ira-review 1.0.0 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.github.md +267 -240
  2. package/README.md +108 -12
  3. package/README.npm.md +108 -12
  4. package/dist/cli.js +2 -4
  5. package/dist/index.cjs +1 -3
  6. package/dist/index.cjs.map +1 -1
  7. package/dist/index.js +1 -3
  8. package/dist/index.js.map +1 -1
  9. package/package.json +1 -1
package/README.github.md CHANGED
@@ -1,5 +1,7 @@
1
1
  # IRA - AI-Powered Code Reviews for Pull Requests
2
2
 
3
+ ![IRA Review](docs/images/hero-banner.png)
4
+
3
5
  [![VS Code Marketplace](https://img.shields.io/visual-studio-marketplace/v/ira-review.ira-review-vscode?label=VS%20Code%20Marketplace&color=blue)](https://marketplace.visualstudio.com/items?itemName=ira-review.ira-review-vscode)
4
6
  [![npm](https://img.shields.io/npm/v/ira-review?color=red)](https://www.npmjs.com/package/ira-review)
5
7
 
@@ -7,16 +9,34 @@ IRA (Intelligent Review Assistant) reviews your pull requests using AI. It posts
7
9
 
8
10
  **Works with any language.** Supports GitHub, GitHub Enterprise, Bitbucket Cloud, and Bitbucket Server/Data Center.
9
11
 
10
- > 🆕 **Now available as a [VS Code Extension](#vs-code-extension)** - get AI code reviews right inside your editor using GitHub Copilot.
12
+ **Free for core features.** Review PRs, score risk, validate JIRA acceptance criteria, and generate tests. [Pro features](#vs-code-pro-features) available for $10/mo.
13
+
14
+ > 🧩 **[VS Code Extension](https://marketplace.visualstudio.com/items?itemName=ira-review.ira-review-vscode)** - AI reviews inside your editor with zero-config Copilot support
15
+ >
16
+ > 📦 **[npm package](https://www.npmjs.com/package/ira-review)** - CLI and CI integration
17
+
18
+ ## 🔒 Security First - No Secret Ever Touches Disk in Plaintext
11
19
 
12
- ## What's New in v1.0.0
20
+ This is a core design principle, not an afterthought. Every token is encrypted at rest using OS-native credential storage.
21
+
22
+ | Where | How secrets are stored | Details |
23
+ |---|---|---|
24
+ | **VS Code Extension** | OS keychain (macOS Keychain, Windows Credential Manager, Linux libsecret) | GitHub uses VS Code OAuth. Bitbucket, Sonar, JIRA, and AI keys use SecretStorage |
25
+ | **CLI** | Environment variables | Read from `IRA_*` env vars at runtime. Never written to disk |
26
+ | **CI Pipelines** | Your CI secrets manager | GitHub Actions secrets, Jenkins credentials, HashiCorp Vault, Azure Key Vault, etc. |
13
27
 
14
- - **⚠️ Breaking:** Rule prefixes renamed from `ai/` → `IRA/` (e.g. `IRA/security`, `IRA/best-practice`)
15
- - **Risk scoring v2** — BLOCKER issues now set a minimum HIGH severity floor; CRITICAL issues set minimum MEDIUM
16
- - **VS Code Extension** — full-featured editor integration with Pro tier (auto-review, apply fix, trends dashboard)
17
- - **Notifications** — Slack & Teams now available in both CLI and VS Code extension
18
- - **Bug fix** — Security issues are now correctly detected and classified (stale prefix was preventing detection)
19
- - **License** — switched to proprietary license
28
+ **What this means for your team:**
29
+ - GitHub users authenticate with one click via VS Code OAuth. No tokens to copy or paste
30
+ - Bitbucket users enter their token once in a masked prompt. It goes straight to the OS keychain
31
+ - Copilot users need zero configuration. It uses the existing VS Code GitHub session
32
+ - `IRA: Sign Out` wipes all secrets from the keychain in one command
33
+ - Token refresh is automatic. IRA detects VS Code session changes and invalidates stale tokens
34
+ - No cloud service, no telemetry, no analytics. Code and tokens never leave your infrastructure
35
+ - Config files (`.irarc.json`) block token fields by design
36
+
37
+ > **For your security team:** IRA is not a SaaS. It runs entirely on developer machines and CI runners. Tokens are used only to call APIs you already trust (GitHub, Bitbucket, SonarQube, JIRA, OpenAI). The authentication module is a single auditable file with full test coverage.
38
+
39
+ ---
20
40
 
