reporting a Vulnerability
10
+
11
+ If you discover a security vulnerability, please report it responsibly:
12
+
13
+ - **Email**: Theihtisham@outlook.com
14
+ - **Subject**: [Security] Vulnerability in ai-agent-memory
15
+
16
+ Please include:
17
+ 1. Description of the vulnerability
18
+ 2. Steps to reproduce
19
+ 3. Potential impact
20
+ 4. Suggested fix (if any)
21
+
22
+ We aim to respond within 48 hours and patch critical issues within 7 days.
package/package.json CHANGED
@@ -1,46 +1,53 @@
1
- {
2
- "name": "@theihtisham/review-agent",
3
- "version": "1.0.0",
4
- "description": "AI-powered code review GitHub Action with line-by-line PR comments",
5
- "main": "dist/index.js",
6
- "scripts": {
7
- "build": "ncc build src/main.ts -o dist --source-map --license licenses.txt",
8
- "test": "vitest run",
9
- "test:watch": "vitest",
10
- "test:coverage": "vitest run --coverage",
11
- "lint": "tsc --noEmit",
12
- "all": "npm run lint && npm run test && npm run build"
13
- },
14
- "keywords": [
15
- "github-action",
16
- "code-review",
17
- "ai",
18
- "pull-request",
19
- "linting",
20
- "security",
21
- "automation"
22
- ],
23
- "author": "ReviewAgent Contributors",
24
- "license": "MIT",
25
- "dependencies": {
26
- "@actions/core": "^1.10.1",
27
- "@actions/github": "^6.0.0",
28
- "openai": "^4.67.3",
29
- "js-yaml": "^4.1.0",
30
- "minimatch": "^9.0.5"
31
- },
32
- "devDependencies": {
33
- "@types/js-yaml": "^4.0.9",
34
- "@types/node": "^22.7.9",
35
- "@vercel/ncc": "^0.38.3",
36
- "typescript": "^5.6.3",
37
- "vitest": "^2.1.5"
38
- },
39
- "publishConfig": {
40
- "access": "public"
41
- },
42
- "repository": {
43
- "type": "git",
44
- "url": "https://github.com/theihtisham/review-agent"
45
- }
46
- }
1
+ {
2
+ "name": "@theihtisham/review-agent",
3
+ "version": "1.1.0",
4
+ "description": "AI-powered code review GitHub Action with line-by-line PR comments",
5
+ "main": "dist/index.js",
6
+ "scripts": {
7
+ "build": "ncc build src/main.ts -o dist --source-map --license licenses.txt",
8
+ "test": "vitest run",
9
+ "test:watch": "vitest",
10
+ "test:coverage": "vitest run --coverage",
11
+ "lint": "tsc --noEmit",
12
+ "all": "npm run lint && npm run test && npm run build"
13
+ },
14
+ "keywords": [
15
+ "github-action",
16
+ "code-review",
17
+ "ai",
18
+ "pull-request",
19
+ "linting",
20
+ "security",
21
+ "automation"
22
+ ],
23
+ "author": "theihtisham",
24
+ "license": "MIT",
25
+ "publishConfig": {
26
+ "access": "public"
27
+ },
28
+ "dependencies": {
29
+ "@actions/core": "^1.10.1",
30
+ "@actions/github": "^6.0.0",
31
+ "openai": "^4.67.3",
32
+ "js-yaml": "^4.1.0",
33
+ "minimatch": "^9.0.5"
34
+ },
35
+ "devDependencies": {
36
+ "@types/js-yaml": "^4.0.9",
37
+ "@types/node": "^22.7.9",
38
+ "@vercel/ncc": "^0.38.3",
39
+ "typescript": "^5.6.3",
40
+ "vitest": "^2.1.5",
41
+ "jest": "^29.7.0",
42
+ "ts-jest": "^29.1.0",
43
+ "@types/jest": "^29.5.0"
44
+ },
45
+ "repository": {
46
+ "type": "git",
47
+ "url": "git+https://github.com/theihtisham/review-agent.git"
48
+ },
49
+ "bugs": {
50
+ "url": "https://github.com/theihtisham/review-agent/issues"
51
+ },
52
+ "homepage": "https://github.com/theihtisham/review-agent#readme"
53
+ }