ira-review 1.0.1 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.github.md +267 -240
  2. package/README.md +108 -12
  3. package/README.npm.md +108 -12
  4. package/dist/cli.js +1 -3
  5. package/dist/index.cjs +1 -3
  6. package/dist/index.cjs.map +1 -1
  7. package/dist/index.js +1 -3
  8. package/dist/index.js.map +1 -1
  9. package/package.json +1 -1
package/README.github.md CHANGED
@@ -1,5 +1,7 @@
1
1
  # IRA - AI-Powered Code Reviews for Pull Requests
2
2
 
3
+ ![IRA Review](docs/images/hero-banner.png)
4
+
3
5
  [![VS Code Marketplace](https://img.shields.io/visual-studio-marketplace/v/ira-review.ira-review-vscode?label=VS%20Code%20Marketplace&color=blue)](https://marketplace.visualstudio.com/items?itemName=ira-review.ira-review-vscode)
4
6
  [![npm](https://img.shields.io/npm/v/ira-review?color=red)](https://www.npmjs.com/package/ira-review)
5
7
 
@@ -7,14 +9,34 @@ IRA (Intelligent Review Assistant) reviews your pull requests using AI. It posts
7
9
 
8
10
  **Works with any language.** Supports GitHub, GitHub Enterprise, Bitbucket Cloud, and Bitbucket Server/Data Center.
9
11
 
10
- > 🆕 **Now available as a [VS Code Extension](#vs-code-extension)** - get AI code reviews right inside your editor using GitHub Copilot.
12
+ **Free for core features.** Review PRs, score risk, validate JIRA acceptance criteria, and generate tests. [Pro features](#vs-code-pro-features) available for $10/mo.
13
+
14
+ > 🧩 **[VS Code Extension](https://marketplace.visualstudio.com/items?itemName=ira-review.ira-review-vscode)** - AI reviews inside your editor with zero-config Copilot support
15
+ >
16
+ > 📦 **[npm package](https://www.npmjs.com/package/ira-review)** - CLI and CI integration
17
+
18
+ ## 🔒 Security First - No Secret Ever Touches Disk in Plaintext
11
19
 
12
- ## What's New in v1.0.1
20
+ This is a core design principle, not an afterthought. Every token is encrypted at rest using OS-native credential storage.
21
+
22
+ | Where | How secrets are stored | Details |
23
+ |---|---|---|
24
+ | **VS Code Extension** | OS keychain (macOS Keychain, Windows Credential Manager, Linux libsecret) | GitHub uses VS Code OAuth. Bitbucket, Sonar, JIRA, and AI keys use SecretStorage |
25
+ | **CLI** | Environment variables | Read from `IRA_*` env vars at runtime. Never written to disk |
26
+ | **CI Pipelines** | Your CI secrets manager | GitHub Actions secrets, Jenkins credentials, HashiCorp Vault, Azure Key Vault, etc. |
13
27
 
14
- - **Generate Tests** — generate test cases from JIRA acceptance criteria in the VS Code extension (Cmd+Shift+P → IRA: Generate Tests)
15
- - **Review Current File** — review the currently open file without needing a PR (Cmd+Shift+P → IRA: Review Current File)
16
- - **CLI version fix** — CLI now correctly reports 1.0.1 (was showing 0.7.0)
17
- - **Feature table** — updated to reflect all available features
28
+ **What this means for your team:**
29
+ - GitHub users authenticate with one click via VS Code OAuth. No tokens to copy or paste
30
+ - Bitbucket users enter their token once in a masked prompt. It goes straight to the OS keychain
31
+ - Copilot users need zero configuration. It uses the existing VS Code GitHub session
32
+ - `IRA: Sign Out` wipes all secrets from the keychain in one command
33
+ - Token refresh is automatic. IRA detects VS Code session changes and invalidates stale tokens
34
+ - No cloud service, no telemetry, no analytics. Code and tokens never leave your infrastructure
35
+ - Config files (`.irarc.json`) block token fields by design
36
+
37
+ > **For your security team:** IRA is not a SaaS. It runs entirely on developer machines and CI runners. Tokens are used only to call APIs you already trust (GitHub, Bitbucket, SonarQube, JIRA, OpenAI). The authentication module is a single auditable file with full test coverage.
38
+
39
+ ---
18
40
 
19
41
  ## What can IRA do?
20
42
 
@@ -25,93 +47,76 @@ IRA (Intelligent Review Assistant) reviews your pull requests using AI. It posts
25
47
  - **Enrich SonarQube issues** with AI-powered explanations when Sonar is connected
26
48
  - **Notify your team** via Slack or Microsoft Teams after each review
27
49
 
