Skip to content

feat: add AI code reviewer using Gemini API #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swadhinbiswas merged 16 commits into from
Jul 10, 2026
Merged

feat: add AI code reviewer using Gemini API #68

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
59e3443
feat: add AI code reviewer using Gemini API
swadhinbiswas Jul 10, 2026
78578b7
fix: change secret name to GEMINI_KEY
swadhinbiswas Jul 10, 2026
387ea77
feat: upgrade AI code reviewer to Gemini 3.5 Flash using official SDK
swadhinbiswas Jul 10, 2026
45953c0
fix: use snake_case for thinking_level parameter
swadhinbiswas Jul 10, 2026
3d7d578
feat: switch AI reviewer from Gemini to Mistral Agent
swadhinbiswas Jul 10, 2026
eb6e7ab
fix: add missing bun install step to AI reviewer workflow
swadhinbiswas Jul 10, 2026
09dd002
fix: resolve AI review duplication and GenAI config issues
swadhinbiswas Jul 10, 2026
db27f91
fix: require all CI jobs in branch protection and fix NPM provenance …
swadhinbiswas Jul 10, 2026
eb89e1a
fix(ci): correct unresolved job dependency perf -> performance
swadhinbiswas Jul 10, 2026
5709934
fix(lint): resolve typescript strict typing errors and unused variables
swadhinbiswas Jul 10, 2026
fc37c59
fix(perf): respect SKIP_REDIS_CHECK and run baseline on built server
swadhinbiswas Jul 10, 2026
f871577
fix(health): ensure storage directory exists before checking access
swadhinbiswas Jul 10, 2026
8416fe1
test: fix health route unit test mock for fs.mkdir
swadhinbiswas Jul 10, 2026
770e892
fix(health): use proper getDatabase to fix 503 error on health endpoint
swadhinbiswas Jul 10, 2026
470436a
ci: add server warmup curls before running perf tests
swadhinbiswas Jul 10, 2026
3b0259c
ci: disable rate limiter during perf baseline check
swadhinbiswas Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions .github/workflows/ai-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: AI Code Reviewer

on:
pull_request:
types: [opened, synchronize]

permissions:
pull-requests: write
contents: read

jobs:
review:
name: Gemini AI Review
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
Comment on lines +17 to +19

@coderabbitai coderabbitai Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Set persist-credentials: false on the checkout action.

actions/checkout@v4 persists the GitHub token in .git/config by default. The script only runs a local git diff and never pushes, so credential persistence is unnecessary and expands the attack surface if future steps are added.

🔒️ Proposed fix 
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/checkout@v4
with:
fetch-depth: 0
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 17-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ai-review.yml around lines 17 - 19, Update the
actions/checkout@v4 step to set persist-credentials: false in its with
configuration, alongside fetch-depth, since the workflow only performs local git
diff operations.

Source: Linters/SAST tools


- uses: oven-sh/setup-bun@v2
with:
bun-version: latest

- name: Install dependencies
run: bun install --frozen-lockfile

- name: Run AI Review
env:
# Use user's PAT to count towards their GitHub contribution graph, fallback to standard bot token
GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
AGENT_API_KEY: ${{ secrets.AGENT_API_KEY }}
PR_NUMBER: ${{ github.event.pull_request.number }}
REPO: ${{ github.repository }}
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
Comment on lines +31 to +36
run: bun run scripts/ai-review.ts
Comment thread
greptile-apps[bot] marked this conversation as resolved.
9 changes: 6 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,6 +460,9 @@ jobs:
runs-on: ubuntu-latest
needs: [build, e2e]
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4

Expand Down Expand Up @@ -500,7 +503,7 @@ jobs:
quality-gate:
name: Quality Gate
runs-on: ubuntu-latest
needs: [lint, docs-parity, security, test, e2e, container-scan, sast, perf, build]
needs: [lint, docs-parity, security, test, e2e, container-scan, sast, performance, build]
if: always()
steps:
- name: Check all gates
Expand All @@ -515,13 +518,13 @@ jobs:

echo "Docs Parity: ${{ needs.docs-parity.result }}"
echo "Security Gates: ${{ needs.security.result }}"
echo "Perf Gate: ${{ needs.perf.result }}"
echo "Perf Gate: ${{ needs.performance.result }}"

if [[ "${{ needs.lint.result }}" != "success" ]] || \
[[ "${{ needs.docs-parity.result }}" != "success" ]] || \
[[ "${{ needs.security.result }}" != "success" ]] || \
[[ "${{ needs.test.result }}" != "success" ]] || \
[[ "${{ needs.perf.result }}" != "success" ]] || \
[[ "${{ needs.performance.result }}" != "success" ]] || \
[[ "${{ needs.build.result }}" != "success" ]]; then
echo "::error::Quality gate FAILED — required checks did not pass"
exit 1
Expand Down
27 changes: 26 additions & 1 deletion bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion features.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Canonical source: `doc/feature_audit.md`

## Recently completed
- Local free-model AI support (`local` provider, Ollama/OpenAI-compatible) with configurable `localBaseUrl` and key.
- External-agent (CodeRabbit-like) callback and async AI review flow documented and supported.
- External-agent (Greptile-like) callback and async AI review flow documented and supported.
- PR dependency APIs:
- `GET /api/repos/{owner}/{repo}/pulls/dependencies`
- `POST /api/repos/{owner}/{repo}/pulls/stack-order`
Expand Down
5 changes: 4 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,9 @@
"@dnd-kit/core": "^6.3.1",
"@dnd-kit/sortable": "^10.0.0",
"@dnd-kit/utilities": "^3.2.2",
"@google/genai": "^2.11.0",
"@libsql/client": "^0.15.15",
"@mistralai/mistralai": "^2.4.1",
"@monaco-editor/react": "^4.6.0",
Comment on lines 59 to 61
"@opentelemetry/auto-instrumentations-node": "^0.76.0",
"@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
Expand Down Expand Up @@ -99,6 +101,7 @@
"cobe": "^0.6.5",
"date-fns": "^4.1.0",
"dockerode": "^4.0.12",
"dotenv": "^17.4.2",
"drizzle-orm": "^0.45.2",
"framer-motion": "^11.18.2",
"github-markdown-css": "^5.8.1",
Expand Down Expand Up @@ -137,6 +140,7 @@
"remark-gfm": "^4.0.1",
"remark-parse": "^11.0.0",
"remark-rehype": "^11.1.2",
"shiki": "^1.29.0",
"simple-git": "^3.36.0",
"sonner": "^2.0.7",
"ssh2": "^1.15.0",
Expand All @@ -145,7 +149,6 @@
"three": "^0.182.0",
"unified": "^11.0.5",
"unist-util-visit": "^5.1.0",
"shiki": "^1.29.0",
"yaml": "^2.8.0",
"zod": "^3.23.8",
"zustand": "^4.5.4"
Expand Down
Loading
Loading