21
41
  ## What can IRA do?
22
42
 
@@ -27,93 +47,76 @@ IRA (Intelligent Review Assistant) reviews your pull requests using AI. It posts
27
47
  - **Enrich SonarQube issues** with AI-powered explanations when Sonar is connected
28
48
  - **Notify your team** via Slack or Microsoft Teams after each review
29
49
 
30
- ## Try it in 30 seconds
50
+ ---
31
51
 
32
- ```bash
33
- npx ira-review review \
34
- --pr 42 \
35
- --scm-provider github \
36
- --github-token 'ghp_xxxxx' \
37
- --github-repo owner/repo \
38
- --ai-api-key 'sk-xxxxx' \
39
- --dry-run
40
- ```
52
+ ## Setup Guides
41
53
 
42
- This prints the review in your terminal. Drop `--dry-run` to post it on the PR.
54
+ ### VS Code Extension with GitHub
43
55
 
44
- ## Install
56
+ ![IRA Sign In via Command Palette](docs/images/vscode-sign-in.png)
45
57
 
46
- ```bash
47
- npx ira-review review --help # no install needed
48
- npm install -g ira-review # or install globally
49
- npm install --save-dev ira-review # or add to your project
50
- ```
58
+ 1. Install the extension: search **"IRA - AI Code Reviews"** in the Extensions panel, or run:
59
+ ```bash
60
+ code --install-extension ira-review.ira-review-vscode
61
+ ```
62
+ 2. Open a project with a GitHub remote
63
+ 3. Run `IRA: Sign In` from the Command Palette (`Cmd+Shift+P` / `Ctrl+Shift+P`)
64
+ 4. Click "Sign in with GitHub" in the popup. VS Code handles the OAuth flow
65
+ 5. Run `IRA: Review Current PR` and enter your PR number
51
66
 
52
- ## How to use IRA
67
+ ![IRA inline diagnostics and TreeView](docs/images/vscode-review-diagnostics.png)
53
68
 
54
- Pick the combination that fits your workflow. Each example builds on the previous one.
69
+ That's it. Copilot is the default AI provider, so no API key is needed.
55
70
 
56
- ### 1. AI-only review
71
+ **Optional - switch AI provider:**
72
+ - Open Settings > Extensions > IRA
73
+ - Change `ira.aiProvider` to `openai`, `anthropic`, or `ollama`
74
+ - Run `IRA: Sign In` again to store your AI API key securely
57
75
 
58
- The simplest setup. IRA reads your PR diff and finds bugs, security issues, and performance problems.
76
+ **Optional - connect SonarQube:**
77
+ - Set `ira.sonarUrl` to your SonarQube server URL
78
+ - The Sonar token is stored securely in the OS keychain via `IRA: Sign In`
79
+ - Set `ira.sonarProjectKey` in settings
59
80
 
60
- **GitHub:**
61
- ```bash
62
- npx ira-review review \
63
- --pr 42 \
64
- --scm-provider github \
65
- --github-token 'ghp_xxxxx' \
66
- --github-repo owner/repo \
67
- --ai-api-key 'sk-xxxxx'
68
- ```
81
+ **Optional - connect JIRA:**
82
+ - Set `ira.jiraUrl` and `ira.jiraEmail` in settings
83
+ - The JIRA token is stored securely in the OS keychain via `IRA: Sign In`
69
84
 
70
- **Bitbucket Cloud:**
71
- ```bash
72
- npx ira-review review \
73
- --pr 42 \
74
- --bitbucket-token 'bb_xxxxx' \
75
- --repo my-workspace/my-repo \
76
- --ai-api-key 'sk-xxxxx'
77
- ```
85
+ ### VS Code Extension with Bitbucket
86
+
87
+ 1. Install the extension (same as above)
88
+ 2. Open a project with a Bitbucket remote
89
+ 3. Run `IRA: Review Current PR` from the Command Palette
90
+ 4. IRA auto-detects Bitbucket from your git remote URL
91
+ 5. A masked input box appears: paste your Bitbucket access token (read-only scope recommended)
92
+ 6. The token is stored in the OS keychain. You will not be asked again
93
+
94
+ ![Bitbucket token stored securely](docs/images/vscode-bitbucket-token.png)
78
95
 
79
- ### 2. Review with JIRA (requirement tracking + AC validation)
96
+ **For Bitbucket Server / Data Center:**
97
+ - Set `ira.bitbucketUrl` to your server URL (e.g. `https://bitbucket.yourcompany.com`)
80
98
 
81
- Connect a JIRA ticket and IRA will tell you how much of the acceptance criteria is actually implemented, with per-criterion pass/fail and edge case warnings.
99
+ ### CLI with GitHub
100
+
101
+ ![IRA CLI review output](docs/images/cli-review-output.png)
82
102
 