28
- ## Try it in 30 seconds
50
+ ---
29
51
 
30
- ```bash
31
- npx ira-review review \
32
- --pr 42 \
33
- --scm-provider github \
34
- --github-token 'ghp_xxxxx' \
35
- --github-repo owner/repo \
36
- --ai-api-key 'sk-xxxxx' \
37
- --dry-run
38
- ```
52
+ ## Setup Guides
39
53
 
40
- This prints the review in your terminal. Drop `--dry-run` to post it on the PR.
54
+ ### VS Code Extension with GitHub
41
55
 
42
- ## Install
56
+ ![IRA Sign In via Command Palette](docs/images/vscode-sign-in.png)
43
57
 
44
- ```bash
45
- npx ira-review review --help # no install needed
46
- npm install -g ira-review # or install globally
47
- npm install --save-dev ira-review # or add to your project
48
- ```
58
+ 1. Install the extension: search **"IRA - AI Code Reviews"** in the Extensions panel, or run:
59
+ ```bash
60
+ code --install-extension ira-review.ira-review-vscode
61
+ ```
62
+ 2. Open a project with a GitHub remote
63
+ 3. Run `IRA: Sign In` from the Command Palette (`Cmd+Shift+P` / `Ctrl+Shift+P`)
64
+ 4. Click "Sign in with GitHub" in the popup. VS Code handles the OAuth flow
65
+ 5. Run `IRA: Review Current PR` and enter your PR number
49
66
 
50
- ## How to use IRA
67
+ ![IRA inline diagnostics and TreeView](docs/images/vscode-review-diagnostics.png)
51
68
 
52
- Pick the combination that fits your workflow. Each example builds on the previous one.
69
+ That's it. Copilot is the default AI provider, so no API key is needed.
53
70
 
54
- ### 1. AI-only review
71
+ **Optional - switch AI provider:**
72
+ - Open Settings > Extensions > IRA
73
+ - Change `ira.aiProvider` to `openai`, `anthropic`, or `ollama`
74
+ - Run `IRA: Sign In` again to store your AI API key securely
55
75
 
56
- The simplest setup. IRA reads your PR diff and finds bugs, security issues, and performance problems.
76
+ **Optional - connect SonarQube:**
77
+ - Set `ira.sonarUrl` to your SonarQube server URL
78
+ - The Sonar token is stored securely in the OS keychain via `IRA: Sign In`
79
+ - Set `ira.sonarProjectKey` in settings
57
80
 
58
- **GitHub:**
59
- ```bash
60
- npx ira-review review \
61
- --pr 42 \
62
- --scm-provider github \
63
- --github-token 'ghp_xxxxx' \
64
- --github-repo owner/repo \
65
- --ai-api-key 'sk-xxxxx'
66
- ```
81
+ **Optional - connect JIRA:**
82
+ - Set `ira.jiraUrl` and `ira.jiraEmail` in settings
83
+ - The JIRA token is stored securely in the OS keychain via `IRA: Sign In`
67
84
 
68
- **Bitbucket Cloud:**
69
- ```bash
70
- npx ira-review review \
71
- --pr 42 \
72
- --bitbucket-token 'bb_xxxxx' \
73
- --repo my-workspace/my-repo \
74
- --ai-api-key 'sk-xxxxx'
75
- ```
85
+ ### VS Code Extension with Bitbucket
86
+
87
+ 1. Install the extension (same as above)
88
+ 2. Open a project with a Bitbucket remote
89
+ 3. Run `IRA: Review Current PR` from the Command Palette
90
+ 4. IRA auto-detects Bitbucket from your git remote URL
91
+ 5. A masked input box appears: paste your Bitbucket access token (read-only scope recommended)
92
+ 6. The token is stored in the OS keychain. You will not be asked again
93
+
94
+ ![Bitbucket token stored securely](docs/images/vscode-bitbucket-token.png)
76
95
 
77
- ### 2. Review with JIRA (requirement tracking + AC validation)
96
+ **For Bitbucket Server / Data Center:**
97
+ - Set `ira.bitbucketUrl` to your server URL (e.g. `https://bitbucket.yourcompany.com`)
78
98
 
79
- Connect a JIRA ticket and IRA will tell you how much of the acceptance criteria is actually implemented, with per-criterion pass/fail and edge case warnings.
99
+ ### CLI with GitHub
100
+
101
+ ![IRA CLI review output](docs/images/cli-review-output.png)
80
102
 
