@tinkcarlos/skillora 0.2.0

package/.claude/skills/code-review/references/automated-analysis.md

@@ -0,0 +1,456 @@
+# Automated Code Analysis Guide
+
+> Maximize bug discovery rate through automated tools and scripts.
+
+## Table of Contents
+
+- [Impact Scope Auto-Analysis](#impact-scope-auto-analysis)
+- [Dependency Graph Auto-Generation](#dependency-graph-auto-generation)
+- [Full-Stack Scan Scripts](#full-stack-scan-scripts)
+- [CI/CD Integration](#cicd-integration)
+
+---
+
+## Impact Scope Auto-Analysis
+
+### One-Click Impact Scope Analysis Script
+
+```bash
+#!/bin/bash
+# impact-analyzer.sh - Auto-analyze code change impact scope
+
+TARGET_FILE=$1
+echo "=== Analyzing file: $TARGET_FILE ==="
+
+echo ""
+echo "=== Layer 0: File itself ==="
+echo "Line count: $(wc -l < $TARGET_FILE)"
+echo "Functions/Classes:"
+grep -n "^def \|^class \|^async def " $TARGET_FILE
+
+echo ""
+echo "=== Layer 1: Direct callers ==="
+BASENAME=$(basename $TARGET_FILE .py)
+grep -rn "from.*$BASENAME import\|import $BASENAME" --include="*.py" | head -20
+
+echo ""
+echo "=== Layer 2: Indirect callers (trace Layer 1 callers) ==="
+for caller in $(grep -l "from.*$BASENAME import\|import $BASENAME" --include="*.py" -r); do
+    caller_base=$(basename $caller .py)
+    echo "--- $caller called by: ---"
+    grep -rn "from.*$caller_base import\|import $caller_base" --include="*.py" | head -5
+done
+
+echo ""
+echo "=== Layer 3: Router/API layer ==="
+grep -rn "@router\|@app\." --include="*.py" -l | xargs grep -l "$BASENAME" 2>/dev/null
+
+echo ""
+echo "=== Layer 4: Frontend calls ==="
+# Search API calls
+FUNC_NAMES=$(grep -oP "def \K[a-z_]+" $TARGET_FILE | tr '\n' '|' | sed 's/|$//')
+grep -rn "$FUNC_NAMES" --include="*.ts" --include="*.tsx" 2>/dev/null | head -10
+
+echo ""
+echo "=== Layer 5: Test coverage ==="
+grep -rn "$BASENAME" --include="*test*.py" --include="*spec*.ts" | head -10
+```
+
+### Python Dependency Analysis
+
+```bash
+# Install tools
+pip install pydeps pipdeptree
+
+# Generate module dependency graph
+pydeps src/services/chat_service.py --max-bacon 3 -o deps.svg
+
+# View package dependency tree
+pipdeptree --packages your-package
+```
+
+### TypeScript/JavaScript Dependency Analysis
+
+```bash
+# Install madge
+npm install -g madge
+
+# Generate dependency graph
+madge --image deps.svg src/
+
+# Detect circular dependencies
+madge --circular src/
+
+# Generate dependencies for specific file
+madge --image chat-deps.svg src/services/chatService.ts
+```
+
+---
+
+## Dependency Graph Auto-Generation
+
+### Mermaid Dependency Graph Generator
+
+```python
+#!/usr/bin/env python3
+# generate_dep_graph.py - Auto-generate Mermaid dependency graph
+
+import os
+import re
+import sys
+from pathlib import Path
+
+def extract_imports(file_path):
+    """Extract imports from Python file"""
+    imports = []
+    with open(file_path, 'r', encoding='utf-8') as f:
+        for line in f:
+            # from x import y
+            match = re.match(r'from\s+\.?([a-zA-Z_][a-zA-Z0-9_\.]*)\s+import', line)
+            if match:
+                imports.append(match.group(1))
+            # import x
+            match = re.match(r'import\s+([a-zA-Z_][a-zA-Z0-9_\.]*)', line)
+            if match:
+                imports.append(match.group(1))
+    return imports
+
+def generate_mermaid(directory, target_module=None):
+    """Generate Mermaid dependency graph"""
+    deps = {}
+    
+    for py_file in Path(directory).rglob('*.py'):