83
103
  ```bash
104
+ # Install (optional - you can use npx directly)
105
+ npm install -g ira-review
106
+
107
+ # Run a review
84
108
  npx ira-review review \
85
109
  --pr 42 \
86
110
  --scm-provider github \
87
111
  --github-token 'ghp_xxxxx' \
88
112
  --github-repo owner/repo \
89
113
  --ai-api-key 'sk-xxxxx' \
90
- --jira-url https://yourcompany.atlassian.net \
91
- --jira-email you@company.com \
92
- --jira-token 'jira_xxxxx' \
93
- --jira-ticket AUTH-234
94
- ```
95
-
96
- Example output posted on your PR:
97
-
98
- ```
99
- 📊 Requirements: AUTH-234 - 67% Complete (4/6 AC met)
100
-
101
- ✅ OAuth2 login flow implemented with Google provider
102
- ✅ JWT tokens generated on successful authentication
103
- ✅ Refresh token rotation with 7-day expiry
104
- ❌ Input validation on login endpoint - no email format check
105
- ✅ Logout endpoint clears session and revokes token
106
- ❌ Rate limiting on login attempts - not implemented
107
-
108
- ⚠️ Edge Cases Not Covered:
109
- - What happens when Google OAuth is unreachable?
110
- - Token refresh during concurrent requests?
114
+ --dry-run
111
115
  ```
112
116
 
113
- ### 3. Review with JIRA + test generation
114
-
115
- Add `--generate-tests` to any review command and IRA will generate test scaffolding alongside the code review.
117
+ Drop `--dry-run` to post comments directly on the PR.
116
118
 
119
+ **Add JIRA validation:**
117
120
  ```bash
118
121
  npx ira-review review \
119
122
  --pr 42 \
@@ -124,33 +127,10 @@ npx ira-review review \
124
127
  --jira-url https://yourcompany.atlassian.net \
125
128
  --jira-email you@company.com \
126
129
  --jira-token 'jira_xxxxx' \
127
- --jira-ticket AUTH-234 \
128
- --generate-tests \
129
- --test-framework vitest
130
+ --jira-ticket AUTH-234
130
131
  ```
131
132
 
132
- ### 4. Standalone test generation (no review)
133
-
134
- Don't need a review? Generate test cases directly from a JIRA ticket.
135
-
136
- ```bash
137
- npx ira-review generate-tests \
138
- --jira-ticket AUTH-234 \
139
- --jira-url https://yourcompany.atlassian.net \
140
- --jira-email you@company.com \
141
- --jira-token 'jira_xxxxx' \
142
- --ai-api-key 'sk-xxxxx' \
143
- --test-framework playwright
144
- ```
145
-
146
- Add `--pr 42 --scm-provider github --github-repo owner/repo` to include code context from a PR for higher precision.
147
-
148
- Add `--output tests/auth.test.ts` to save the generated tests to a file.
149
-
150
- ### 5. Sonar + AI review
151
-
152
- Already using SonarQube? IRA pulls your Sonar issues and enriches each one with AI explanations and suggested fixes.
153
-
133
+ **Add SonarQube:**
154
134
  ```bash
155
135
  npx ira-review review \
156
136
  --pr 42 \
@@ -163,55 +143,28 @@ npx ira-review review \
163
143
  --project-key my-org_my-project
164
144
  ```
165
145
 