81
103
  ```bash
104
+ # Install (optional - you can use npx directly)
105
+ npm install -g ira-review
106
+
107
+ # Run a review
82
108
  npx ira-review review \
83
109
  --pr 42 \
84
110
  --scm-provider github \
85
111
  --github-token 'ghp_xxxxx' \
86
112
  --github-repo owner/repo \
87
113
  --ai-api-key 'sk-xxxxx' \
88
- --jira-url https://yourcompany.atlassian.net \
89
- --jira-email you@company.com \
90
- --jira-token 'jira_xxxxx' \
91
- --jira-ticket AUTH-234
92
- ```
93
-
94
- Example output posted on your PR:
95
-
96
- ```
97
- 📊 Requirements: AUTH-234 - 67% Complete (4/6 AC met)
98
-
99
- ✅ OAuth2 login flow implemented with Google provider
100
- ✅ JWT tokens generated on successful authentication
101
- ✅ Refresh token rotation with 7-day expiry
102
- ❌ Input validation on login endpoint - no email format check
103
- ✅ Logout endpoint clears session and revokes token
104
- ❌ Rate limiting on login attempts - not implemented
105
-
106
- ⚠️ Edge Cases Not Covered:
107
- - What happens when Google OAuth is unreachable?
108
- - Token refresh during concurrent requests?
114
+ --dry-run
109
115
  ```
110
116
 
111
- ### 3. Review with JIRA + test generation
112
-
113
- Add `--generate-tests` to any review command and IRA will generate test scaffolding alongside the code review.
117
+ Drop `--dry-run` to post comments directly on the PR.
114
118
 
119
+ **Add JIRA validation:**
115
120
  ```bash
116
121
  npx ira-review review \
117
122
  --pr 42 \
@@ -122,33 +127,10 @@ npx ira-review review \
122
127
  --jira-url https://yourcompany.atlassian.net \
123
128
  --jira-email you@company.com \
124
129
  --jira-token 'jira_xxxxx' \
125
- --jira-ticket AUTH-234 \
126
- --generate-tests \
127
- --test-framework vitest
130
+ --jira-ticket AUTH-234
128
131
  ```
129
132
 
130
- ### 4. Standalone test generation (no review)
131
-
132
- Don't need a review? Generate test cases directly from a JIRA ticket.
133
-
134
- ```bash
135
- npx ira-review generate-tests \
136
- --jira-ticket AUTH-234 \
137
- --jira-url https://yourcompany.atlassian.net \
138
- --jira-email you@company.com \
139
- --jira-token 'jira_xxxxx' \
140
- --ai-api-key 'sk-xxxxx' \
141
- --test-framework playwright
142
- ```
143
-
144
- Add `--pr 42 --scm-provider github --github-repo owner/repo` to include code context from a PR for higher precision.
145
-
146
- Add `--output tests/auth.test.ts` to save the generated tests to a file.
147
-
148
- ### 5. Sonar + AI review
149
-
150
- Already using SonarQube? IRA pulls your Sonar issues and enriches each one with AI explanations and suggested fixes.
151
-
133
+ **Add SonarQube:**
152
134
  ```bash
153
135
  npx ira-review review \
154
136
  --pr 42 \
@@ -161,55 +143,28 @@ npx ira-review review \
161
143
  --project-key my-org_my-project
162
144
  ```
163
145
 
