@usepipr/cli 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/main.mjs
CHANGED
|
@@ -10,7 +10,7 @@ import os from "node:os";
|
|
|
10
10
|
import path from "node:path";
|
|
11
11
|
import { createHash } from "node:crypto";
|
|
12
12
|
//#region package.json
|
|
13
|
-
var version = "0.
|
|
13
|
+
var version = "0.6.0";
|
|
14
14
|
//#endregion
|
|
15
15
|
//#region src/skill-catalog.ts
|
|
16
16
|
const bundledSkillName = "pipr-setup";
|
|
@@ -87,7 +87,7 @@ While customizing:
|
|
|
87
87
|
|
|
88
88
|
- Keep config load synchronous. Runtime work belongs inside `pipr.task(...)`.
|
|
89
89
|
- Use `pipr.secret({ name })`; never write raw secret values.
|
|
90
|
-
- Prefer `pipr.review(...)`
|
|
90
|
+
- Prefer `pipr.review(...)` for the built-in findings-plus-summary flow. Use custom agents and tasks for custom prompts, additional Pi calls, command input, custom schemas, plugin tools, explicit checks, or main-comment-only output.
|
|
91
91
|
- For custom tasks, pass `{ manifest }` to `ctx.pi.run(...)`; do not interpolate the Diff Manifest into prompts yourself.
|
|
92
92
|
- Core already adds bounded change request metadata and schema-aware `suggestedFix` rules to agent prompts. Do not duplicate them in `instructions` or prompt input.
|
|
93
93
|
- Emit exactly one final output from each selected task: `ctx.comment(...)` or `ctx.command.reply(...)`.
|
|
@@ -4,17 +4,17 @@ Use these patterns when customizing `.pipr/config.ts`.
|
|
|
4
4
|
|
|
5
5
|
## CLI commands
|
|
6
6
|
|
|
7
|
-
| Command
|
|
8
|
-
|
|
|
9
|
-
| `pipr init`
|
|
10
|
-
| `pipr init --adapters <list>`
|
|
11
|
-
| `pipr init --minimal`
|
|
12
|
-
| `pipr inspect`
|
|
13
|
-
| `pipr check`
|
|
14
|
-
| `pipr check --require-env`
|
|
15
|
-
| `pipr review --base <ref>`
|
|
16
|
-
| `pipr dry-run --host <host> --event <path>`
|
|
17
|
-
| `pipr webhook serve --host <host> --workspace <path> --repository <id>` | Run trusted webhook ingress for GitLab, Azure DevOps, or Bitbucket.
|
|
7
|
+
| Command | Use |
|
|
8
|
+
| ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
9
|
+
| `pipr init` | Create `.pipr/config.ts`, `.pipr/package.json`, `.pipr/bun.lock`, `.pipr/tsconfig.json`, `.pipr/.gitignore`, and the default GitHub workflow. |
|
|
10
|
+
| `pipr init --adapters <list>` | Generate selected adapter artifacts for `github`, `gitlab`, `azure-devops`, or `bitbucket`; use `none` to skip adapter files. |
|
|
11
|
+
| `pipr init --minimal` | Create only `.pipr/config.ts`; editor types come from a repo-root `@usepipr/sdk` install. |
|
|
12
|
+
| `pipr inspect` | Print models, agents, tasks, commands, tools, publication settings, checks, and limits. |
|
|
13
|
+
| `pipr check` | Type-load config and validate the runtime plan. |
|
|
14
|
+
| `pipr check --require-env` | Also require configured provider env vars. |
|
|
15
|
+
| `pipr review --base <ref>` | Run change-request tasks locally without publishing comments. |
|
|
16
|
+
| `pipr dry-run --host <host> --event <path>` | Load a native provider event and config without model calls or publication. |
|
|
17
|
+
| `pipr webhook serve --host <host> --workspace <path> --repository <id>` | Run trusted webhook ingress for GitLab, Azure DevOps, or Bitbucket. |
|
|
18
18
|
|
|
19
19
|
## Model and review basics
|
|
20
20
|
|
|
@@ -26,7 +26,7 @@ export default definePipr((pipr) => {
|
|
|
26
26
|
provider: "deepseek",
|
|
27
27
|
model: "deepseek-v4-pro",
|
|
28
28
|
apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
|
|
29
|
-
|
|
29
|
+
thinking: "high",
|
|
30
30
|
});
|
|
31
31
|
|
|
32
32
|
pipr.config({ publication: { maxInlineComments: 5 } });
|
|
@@ -34,17 +34,20 @@ export default definePipr((pipr) => {
|
|
|
34
34
|
pipr.review({
|
|
35
35
|
id: "review",
|
|
36
36
|
model,
|
|
37
|
-
instructions:
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
37
|
+
instructions: {
|
|
38
|
+
findings: `
|
|
39
|
+
Review the change request diff for correctness, security,
|
|
40
|
+
maintainability, and test coverage. Return only actionable findings
|
|
41
|
+
that target valid diff ranges.