166
- You can combine this with JIRA, test generation, and notifications too.
167
-
168
- ## Quick reference
169
-
170
- | What you want | What to add | Example |
171
- |---|---|---|
172
- | AI-only review | `--pr`, SCM token, `--ai-api-key` | `npx ira-review review --pr 42 --scm-provider github --github-token ghp_xxx --github-repo owner/repo --ai-api-key sk-xxx` |
173
- | + SonarQube | `--sonar-url`, `--sonar-token`, `--project-key` | `... --sonar-url https://sonarcloud.io --sonar-token sqa_xxx --project-key my-org_my-project` |
174
- | + JIRA validation | `--jira-url`, `--jira-email`, `--jira-token`, `--jira-ticket` | `... --jira-url https://acme.atlassian.net --jira-email dev@acme.com --jira-token xxx --jira-ticket AUTH-234` |
175
- | + Test generation | `--generate-tests`, `--test-framework` | `... --generate-tests --test-framework vitest` |
176
- | + Slack notifications | `--slack-webhook` | `... --slack-webhook https://hooks.slack.com/services/xxx` |
177
- | + Teams notifications | `--teams-webhook` | `... --teams-webhook https://outlook.office.com/webhook/xxx` |
178
- | Notify only high risk | `--notify-min-risk` | `... --slack-webhook https://hooks.slack.com/xxx --notify-min-risk high` (only HIGH and CRITICAL trigger a notification) |
179
- | Notify on AC failure | `--notify-on-ac-fail` | `... --slack-webhook https://hooks.slack.com/xxx --notify-on-ac-fail` (notify when JIRA acceptance criteria fail, regardless of risk) |
180
- | Risk labels | Automatic on GitHub | Labels like `ira:critical`, `ira:high`, `ira:medium`, `ira:low` are applied automatically |
181
- | Preview in terminal | `--dry-run` | `... --dry-run` (prints output, doesn't post on PR) |
182
- | Use Anthropic | `--ai-provider anthropic` | `... --ai-provider anthropic --ai-api-key sk-ant-xxx` |
183
- | Use Ollama (free) | `--ai-provider ollama` | `... --ai-provider ollama` (no API key needed) |
184
- | Save on AI costs | `--ai-model` + `--ai-model-critical` | `... --ai-model gpt-4o-mini --ai-model-critical gpt-4o` |
185
- | Generate tests only | `generate-tests` command | `npx ira-review generate-tests --jira-ticket AUTH-234 --test-framework jest --ai-api-key sk-xxx` |
186
- | Save tests to file | `--output` | `... generate-tests --jira-ticket AUTH-234 --test-framework vitest --output tests/auth.test.ts` |
187
-
188
- ## Supported test frameworks
189
-
190
- | Framework | Language | Style |
191
- |---|---|---|
192
- | `jest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
193
- | `vitest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
194
- | `mocha` | JavaScript/TypeScript | `describe` / `it` + Chai |
195
- | `playwright` | TypeScript | `test` / `page` / E2E |
196
- | `cypress` | JavaScript | `cy.visit` / `cy.get` / E2E |
197
- | `gherkin` | Any (BDD) | `Given` / `When` / `Then` |
198
- | `pytest` | Python | `def test_` / `assert` |
199
- | `junit` | Java/Kotlin | `@Test` / `assertEquals` |
200
-
201
- ## AI providers
202
-
203
- | Provider | Flag | Notes |
204
- |---|---|---|
205
- | **OpenAI** (default) | `--ai-provider openai` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
206
- | **Azure OpenAI** | `--ai-provider azure-openai` | Also needs `--ai-base-url` and `--ai-deployment` |
207
- | **Anthropic** | `--ai-provider anthropic` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
208
- | **Ollama** (local) | `--ai-provider ollama` | Runs locally, no API key needed |
146
+ ### CLI with Bitbucket
209
147
 
210
- > **Tip:** Use `--ai-model gpt-4o-mini` for most issues and `--ai-model-critical gpt-4o` for blockers. This keeps costs low without sacrificing quality on critical findings.
148
+ ```bash
149
+ npx ira-review review \
150
+ --pr 42 \
151
+ --bitbucket-token 'bb_xxxxx' \
152
+ --repo my-workspace/my-repo \
153
+ --ai-api-key 'sk-xxxxx' \
154
+ --dry-run
155
+ ```
211
156
 
212
- ## CI/CD setup
157
+ **For Bitbucket Server / Data Center:**
158
+ ```bash
159
+ npx ira-review review \
160
+ --pr 42 \
161
+ --bitbucket-token 'bb_xxxxx' \
162
+ --repo my-workspace/my-repo \
163
+ --bitbucket-url https://bitbucket.yourcompany.com \
164
+ --ai-api-key 'sk-xxxxx'
165
+ ```
213
166
 
214
- ### GitHub Actions
167
+ ### CI with GitHub Actions
215
168
 
216
169
  ```yaml
217
170
  name: AI Code Review
@@ -237,17 +190,47 @@ jobs:
237
190
  IRA_AI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
238
191
  ```
239
192
 