164
- You can combine this with JIRA, test generation, and notifications too.
165
-
166
- ## Quick reference
167
-
168
- | What you want | What to add | Example |
169
- |---|---|---|
170
- | AI-only review | `--pr`, SCM token, `--ai-api-key` | `npx ira-review review --pr 42 --scm-provider github --github-token ghp_xxx --github-repo owner/repo --ai-api-key sk-xxx` |
171
- | + SonarQube | `--sonar-url`, `--sonar-token`, `--project-key` | `... --sonar-url https://sonarcloud.io --sonar-token sqa_xxx --project-key my-org_my-project` |
172
- | + JIRA validation | `--jira-url`, `--jira-email`, `--jira-token`, `--jira-ticket` | `... --jira-url https://acme.atlassian.net --jira-email dev@acme.com --jira-token xxx --jira-ticket AUTH-234` |
173
- | + Test generation | `--generate-tests`, `--test-framework` | `... --generate-tests --test-framework vitest` |
174
- | + Slack notifications | `--slack-webhook` | `... --slack-webhook https://hooks.slack.com/services/xxx` |
175
- | + Teams notifications | `--teams-webhook` | `... --teams-webhook https://outlook.office.com/webhook/xxx` |
176
- | Notify only high risk | `--notify-min-risk` | `... --slack-webhook https://hooks.slack.com/xxx --notify-min-risk high` (only HIGH and CRITICAL trigger a notification) |
177
- | Notify on AC failure | `--notify-on-ac-fail` | `... --slack-webhook https://hooks.slack.com/xxx --notify-on-ac-fail` (notify when JIRA acceptance criteria fail, regardless of risk) |
178
- | Risk labels | Automatic on GitHub | Labels like `ira:critical`, `ira:high`, `ira:medium`, `ira:low` are applied automatically |
179
- | Preview in terminal | `--dry-run` | `... --dry-run` (prints output, doesn't post on PR) |
180
- | Use Anthropic | `--ai-provider anthropic` | `... --ai-provider anthropic --ai-api-key sk-ant-xxx` |
181
- | Use Ollama (free) | `--ai-provider ollama` | `... --ai-provider ollama` (no API key needed) |
182
- | Save on AI costs | `--ai-model` + `--ai-model-critical` | `... --ai-model gpt-4o-mini --ai-model-critical gpt-4o` |
183
- | Generate tests only | `generate-tests` command | `npx ira-review generate-tests --jira-ticket AUTH-234 --test-framework jest --ai-api-key sk-xxx` |
184
- | Save tests to file | `--output` | `... generate-tests --jira-ticket AUTH-234 --test-framework vitest --output tests/auth.test.ts` |
185
-
186
- ## Supported test frameworks
187
-
188
- | Framework | Language | Style |
189
- |---|---|---|
190
- | `jest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
191
- | `vitest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
192
- | `mocha` | JavaScript/TypeScript | `describe` / `it` + Chai |
193
- | `playwright` | TypeScript | `test` / `page` / E2E |
194
- | `cypress` | JavaScript | `cy.visit` / `cy.get` / E2E |
195
- | `gherkin` | Any (BDD) | `Given` / `When` / `Then` |
196
- | `pytest` | Python | `def test_` / `assert` |
197
- | `junit` | Java/Kotlin | `@Test` / `assertEquals` |
198
-
199
- ## AI providers
200
-
201
- | Provider | Flag | Notes |
202
- |---|---|---|
203
- | **OpenAI** (default) | `--ai-provider openai` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
204
- | **Azure OpenAI** | `--ai-provider azure-openai` | Also needs `--ai-base-url` and `--ai-deployment` |
205
- | **Anthropic** | `--ai-provider anthropic` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
206
- | **Ollama** (local) | `--ai-provider ollama` | Runs locally, no API key needed |
146
+ ### CLI with Bitbucket
207
147
 
208
- > **Tip:** Use `--ai-model gpt-4o-mini` for most issues and `--ai-model-critical gpt-4o` for blockers. This keeps costs low without sacrificing quality on critical findings.
148
+ ```bash
149
+ npx ira-review review \
150
+ --pr 42 \
151
+ --bitbucket-token 'bb_xxxxx' \
152
+ --repo my-workspace/my-repo \
153
+ --ai-api-key 'sk-xxxxx' \
154
+ --dry-run
155
+ ```
209
156
 
210
- ## CI/CD setup
157
+ **For Bitbucket Server / Data Center:**
158
+ ```bash
159
+ npx ira-review review \
160
+ --pr 42 \
161
+ --bitbucket-token 'bb_xxxxx' \
162
+ --repo my-workspace/my-repo \
163
+ --bitbucket-url https://bitbucket.yourcompany.com \
164
+ --ai-api-key 'sk-xxxxx'
165
+ ```
211
166
 
212
- ### GitHub Actions
167
+ ### CI with GitHub Actions
213
168
 
214
169
  ```yaml
215
170
  name: AI Code Review
@@ -235,17 +190,47 @@ jobs:
235
190
  IRA_AI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
236
191
  ```
237
192
 