+        module_name = py_file.stem
+        if module_name.startswith('__'):
+            continue
+        imports = extract_imports(py_file)
+        deps[module_name] = imports
+    
+    # Generate Mermaid
+    print("```mermaid")
+    print("graph TD")
+    
+    for module, imports in deps.items():
+        for imp in imports:
+            imp_base = imp.split('.')[-1]
+            if imp_base in deps:  # Only show internal dependencies
+                print(f"    {module} --> {imp_base}")
+    
+    print("```")
+
+if __name__ == "__main__":
+    directory = sys.argv[1] if len(sys.argv) > 1 else "src"
+    generate_mermaid(directory)
+```
+
+### Call Graph Generation
+
+```bash
+# Using pycallgraph (Python)
+pip install pycallgraph2
+pycallgraph graphviz -- ./your_script.py
+
+# Using py-call-graph to generate JSON
+python -m trace --trackcalls your_script.py
+```
+
+---
+
+## Full-Stack Scan Scripts
+
+### Complete Code Review Scan Script
+
+```bash
+#!/bin/bash
+# full-stack-scan.sh - Full-stack code review auto scanner
+
+set -e
+
+echo "╔════════════════════════════════════════════════════════╗"
+echo "║        Full-Stack Code Review Auto Scanner v1.0        ║"
+echo "╚════════════════════════════════════════════════════════╝"
+
+# Color definitions
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# ==================== Backend Scan ====================
+echo ""
+echo "━━━━━━━━━━━━━━━━ Backend Scan ━━━━━━━━━━━━━━━━"
+
+if [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then
+    echo -e "${YELLOW}[Python project detected]${NC}"
+    
+    echo ""
+    echo "📋 1. Static Analysis (pylint + flake8)"
+    pylint src/ --output-format=colorized --disable=C0114,C0115,C0116 2>/dev/null || true
+    flake8 src/ --count --show-source --statistics || true
+    
+    echo ""
+    echo "🔒 2. Security Scan (bandit)"
+    bandit -r src/ -ll 2>/dev/null || true
+    
+    echo ""
+    echo "📊 3. Type Check (mypy)"
+    mypy src/ --ignore-missing-imports 2>/dev/null || true
+    
+    echo ""
+    echo "🧪 4. Test Coverage"
+    pytest --cov=src --cov-report=term-missing --cov-fail-under=80 2>/dev/null || echo "Tests not configured or failed"
+fi
+
+if [ -f "package.json" ] && [ -d "backend" ]; then
+    echo -e "${YELLOW}[Node.js backend detected]${NC}"
+    
+    echo ""
+    echo "📋 ESLint Check"
+    npx eslint backend/ --max-warnings 0 || true
+    
+    echo ""
+    echo "📊 TypeScript Type Check"
+    npx tsc --noEmit -p backend/tsconfig.json || true
+    
+    echo ""
+    echo "🔒 Security Vulnerability Check"
+    npm audit || true
+fi
+
+# ==================== Frontend Scan ====================
+echo ""
+echo "━━━━━━━━━━━━━━━━ Frontend Scan ━━━━━━━━━━━━━━━━"
+
+if [ -d "frontend" ] || [ -d "src/components" ]; then
+    echo -e "${YELLOW}[Frontend project detected]${NC}"
+    
+    echo ""
+    echo "📋 1. ESLint + TypeScript"
+    npx eslint "frontend/**/*.{ts,tsx}" --max-warnings 0 2>/dev/null || true
+    npx tsc --noEmit 2>/dev/null || true
+    
+    echo ""
+    echo "🎨 2. Stylelint (CSS)"
+    npx stylelint "frontend/**/*.{css,scss}" 2>/dev/null || echo "Stylelint not configured"
+    
+    echo ""
+    echo "♿ 3. Accessibility Check"
+    echo "   (Need to run axe-core or Lighthouse in browser)"
+    
+    echo ""
+    echo "📦 4. Bundle Analysis"
+    if [ -f "frontend/package.json" ]; then
+        cd frontend
+        npx source-map-explorer 'dist/**/*.js' 2>/dev/null || echo "Need to build project first"
+        cd ..