240
- Want JIRA validation in CI? Add these flags to the run command:
241
-
242
- ```
243
- --jira-url ${{ vars.JIRA_URL }} \
244
- --jira-email ${{ vars.JIRA_EMAIL }} \
245
- --jira-token ${{ secrets.JIRA_TOKEN }} \
246
- --jira-ticket AUTH-234
193
+ **Add JIRA + Sonar in CI:**
194
+ ```yaml
195
+ - run: |
196
+ npx ira-review review \
197
+ --pr ${{ github.event.pull_request.number }} \
198
+ --scm-provider github \
199
+ --github-token ${{ secrets.GITHUB_TOKEN }} \
200
+ --github-repo ${{ github.repository }} \
201
+ --sonar-url ${{ vars.SONAR_URL }} \
202
+ --sonar-token ${{ secrets.SONAR_TOKEN }} \
203
+ --project-key ${{ vars.SONAR_PROJECT_KEY }} \
204
+ --jira-url ${{ vars.JIRA_URL }} \
205
+ --jira-email ${{ vars.JIRA_EMAIL }} \
206
+ --jira-token ${{ secrets.JIRA_TOKEN }} \
207
+ --jira-ticket AUTH-234 \
208
+ --no-config-file
209
+ env:
210
+ IRA_AI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
247
211
  ```
248
212
 
249
- ### Bitbucket Pipelines
213
+ All tokens come from GitHub Actions secrets. Nothing is hardcoded.
250
214
 
215
+ ### CI with Bitbucket Pipelines
216
+
217
+ ```yaml
218
+ pipelines:
219
+ pull-requests:
220
+ '**':
221
+ - step:
222
+ name: AI Code Review
223
+ script:
224
+ - npx ira-review review
225
+ --pr $BITBUCKET_PR_ID
226
+ --repo $BITBUCKET_REPO_FULL_NAME
227
+ --no-config-file
228
+ environment:
229
+ IRA_AI_API_KEY: $OPENAI_API_KEY
230
+ IRA_BITBUCKET_TOKEN: $BB_TOKEN
231
+ ```
232
+
233
+ **With Bitbucket Server + JIRA + Sonar:**
251
234
  ```yaml
252
235
  pipelines:
253
236
  pull-requests:
@@ -258,6 +241,14 @@ pipelines:
258
241
  - npx ira-review review
259
242
  --pr $BITBUCKET_PR_ID
260
243
  --repo $BITBUCKET_REPO_FULL_NAME
244
+ --bitbucket-url $BITBUCKET_SERVER_URL
245
+ --sonar-url $SONAR_URL
246
+ --sonar-token $SONAR_TOKEN
247
+ --project-key $SONAR_PROJECT_KEY
248
+ --jira-url $JIRA_URL
249
+ --jira-email $JIRA_EMAIL
250
+ --jira-token $JIRA_TOKEN
251
+ --jira-ticket AUTH-234
261
252
  --no-config-file
262
253
  environment:
263
254
  IRA_AI_API_KEY: $OPENAI_API_KEY
@@ -266,45 +257,142 @@ pipelines:
266
257
 
267
258
  > Use `--no-config-file` in CI pipelines that run on untrusted PRs (forks, external contributors).
268
259
 
269
- ## Smart notifications
260
+ ---
270
261
 
271
- By default, IRA sends a Slack or Teams notification after every review. You can control exactly when notifications fire so your team only hears about what matters.
262
+ ## What's New in v1.1.0
272
263
 
273
- ### How it works
264
+ - **🔒 Zero Plaintext Secrets** - all tokens (GitHub, Bitbucket, Sonar, JIRA, AI API keys) now use OS-native keychain storage via VS Code SecretStorage. Nothing is stored in `settings.json` anymore
265
+ - **OAuth Authentication** - sign in with GitHub via VS Code's built-in OAuth flow. No more copying Personal Access Tokens
266
+ - **GitHub Enterprise OAuth** - full support for GHE instances via the `github-enterprise` authentication provider
267
+ - **Bitbucket Secure Token Storage** - Bitbucket tokens stored in OS keychain instead of plain-text settings
268
+ - **Token Refresh Awareness** - automatic cache invalidation when VS Code detects session changes (token refresh, sign-out)
269
+ - **Centralized Auth** - unified authentication service with per-provider session caching for consistent, secure auth across all commands
270
+ - **Sign In / Sign Out Commands** - dedicated `IRA: Sign In` and `IRA: Sign Out` commands for managing authentication
271
+ - **PAT Fallback** - existing Personal Access Token workflows continue to work. OAuth is additive, not a breaking change
274
272
 