238
- Want JIRA validation in CI? Add these flags to the run command:
239
-
240
- ```
241
- --jira-url ${{ vars.JIRA_URL }} \
242
- --jira-email ${{ vars.JIRA_EMAIL }} \
243
- --jira-token ${{ secrets.JIRA_TOKEN }} \
244
- --jira-ticket AUTH-234
193
+ **Add JIRA + Sonar in CI:**
194
+ ```yaml
195
+ - run: |
196
+ npx ira-review review \
197
+ --pr ${{ github.event.pull_request.number }} \
198
+ --scm-provider github \
199
+ --github-token ${{ secrets.GITHUB_TOKEN }} \
200
+ --github-repo ${{ github.repository }} \
201
+ --sonar-url ${{ vars.SONAR_URL }} \
202
+ --sonar-token ${{ secrets.SONAR_TOKEN }} \
203
+ --project-key ${{ vars.SONAR_PROJECT_KEY }} \
204
+ --jira-url ${{ vars.JIRA_URL }} \
205
+ --jira-email ${{ vars.JIRA_EMAIL }} \
206
+ --jira-token ${{ secrets.JIRA_TOKEN }} \
207
+ --jira-ticket AUTH-234 \
208
+ --no-config-file
209
+ env:
210
+ IRA_AI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
245
211
  ```
246
212
 
247
- ### Bitbucket Pipelines
213
+ All tokens come from GitHub Actions secrets. Nothing is hardcoded.
248
214
 
215
+ ### CI with Bitbucket Pipelines
216
+
217
+ ```yaml
218
+ pipelines:
219
+ pull-requests:
220
+ '**':
221
+ - step:
222
+ name: AI Code Review
223
+ script:
224
+ - npx ira-review review
225
+ --pr $BITBUCKET_PR_ID
226
+ --repo $BITBUCKET_REPO_FULL_NAME
227
+ --no-config-file
228
+ environment:
229
+ IRA_AI_API_KEY: $OPENAI_API_KEY
230
+ IRA_BITBUCKET_TOKEN: $BB_TOKEN
231
+ ```
232
+
233
+ **With Bitbucket Server + JIRA + Sonar:**
249
234
  ```yaml
250
235
  pipelines:
251
236
  pull-requests:
@@ -256,6 +241,14 @@ pipelines:
256
241
  - npx ira-review review
257
242
  --pr $BITBUCKET_PR_ID
258
243
  --repo $BITBUCKET_REPO_FULL_NAME
244
+ --bitbucket-url $BITBUCKET_SERVER_URL
245
+ --sonar-url $SONAR_URL
246
+ --sonar-token $SONAR_TOKEN
247
+ --project-key $SONAR_PROJECT_KEY
248
+ --jira-url $JIRA_URL
249
+ --jira-email $JIRA_EMAIL
250
+ --jira-token $JIRA_TOKEN
251
+ --jira-ticket AUTH-234
259
252
  --no-config-file
260
253
  environment:
261
254
  IRA_AI_API_KEY: $OPENAI_API_KEY
@@ -264,45 +257,142 @@ pipelines:
264
257
 
265
258
  > Use `--no-config-file` in CI pipelines that run on untrusted PRs (forks, external contributors).
266
259
 
267
- ## Smart notifications
260
+ ---
268
261
 
269
- By default, IRA sends a Slack or Teams notification after every review. You can control exactly when notifications fire so your team only hears about what matters.
262
+ ## What's New in v1.1.0
270
263
 
271
- ### How it works
264
+ - **🔒 Zero Plaintext Secrets** - all tokens (GitHub, Bitbucket, Sonar, JIRA, AI API keys) now use OS-native keychain storage via VS Code SecretStorage. Nothing is stored in `settings.json` anymore
265
+ - **OAuth Authentication** - sign in with GitHub via VS Code's built-in OAuth flow. No more copying Personal Access Tokens
266
+ - **GitHub Enterprise OAuth** - full support for GHE instances via the `github-enterprise` authentication provider
267
+ - **Bitbucket Secure Token Storage** - Bitbucket tokens stored in OS keychain instead of plain-text settings
268
+ - **Token Refresh Awareness** - automatic cache invalidation when VS Code detects session changes (token refresh, sign-out)
269
+ - **Centralized Auth** - unified authentication service with per-provider session caching for consistent, secure auth across all commands
270
+ - **Sign In / Sign Out Commands** - dedicated `IRA: Sign In` and `IRA: Sign Out` commands for managing authentication
271
+ - **PAT Fallback** - existing Personal Access Token workflows continue to work. OAuth is additive, not a breaking change
272
272
 
273
- | Setup | What happens | Best for |
273
+ ### Authentication: OAuth vs Personal Access Token (PAT)
274
+
275
+ | | OAuth (new in v1.1.0) | Personal Access Token (PAT) |
274
276
  |---|---|---|
275
- | No flags set | Every review triggers a notification | Small teams that want full visibility |
276
- | `--notify-min-risk high` | Only HIGH (40+) and CRITICAL (60+) PRs trigger notifications. LOW and MEDIUM stay silent | Reducing noise, focusing on risky PRs |
277
- | `--notify-min-risk high --notify-on-ac-fail` | Notifies on HIGH/CRITICAL risk **or** when JIRA acceptance criteria fail, even on low risk PRs | **Recommended for tech leads.** Catches both risky code and incomplete requirements |
278
- | `--notify-on-ac-fail` alone | Every review still triggers a notification (no risk filter), but AC failures are guaranteed to notify | Teams that want full visibility but never want to miss an AC failure |
277
+ | **Setup** | One-click sign-in via VS Code | Manually generate token on GitHub/Bitbucket, paste into settings |
278
+ | **Security** | Token managed by VS Code, stored in OS keychain | Token stored in VS Code settings (plain text in `settings.json`) |
279
+ | **Scopes** | Requests `repo` scope automatically | You choose scopes manually when creating the token |
280
+ | **Token Rotation** | Handled automatically by VS Code | Manual - you must regenerate expired tokens |
281
+ | **GitHub Enterprise** | ✅ Supported (org admin may need to approve the VS Code OAuth app) | ✅ Supported |
282
+ | **Bitbucket** | Token stored securely via SecretStorage | Token stored in settings |
283
+ | **Multi-account** | Managed by VS Code account system | One token per settings entry |
284
+ | **Offline / CI** | Not applicable (VS Code only) | ✅ Works in CI/CD and headless environments |
279
285
 