+    fi
+fi
+
+# ==================== Hidden Bug Scan ====================
+echo ""
+echo "━━━━━━━━━━━━━━━━ Hidden Bug Scan ━━━━━━━━━━━━━━━━"
+
+echo ""
+echo "🔴 1. Data Race Detection"
+echo "--- Singleton state modification ---"
+grep -rn "self\.[a-z_]* = " --include="*.py" | grep -v "__init__\|# " | head -10 || echo "Not found"
+
+echo ""
+echo "🟠 2. Resource Leak Detection"
+echo "--- Unclosed connections ---"
+grep -rn "\.acquire()\|connection\(" --include="*.py" | grep -v "with\|async with" | head -5 || echo "Not found"
+
+echo ""
+echo "--- Uncleaned useEffect ---"
+grep -rn "useEffect" --include="*.tsx" -A 5 | grep -B 3 "\\[\\])" | grep -v "return" | head -10 || echo "Not found"
+
+echo ""
+echo "🟡 3. Hardcoded Credentials Detection"
+grep -rn "password\s*=\s*['\"]" --include="*.py" --include="*.ts" | grep -v "os.environ\|process.env\|example\|test" | head -5 || echo "Not found"
+
+echo ""
+echo "🔵 4. N+1 Query Detection"
+grep -rn "for.*in.*:\s*$" --include="*.py" -A 3 | grep -E "await.*\.(get|fetch|query)" | head -5 || echo "Not found"
+
+# ==================== Summary Report ====================
+echo ""
+echo "╔════════════════════════════════════════════════════════╗"
+echo "║                    Scan Complete                       ║"
+echo "╚════════════════════════════════════════════════════════╝"
+echo ""
+echo "Recommended next steps:"
+echo "  1. Fix all 🔴 Critical issues"
+echo "  2. Evaluate risk of 🟠 High issues"
+echo "  3. Run complete test suite"
+echo "  4. Perform manual code review"
+```
+
+---
+
+## CI/CD Integration
+
+### GitHub Actions Configuration
+
+```yaml
+# .github/workflows/code-review.yml
+name: Automated Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  backend-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      
+      - name: Install dependencies
+        run: |
+          pip install pylint flake8 bandit mypy pytest pytest-cov
+          pip install -r requirements.txt
+      
+      - name: Pylint
+        run: pylint src/ --output-format=colorized --fail-under=7.0
+        continue-on-error: true
+      
+      - name: Flake8
+        run: flake8 src/ --count --show-source --statistics
+      
+      - name: Bandit Security Scan
+        run: bandit -r src/ -ll -f json -o bandit-report.json
+        continue-on-error: true
+      
+      - name: Type Check
+        run: mypy src/ --ignore-missing-imports
+        continue-on-error: true
+      
+      - name: Test Coverage
+        run: pytest --cov=src --cov-report=xml --cov-fail-under=80
+
+  frontend-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      
+      - name: Install dependencies
+        run: cd frontend && npm ci
+      
+      - name: ESLint
+        run: cd frontend && npx eslint . --max-warnings 0
+      
+      - name: TypeScript Check
+        run: cd frontend && npx tsc --noEmit
+      
+      - name: Test
+        run: cd frontend && npm test -- --coverage
+
+  hidden-bugs-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Check for race conditions
+        run: |
+          echo "Checking for singleton state mutations..."
+          ! grep -rn "self\.[a-z_]* = " --include="*.py" | grep -v "__init__" | grep -q .
+      
+      - name: Check for resource leaks
+        run: |
+          echo "Checking for unclosed connections..."
+          ! grep -rn "\.acquire()" --include="*.py" | grep -v "with" | grep -q .
+      
+      - name: Check for hardcoded secrets
+        run: |
+          echo "Checking for hardcoded credentials..."
+          ! grep -rn "password\s*=\s*['\"]" --include="*.py" | grep -v "environ\|test" | grep -q .
+```
+
+### Pre-commit Hooks
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+      - id: detect-private-key
+
+  - repo: https://github.com/psf/black
+    rev: 24.1.0
+    hooks:
+      - id: black
+
+  - repo: https://github.com/pycqa/flake8
+    rev: 7.0.0
+    hooks:
+      - id: flake8
+
+  - repo: https://github.com/pycqa/bandit
+    rev: 1.7.7
+    hooks:
+      - id: bandit
+        args: ['-ll', '-r', 'src/']
+
+  - repo: local
+    hooks:
+      - id: hidden-bug-check
+        name: Hidden Bug Check
+        entry: bash -c 'grep -rn "self\.[a-z_]* = " --include="*.py" | grep -v "__init__" && exit 1 || exit 0'
+        language: system
+        types: [python]
+```
+
+---
+
+## Quick Command Reference
+
+```bash
+# ==================== Backend ====================
+# Python full scan
+pylint src/ && flake8 src/ && bandit -r src/ && mypy src/
+
+# Go full scan
+golangci-lint run && go vet ./... && go test -race ./...
+
+# Node.js full scan
+npm run lint && npm audit && npm test
+
+# ==================== Frontend ====================
+# React full scan
+npx eslint . && npx tsc --noEmit && npm test -- --coverage
+
+# ==================== Impact Analysis ====================
+# Python dependency graph
+pydeps src/services/chat_service.py -o deps.svg
+
+# JS/TS dependency graph
+madge --image deps.svg src/
+
+# Circular dependency detection
+madge --circular src/
+
+# ==================== Hidden Bugs ====================
+# Data race
+grep -rn "self\.[a-z_]* = " --include="*.py" | grep -v "__init__"
+
+# Resource leak
+grep -rn "\.acquire()" --include="*.py" | grep -v "with"
+
+# Security issue
+grep -rn "password\s*=" --include="*.py" | grep -v "environ"
+```