275
- | Setup | What happens | Best for |
273
+ ### Authentication: OAuth vs Personal Access Token (PAT)
274
+
275
+ | | OAuth (new in v1.1.0) | Personal Access Token (PAT) |
276
276
  |---|---|---|
277
- | No flags set | Every review triggers a notification | Small teams that want full visibility |
278
- | `--notify-min-risk high` | Only HIGH (40+) and CRITICAL (60+) PRs trigger notifications. LOW and MEDIUM stay silent | Reducing noise, focusing on risky PRs |
279
- | `--notify-min-risk high --notify-on-ac-fail` | Notifies on HIGH/CRITICAL risk **or** when JIRA acceptance criteria fail, even on low risk PRs | **Recommended for tech leads.** Catches both risky code and incomplete requirements |
280
- | `--notify-on-ac-fail` alone | Every review still triggers a notification (no risk filter), but AC failures are guaranteed to notify | Teams that want full visibility but never want to miss an AC failure |
277
+ | **Setup** | One-click sign-in via VS Code | Manually generate token on GitHub/Bitbucket, paste into settings |
278
+ | **Security** | Token managed by VS Code, stored in OS keychain | Token stored in VS Code settings (plain text in `settings.json`) |
279
+ | **Scopes** | Requests `repo` scope automatically | You choose scopes manually when creating the token |
280
+ | **Token Rotation** | Handled automatically by VS Code | Manual - you must regenerate expired tokens |
281
+ | **GitHub Enterprise** | ✅ Supported (org admin may need to approve the VS Code OAuth app) | ✅ Supported |
282
+ | **Bitbucket** | Token stored securely via SecretStorage | Token stored in settings |
283
+ | **Multi-account** | Managed by VS Code account system | One token per settings entry |
284
+ | **Offline / CI** | Not applicable (VS Code only) | ✅ Works in CI/CD and headless environments |
281
285
 
282
- ### Example: only ping on high risk PRs
286
+ > **GHE Note:** If your organization uses GitHub Enterprise, an org admin may need to approve the VS Code GitHub authentication app before OAuth will work. Users can still fall back to PATs in the meantime.
287
+
288
+ <details>
289
+ <summary>Previous releases</summary>
290
+
291
+ #### v1.0.0
292
+
293
+ - **⚠️ Breaking:** Rule prefixes renamed from `ai/` to `IRA/` (e.g. `IRA/security`, `IRA/best-practice`)
294
+ - **Risk scoring v2** - BLOCKER issues now set a minimum HIGH severity floor; CRITICAL issues set minimum MEDIUM
295
+ - **VS Code Extension** - full-featured editor integration with Pro tier (auto-review, apply fix, trends dashboard)
296
+ - **Notifications** - Slack and Teams now available in both CLI and VS Code extension
297
+ - **Bug fix** - Security issues are now correctly detected and classified (stale prefix was preventing detection)
298
+ - **License** - switched to proprietary license
299
+
300
+ </details>
301
+
302
+ ## Example output
303
+
304
+ ![IRA JIRA validation and risk scoring in VS Code](docs/images/vscode-jira-ac.png)
305
+
306
+ **JIRA requirement tracking posted on your PR:**
283
307
 
284
- ```bash
285
- npx ira-review review \
286
- --pr 42 \
287
- --scm-provider github \
288
- --github-token 'ghp_xxxxx' \
289
- --github-repo owner/repo \
290
- --ai-api-key 'sk-xxxxx' \
291
- --slack-webhook 'https://hooks.slack.com/services/xxx' \
292
- --notify-min-risk high
293
308
  ```
309
+ 📊 Requirements: AUTH-234 - 67% Complete (4/6 AC met)
294
310
 
295
- Your `#code-reviews` channel only gets pinged for HIGH and CRITICAL PRs. Everything else reviews silently.
311
+ ✅ OAuth2 login flow implemented with Google provider
312
+ ✅ JWT tokens generated on successful authentication
313
+ ✅ Refresh token rotation with 7-day expiry
314
+ ❌ Input validation on login endpoint - no email format check
315
+ ✅ Logout endpoint clears session and revokes token
316
+ ❌ Rate limiting on login attempts - not implemented
296
317
 