280
- ### Example: only ping on high risk PRs
286
+ > **GHE Note:** If your organization uses GitHub Enterprise, an org admin may need to approve the VS Code GitHub authentication app before OAuth will work. Users can still fall back to PATs in the meantime.
287
+
288
+ <details>
289
+ <summary>Previous releases</summary>
290
+
291
+ #### v1.0.0
292
+
293
+ - **⚠️ Breaking:** Rule prefixes renamed from `ai/` to `IRA/` (e.g. `IRA/security`, `IRA/best-practice`)
294
+ - **Risk scoring v2** - BLOCKER issues now set a minimum HIGH severity floor; CRITICAL issues set minimum MEDIUM
295
+ - **VS Code Extension** - full-featured editor integration with Pro tier (auto-review, apply fix, trends dashboard)
296
+ - **Notifications** - Slack and Teams now available in both CLI and VS Code extension
297
+ - **Bug fix** - Security issues are now correctly detected and classified (stale prefix was preventing detection)
298
+ - **License** - switched to proprietary license
299
+
300
+ </details>
301
+
302
+ ## Example output
303
+
304
+ ![IRA JIRA validation and risk scoring in VS Code](docs/images/vscode-jira-ac.png)
305
+
306
+ **JIRA requirement tracking posted on your PR:**
281
307
 
282
- ```bash
283
- npx ira-review review \
284
- --pr 42 \
285
- --scm-provider github \
286
- --github-token 'ghp_xxxxx' \
287
- --github-repo owner/repo \
288
- --ai-api-key 'sk-xxxxx' \
289
- --slack-webhook 'https://hooks.slack.com/services/xxx' \
290
- --notify-min-risk high
291
308
  ```
309
+ 📊 Requirements: AUTH-234 - 67% Complete (4/6 AC met)
292
310
 
293
- Your `#code-reviews` channel only gets pinged for HIGH and CRITICAL PRs. Everything else reviews silently.
311
+ ✅ OAuth2 login flow implemented with Google provider
312
+ ✅ JWT tokens generated on successful authentication
313
+ ✅ Refresh token rotation with 7-day expiry
314
+ ❌ Input validation on login endpoint - no email format check
315
+ ✅ Logout endpoint clears session and revokes token
316
+ ❌ Rate limiting on login attempts - not implemented
294
317
 