|
|
42
|
+
`,
|
|
43
|
+
summary: "Summarize changed behavior, risk, and reviewer focus.",
|
|
44
|
+
},
|
|
42
45
|
timeout: "10m",
|
|
43
46
|
});
|
|
44
47
|
});
|
|
45
48
|
```
|
|
46
49
|
|
|
47
|
-
Use `id` on a model only when two
|
|
50
|
+
Use `id` on a model only when two profiles share the same provider and model with different API keys or thinking levels.
|
|
48
51
|
|
|
49
52
|
## Entrypoints
|
|
50
53
|
|
|
@@ -52,7 +55,10 @@ Use `id` on a model only when two model profiles share the same provider and mod
|
|
|
52
55
|
pipr.review({
|
|
53
56
|
id: "review",
|
|
54
57
|
model,
|
|
55
|
-
instructions:
|
|
58
|
+
instructions: {
|
|
59
|
+
findings: "Review only actionable defects.",
|
|
60
|
+
summary: "Summarize changed behavior and risk.",
|
|
61
|
+
},
|
|
56
62
|
entrypoints: {
|
|
57
63
|
changeRequest: ["opened", "updated", "reopened", "ready"],
|
|
58
64
|
command: { pattern: "@pipr review", permission: "write" },
|
|
@@ -86,7 +92,10 @@ Use `paths` to filter the Diff Manifest and publishable Inline Review Comments:
|
|
|
86
92
|
pipr.review({
|
|
87
93
|
id: "runtime-review",
|
|
88
94
|
model,
|
|
89
|
-
instructions:
|
|
95
|
+
instructions: {
|
|
96
|
+
findings: "Review runtime changes only.",
|
|
97
|
+
summary: "Summarize runtime changes and risk.",
|
|
98
|
+
},
|
|
90
99
|
paths: {
|
|
91
100
|
include: ["packages/runtime/**"],
|
|
92
101
|
exclude: ["**/*.test.ts"],
|
|
@@ -118,7 +127,10 @@ const task = pipr.task({
|
|
|
118
127
|
async run(ctx) {
|
|
119
128
|
const manifest = await ctx.change.diffManifest({ compressed: true });
|
|
120
129
|
const result = await ctx.pi.run(security, { manifest });
|
|
121
|
-
await ctx.comment({
|
|
130
|
+
await ctx.comment({
|
|
131
|
+
main: result.summary.body,
|
|
132
|
+
inlineFindings: result.inlineFindings,
|
|
133
|
+
});
|
|
122
134
|
},
|
|
123
135
|
});
|
|
124
136
|
|
|
@@ -145,7 +157,8 @@ pipr.config({
|
|
|
145
157
|
autoResolve: {
|
|
146
158
|
enabled: true,
|
|
147
159
|
model,
|
|
148
|
-
instructions:
|
|
160
|
+
instructions:
|
|
161
|
+
"Resolve only when the changed code addresses the finding directly.",
|
|
149
162
|
synchronize: true,
|
|
150
163
|
userReplies: { enabled: true, allowedActors: "write" },
|
|
151
164
|
},
|
|
@@ -163,7 +176,7 @@ Use required checks only when the user wants merge-gate behavior. Use comments f
|
|
|
163
176
|
Use only secret names in config:
|
|
164
177
|
|
|
165
178
|
```ts
|
|
166
|
-
apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" })
|
|
179
|
+
apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" });
|
|
167
180
|
```
|
|
168
181
|
|
|
169
182
|
Add secret mappings in the selected code host integration. GitHub uses `.github/workflows/pipr.yml`; GitLab uses masked CI/CD variables; Azure DevOps and Bitbucket webhook runners use their trusted secret stores. Never commit raw provider keys, local `.env` values, or personal credentials.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@usepipr/cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"description": "Command-line interface for Pipr code host review automation",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -37,8 +37,8 @@
|
|
|
37
37
|
},
|
|
38
38
|
"dependencies": {
|
|
39
39
|
"@actions/core": "3.0.1",
|
|
40
|
-
"@usepipr/runtime": "0.
|
|
41
|
-
"@usepipr/sdk": "0.
|
|
40
|
+
"@usepipr/runtime": "0.6.0",
|
|
41
|
+
"@usepipr/sdk": "0.6.0",
|
|
42
42
|
"commander": "15.0.0"
|
|
43
43
|
}
|
|
44
44
|
}
|