297
- ### Example: catch risky PRs and incomplete requirements
318
+ ⚠️ Edge Cases Not Covered:
319
+ - What happens when Google OAuth is unreachable?
320
+ - Token refresh during concurrent requests?
321
+ ```
322
+
323
+ **Inline comments on the exact lines:**
298
324
 
299
- ```bash
300
- --notify-min-risk high --notify-on-ac-fail
301
325
  ```
326
+ 🔍 IRA Review - IRA/security (CRITICAL)
302
327
 
303
- Tech leads get notified for two things: risky PRs and PRs that don't fully implement the JIRA requirements. Low risk, well-implemented PRs stay quiet.
328
+ > User input used directly in SQL query without sanitization.
304
329
 
305
- ### What triggers a notification?
330
+ Explanation: The username parameter is concatenated into a SQL string,
331
+ creating a SQL injection vector.
306
332
 
307
- Here's exactly when your Slack or Teams channel gets a message:
333
+ Impact: Attacker could execute arbitrary SQL and gain database control.
334
+
335
+ Suggested Fix: Use parameterized queries:
336
+ db.query('SELECT * FROM users WHERE name = $1', [username])
337
+ ```
338
+
339
+ ## Quick reference
340
+
341
+ | What you want | What to add | Example |
342
+ |---|---|---|
343
+ | AI-only review | `--pr`, SCM token, `--ai-api-key` | `npx ira-review review --pr 42 --scm-provider github --github-token ghp_xxx --github-repo owner/repo --ai-api-key sk-xxx` |
344
+ | + SonarQube | `--sonar-url`, `--sonar-token`, `--project-key` | `... --sonar-url https://sonarcloud.io --sonar-token sqa_xxx --project-key my-org_my-project` |
345
+ | + JIRA validation | `--jira-url`, `--jira-email`, `--jira-token`, `--jira-ticket` | `... --jira-url https://acme.atlassian.net --jira-email dev@acme.com --jira-token xxx --jira-ticket AUTH-234` |
346
+ | + Test generation | `--generate-tests`, `--test-framework` | `... --generate-tests --test-framework vitest` |
347
+ | + Slack notifications | `--slack-webhook` | `... --slack-webhook https://hooks.slack.com/services/xxx` |
348
+ | + Teams notifications | `--teams-webhook` | `... --teams-webhook https://outlook.office.com/webhook/xxx` |
349
+ | Notify only high risk | `--notify-min-risk` | `... --notify-min-risk high` |
350
+ | Notify on AC failure | `--notify-on-ac-fail` | `... --notify-on-ac-fail` |
351
+ | Risk labels | Automatic on GitHub | Labels like `ira:critical`, `ira:high`, `ira:medium`, `ira:low` |
352
+ | Preview in terminal | `--dry-run` | `... --dry-run` |
353
+ | Use Anthropic | `--ai-provider anthropic` | `... --ai-provider anthropic --ai-api-key sk-ant-xxx` |
354
+ | Use Ollama (free) | `--ai-provider ollama` | `... --ai-provider ollama` (no API key needed) |
355
+ | Save on AI costs | `--ai-model` + `--ai-model-critical` | `... --ai-model gpt-4o-mini --ai-model-critical gpt-4o` |
356
+ | Generate tests only | `generate-tests` command | `npx ira-review generate-tests --jira-ticket AUTH-234 --test-framework jest --ai-api-key sk-xxx` |
357
+ | Save tests to file | `--output` | `... --output tests/auth.test.ts` |
358
+
359
+ ## Supported test frameworks
360
+
361
+ | Framework | Language | Style |
362
+ |---|---|---|
363
+ | `jest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
364
+ | `vitest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
365
+ | `mocha` | JavaScript/TypeScript | `describe` / `it` + Chai |
366
+ | `playwright` | TypeScript | `test` / `page` / E2E |
367
+ | `cypress` | JavaScript | `cy.visit` / `cy.get` / E2E |
368
+ | `gherkin` | Any (BDD) | `Given` / `When` / `Then` |
369
+ | `pytest` | Python | `def test_` / `assert` |
370
+ | `junit` | Java/Kotlin | `@Test` / `assertEquals` |
371
+
372
+ ## AI providers
373
+
374
+ | Provider | Flag | Notes |
375
+ |---|---|---|
376
+ | **OpenAI** (default for CLI) | `--ai-provider openai` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
377
+ | **GitHub Copilot** (default for VS Code) | `ira.aiProvider: copilot` | Zero config. Uses existing VS Code auth |
378
+ | **Azure OpenAI** | `--ai-provider azure-openai` | Also needs `--ai-base-url` and `--ai-deployment` |
379
+ | **Anthropic** | `--ai-provider anthropic` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
380
+ | **Ollama** (local) | `--ai-provider ollama` | Runs locally, no API key needed |
381
+
382
+ > **Tip:** Use `--ai-model gpt-4o-mini` for most issues and `--ai-model-critical gpt-4o` for blockers. This keeps costs low without sacrificing quality on critical findings.
383
+
384
+ ## Smart notifications
385
+
386
+ By default, IRA sends a Slack or Teams notification after every review. You can control exactly when notifications fire so your team only hears about what matters.
387
+
388
+ | Setup | What happens | Best for |
389
+ |---|---|---|
390
+ | No flags set | Every review triggers a notification | Small teams that want full visibility |
391
+ | `--notify-min-risk high` | Only HIGH and CRITICAL PRs trigger notifications | Reducing noise |
392
+ | `--notify-min-risk high --notify-on-ac-fail` | Notifies on HIGH/CRITICAL risk or when JIRA AC fail | Recommended for tech leads |
393
+ | `--notify-on-ac-fail` alone | Every review notifies, AC failures guaranteed | Never miss an AC failure |
394
+
395
+ ### What triggers a notification?
308
396
 
309
397
  | PR risk | AC status | No flags | `--notify-min-risk high` | `+ --notify-on-ac-fail` |
310
398
  |---|---|---|---|---|
@@ -349,7 +437,7 @@ Labels update automatically when risk changes. Filter your PR list with `label:i
349
437
 