295
- ### Example: catch risky PRs and incomplete requirements
318
+ ⚠️ Edge Cases Not Covered:
319
+ - What happens when Google OAuth is unreachable?
320
+ - Token refresh during concurrent requests?
321
+ ```
322
+
323
+ **Inline comments on the exact lines:**
296
324
 
297
- ```bash
298
- --notify-min-risk high --notify-on-ac-fail
299
325
  ```
326
+ 🔍 IRA Review - IRA/security (CRITICAL)
300
327
 
301
- Tech leads get notified for two things: risky PRs and PRs that don't fully implement the JIRA requirements. Low risk, well-implemented PRs stay quiet.
328
+ > User input used directly in SQL query without sanitization.
302
329
 
303
- ### What triggers a notification?
330
+ Explanation: The username parameter is concatenated into a SQL string,
331
+ creating a SQL injection vector.
304
332
 
305
- Here's exactly when your Slack or Teams channel gets a message:
333
+ Impact: Attacker could execute arbitrary SQL and gain database control.
334
+
335
+ Suggested Fix: Use parameterized queries:
336
+ db.query('SELECT * FROM users WHERE name = $1', [username])
337
+ ```
338
+
339
+ ## Quick reference
340
+
341
+ | What you want | What to add | Example |
342
+ |---|---|---|
343
+ | AI-only review | `--pr`, SCM token, `--ai-api-key` | `npx ira-review review --pr 42 --scm-provider github --github-token ghp_xxx --github-repo owner/repo --ai-api-key sk-xxx` |
344
+ | + SonarQube | `--sonar-url`, `--sonar-token`, `--project-key` | `... --sonar-url https://sonarcloud.io --sonar-token sqa_xxx --project-key my-org_my-project` |
345
+ | + JIRA validation | `--jira-url`, `--jira-email`, `--jira-token`, `--jira-ticket` | `... --jira-url https://acme.atlassian.net --jira-email dev@acme.com --jira-token xxx --jira-ticket AUTH-234` |
346
+ | + Test generation | `--generate-tests`, `--test-framework` | `... --generate-tests --test-framework vitest` |
347
+ | + Slack notifications | `--slack-webhook` | `... --slack-webhook https://hooks.slack.com/services/xxx` |
348
+ | + Teams notifications | `--teams-webhook` | `... --teams-webhook https://outlook.office.com/webhook/xxx` |
349
+ | Notify only high risk | `--notify-min-risk` | `... --notify-min-risk high` |
350
+ | Notify on AC failure | `--notify-on-ac-fail` | `... --notify-on-ac-fail` |
351
+ | Risk labels | Automatic on GitHub | Labels like `ira:critical`, `ira:high`, `ira:medium`, `ira:low` |
352
+ | Preview in terminal | `--dry-run` | `... --dry-run` |
353
+ | Use Anthropic | `--ai-provider anthropic` | `... --ai-provider anthropic --ai-api-key sk-ant-xxx` |
354
+ | Use Ollama (free) | `--ai-provider ollama` | `... --ai-provider ollama` (no API key needed) |
355
+ | Save on AI costs | `--ai-model` + `--ai-model-critical` | `... --ai-model gpt-4o-mini --ai-model-critical gpt-4o` |
356
+ | Generate tests only | `generate-tests` command | `npx ira-review generate-tests --jira-ticket AUTH-234 --test-framework jest --ai-api-key sk-xxx` |
357
+ | Save tests to file | `--output` | `... --output tests/auth.test.ts` |
358
+
359
+ ## Supported test frameworks
360
+
361
+ | Framework | Language | Style |
362
+ |---|---|---|
363
+ | `jest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
364
+ | `vitest` | JavaScript/TypeScript | `describe` / `it` / `expect` |
365
+ | `mocha` | JavaScript/TypeScript | `describe` / `it` + Chai |
366
+ | `playwright` | TypeScript | `test` / `page` / E2E |
367
+ | `cypress` | JavaScript | `cy.visit` / `cy.get` / E2E |
368
+ | `gherkin` | Any (BDD) | `Given` / `When` / `Then` |
369
+ | `pytest` | Python | `def test_` / `assert` |
370
+ | `junit` | Java/Kotlin | `@Test` / `assertEquals` |
371
+
372
+ ## AI providers
373
+
374
+ | Provider | Flag | Notes |
375
+ |---|---|---|
376
+ | **OpenAI** (default for CLI) | `--ai-provider openai` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
377
+ | **GitHub Copilot** (default for VS Code) | `ira.aiProvider: copilot` | Zero config. Uses existing VS Code auth |
378
+ | **Azure OpenAI** | `--ai-provider azure-openai` | Also needs `--ai-base-url` and `--ai-deployment` |
379
+ | **Anthropic** | `--ai-provider anthropic` | Pass key with `--ai-api-key` or set `IRA_AI_API_KEY` |
380
+ | **Ollama** (local) | `--ai-provider ollama` | Runs locally, no API key needed |
381
+
382
+ > **Tip:** Use `--ai-model gpt-4o-mini` for most issues and `--ai-model-critical gpt-4o` for blockers. This keeps costs low without sacrificing quality on critical findings.
383
+
384
+ ## Smart notifications
385
+
386
+ By default, IRA sends a Slack or Teams notification after every review. You can control exactly when notifications fire so your team only hears about what matters.
387
+
388
+ | Setup | What happens | Best for |
389
+ |---|---|---|
390
+ | No flags set | Every review triggers a notification | Small teams that want full visibility |
391
+ | `--notify-min-risk high` | Only HIGH and CRITICAL PRs trigger notifications | Reducing noise |
392
+ | `--notify-min-risk high --notify-on-ac-fail` | Notifies on HIGH/CRITICAL risk or when JIRA AC fail | Recommended for tech leads |
393
+ | `--notify-on-ac-fail` alone | Every review notifies, AC failures guaranteed | Never miss an AC failure |
394
+
395
+ ### What triggers a notification?
306
396
 
307
397
  | PR risk | AC status | No flags | `--notify-min-risk high` | `+ --notify-on-ac-fail` |
308
398
  |---|---|---|---|---|
@@ -347,7 +437,7 @@ Labels update automatically when risk changes. Filter your PR list with `label:i
347
437
 