350
438
  ### Bitbucket: build status
351
439
 
352
- Bitbucket doesn't support PR labels, so IRA posts a **build status** on the PR commit instead. This shows as a status icon (✅ ❌ 🟡) in the PR list.
440
+ Bitbucket does not support PR labels, so IRA posts a **build status** on the PR commit instead. This shows as a status icon in the PR list.
353
441
 
354
442
  | Risk level | Build status | Icon in PR list |
355
443
  |---|---|---|
@@ -358,27 +446,7 @@ Bitbucket doesn't support PR labels, so IRA posts a **build status** on the PR c
358
446
  | MEDIUM | INPROGRESS | 🟡 Yellow dot |
359
447
  | LOW | SUCCESSFUL | 🟢 Green check |
360
448
 
361
- Hover over the icon to see the full risk score. You can also configure Bitbucket branch permissions to **block merging** when the IRA Risk status is FAILED, preventing high-risk PRs from being merged without review.
362
-
363
- ## What IRA posts on your PR
364
-
365
- **Inline comments** on the exact lines:
366
-
367
- ```
368
- 🔍 IRA Review — IRA/security (CRITICAL)
369
-
370
- > User input used directly in SQL query without sanitization.
371
-
372
- Explanation: The username parameter is concatenated into a SQL string,
373
- creating a SQL injection vector.
374
-
375
- Impact: Attacker could execute arbitrary SQL and gain database control.
376
-
377
- Suggested Fix: Use parameterized queries:
378
- db.query('SELECT * FROM users WHERE name = $1', [username])
379
- ```
380
-
381
- **Summary comment** with risk score, issue breakdown, requirement completion (if JIRA is connected), and complexity hotspots (if Sonar is connected).
449
+ Hover over the icon to see the full risk score. You can also configure Bitbucket branch permissions to **block merging** when the IRA Risk status is FAILED.
382
450
 
383
451
  ## Config file
384
452
 
@@ -395,51 +463,10 @@ Create `.irarc.json` in your project root to set defaults:
395
463
 
396
464
  CLI flags override env vars, which override the config file. Tokens and keys are blocked from config files for security.
397
465
 
398
- ## VS Code Extension
399
-
400
- Use IRA directly inside your editor. No terminal needed.
401
-
402
- ### Install
403
-
404
- Search **"IRA - AI Code Reviews"** in the VS Code Extensions panel, or:
405
-
406
- ```bash
407
- code --install-extension ira-review.ira-review-vscode
408
- ```
409
-
410
- ### Features
411
-
412
- - **Zero config** - uses your existing GitHub Copilot subscription (or bring OpenAI, Anthropic, Ollama)
413
- - **Diagnostics** - issues show up as squiggly lines with severity levels
414
- - **CodeLens** - inline annotations on affected lines
415
- - **TreeView** - sidebar panel with all issues grouped by file
416
- - **Risk Score** - status bar badge showing LOW / MEDIUM / HIGH / CRITICAL
417
- - **Multi-SCM** - GitHub, GitHub Enterprise, Bitbucket Cloud, Bitbucket Server/Data Center
418
- - **Auto-review on Save** ⭐ Pro - automatically reviews files when you save
419
- - **Apply Fix** ⭐ Pro - one-click AI-generated fix via CodeLens
420
- - **Review History** ⭐ Pro - browse past reviews in a sidebar tree
421
- - **Trends Dashboard** ⭐ Pro - visualize issues over time
422
- - **Generate PR Description** - AI-powered PR descriptions with JIRA ticket detection
423
- - **Slack & Teams Notifications** - get notified after reviews
424
-
425
- ### Quick Start
426
-
427
- 1. Open a project with a git remote
428
- 2. Run `IRA: Review Current PR` from the Command Palette (`Cmd+Shift+P`)
429
- 3. Enter the PR number. IRA reviews every changed file and shows results inline
430
-
431
- 📖 **Full extension docs:** [`packages/vscode/README.md`](packages/vscode/README.md)
432
-
433
- ## Security
434
-
435
- - Runs in your CI. Tokens never leave your infrastructure
436
- - No telemetry, analytics, or tracking
437
- - Config files block sensitive fields automatically
438
-
439
466
  ## Requirements
440
467
 
441
468
  - Node.js 18+
442
- - An AI provider API key (or Ollama running locally)
469
+ - An AI provider API key (or Ollama running locally, or GitHub Copilot for the VS Code extension)
443
470
  - A GitHub or Bitbucket repo with an open PR
444
471
 
445
472
  ## License