348
438
  ### Bitbucket: build status
349
439
 
350
- Bitbucket doesn't support PR labels, so IRA posts a **build status** on the PR commit instead. This shows as a status icon (✅ ❌ 🟡) in the PR list.
440
+ Bitbucket does not support PR labels, so IRA posts a **build status** on the PR commit instead. This shows as a status icon in the PR list.
351
441
 
352
442
  | Risk level | Build status | Icon in PR list |
353
443
  |---|---|---|
@@ -356,27 +446,7 @@ Bitbucket doesn't support PR labels, so IRA posts a **build status** on the PR c
356
446
  | MEDIUM | INPROGRESS | 🟡 Yellow dot |
357
447
  | LOW | SUCCESSFUL | 🟢 Green check |
358
448
 
359
- Hover over the icon to see the full risk score. You can also configure Bitbucket branch permissions to **block merging** when the IRA Risk status is FAILED, preventing high-risk PRs from being merged without review.
360
-
361
- ## What IRA posts on your PR
362
-
363
- **Inline comments** on the exact lines:
364
-
365
- ```
366
- 🔍 IRA Review — IRA/security (CRITICAL)
367
-
368
- > User input used directly in SQL query without sanitization.
369
-
370
- Explanation: The username parameter is concatenated into a SQL string,
371
- creating a SQL injection vector.
372
-
373
- Impact: Attacker could execute arbitrary SQL and gain database control.
374
-
375
- Suggested Fix: Use parameterized queries:
376
- db.query('SELECT * FROM users WHERE name = $1', [username])
377
- ```
378
-
379
- **Summary comment** with risk score, issue breakdown, requirement completion (if JIRA is connected), and complexity hotspots (if Sonar is connected).
449
+ Hover over the icon to see the full risk score. You can also configure Bitbucket branch permissions to **block merging** when the IRA Risk status is FAILED.
380
450
 
381
451
  ## Config file
382
452
 
@@ -393,53 +463,10 @@ Create `.irarc.json` in your project root to set defaults:
393
463
 
394
464
  CLI flags override env vars, which override the config file. Tokens and keys are blocked from config files for security.
395
465
 
396
- ## VS Code Extension
397
-
398
- Use IRA directly inside your editor. No terminal needed.
399
-
400
- ### Install
401
-
402
- Search **"IRA - AI Code Reviews"** in the VS Code Extensions panel, or:
403
-
404
- ```bash
405
- code --install-extension ira-review.ira-review-vscode
406
- ```
407
-
408
- ### Features
409
-
410
- - **Zero config** - uses your existing GitHub Copilot subscription (or bring OpenAI, Anthropic, Ollama)
411
- - **Review Current File** - review the currently open file without a PR
412
- - **Generate Tests** - generate test cases from JIRA acceptance criteria
413
- - **Diagnostics** - issues show up as squiggly lines with severity levels
414
- - **CodeLens** - inline annotations on affected lines
415
- - **TreeView** - sidebar panel with all issues grouped by file
416
- - **Risk Score** - status bar badge showing LOW / MEDIUM / HIGH / CRITICAL
417
- - **Multi-SCM** - GitHub, GitHub Enterprise, Bitbucket Cloud, Bitbucket Server/Data Center
418
- - **Auto-review on Save** ⭐ Pro - automatically reviews files when you save
419
- - **Apply Fix** ⭐ Pro - one-click AI-generated fix via CodeLens
420
- - **Review History** ⭐ Pro - browse past reviews in a sidebar tree
421
- - **Trends Dashboard** ⭐ Pro - visualize issues over time
422
- - **Generate PR Description** - AI-powered PR descriptions with JIRA ticket detection
423
- - **Slack & Teams Notifications** - get notified after reviews
424
-
425
- ### Quick Start
426
-
427
- 1. Open a project with a git remote
428
- 2. Run `IRA: Review Current PR` from the Command Palette (`Cmd+Shift+P`)
429
- 3. Enter the PR number. IRA reviews every changed file and shows results inline
430
-
431
- 📖 **Full extension docs:** [`packages/vscode/README.md`](packages/vscode/README.md)
432
-
433
- ## Security
434
-
435
- - Runs in your CI. Tokens never leave your infrastructure
436
- - No telemetry, analytics, or tracking
437
- - Config files block sensitive fields automatically
438
-
439
466
  ## Requirements
440
467
 
441
468
  - Node.js 18+
442
- - An AI provider API key (or Ollama running locally)
469
+ - An AI provider API key (or Ollama running locally, or GitHub Copilot for the VS Code extension)
443
470
  - A GitHub or Bitbucket repo with an open PR
444
471
 
445
472
  ## License