feat: Autonomous AI Repository Automation - #110
Conversation
- Add AI PR Reviewer workflow and script using Gemini - Add AI Issue Triage workflow and script - Add continuous improvement workflow and loop - Automate architecture diagram and knowledge graph generation - Add standard GitHub issue and PR templates - Add AI Assistant Guidelines to AGENTS.md Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.github.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @NITISH-R-G, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
github-actions
Bot
added
documentation
![greptile-apps[bot]](https://avatars.github.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds contribution templates, AI-powered issue and pull request automation, scheduled repository-improvement workflows, Gemini-backed analysis scripts, and formatting-only updates across existing application files. ChangesRepository contribution guidance
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubIssue
participant GitHubActions
participant aiTriage
participant GeminiAPI
participant GitHubCLI
GitHubIssue->>GitHubActions: issue opened event
GitHubActions->>aiTriage: run npm run ai:triage
aiTriage->>GeminiAPI: request issue labels
GeminiAPI-->>aiTriage: return labels
aiTriage->>GitHubCLI: add labels to issue
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- Add AI PR Reviewer workflow and script using Gemini - Add AI Issue Triage workflow and script - Add continuous improvement workflow and loop - Automate architecture diagram and knowledge graph generation - Add standard GitHub issue and PR templates - Add AI Assistant Guidelines to AGENTS.md Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
- Add AI PR Reviewer workflow and script using Gemini - Add AI Issue Triage workflow and script - Add continuous improvement workflow and loop - Automate architecture diagram and knowledge graph generation - Add standard GitHub issue and PR templates - Add AI Assistant Guidelines to AGENTS.md Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 14
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/PULL_REQUEST_TEMPLATE.md:
- Line 1: Update the pull request template’s heading structure by changing the
top-level `## Description` heading to `# Description`, or add a preceding `#
Pull Request` heading before it, so the template satisfies the markdownlint
requirement for a top-level heading.
In @.github/workflows/ai-issue-triage.yml:
- Around line 15-21: Pin both actions/checkout and actions/setup-node to
immutable commit SHAs instead of the mutable `@v4` tags, preserving their current
major-version behavior. In the checkout step, set persist-credentials to false
under with so the GITHUB_TOKEN is not stored in git configuration.
In @.github/workflows/ai-pr-reviewer.yml:
- Around line 15-23: Pin all workflow actions, including actions/checkout,
actions/setup-node, and thollander/actions-comment-pull-request, to immutable
commit SHAs instead of mutable version tags. Add persist-credentials: false to
the checkout step’s with block while preserving fetch-depth: 0.
In @.github/workflows/continuous-improvement.yml:
- Around line 8-10: Remove the unnecessary pull-requests: write permission from
the workflow permissions block, retaining only contents: write for the commit
and push operations.
- Around line 3-6: Add a top-level concurrency configuration to the workflow
containing a stable group name, such as the workflow name or a fixed identifier,
and configure cancellation behavior as appropriate to ensure scheduled and
manually dispatched runs cannot overlap. Place it alongside the existing `on`
and `jobs` sections.
- Around line 46-52: Update the “Commit changes” workflow step to stage all
intended modifications, including root-level files such as server.ts, by
replacing the limited git add paths with git add -A. Verify .gitignore excludes
generated or unwanted files so they are not committed.
- Around line 34-41: Configure GEMINI_API_KEY at the job level in the workflow
so it is available to Run AI Improvement Loop, Analyze Repository, Generate
Diagrams, and Generate Knowledge Graph. Remove the step-only env declaration and
reference the repository secret from the job’s env configuration.
In `@scripts/automation/ai-improve.ts`:
- Around line 14-34: Update the lint-result handling in the top-level ESLint
execution flow so a successful run parses the JSON output and exits immediately
when the issues array is empty, before any Gemini/API processing. Remove or
defer the misleading “complete with no issues” log until after this check, and
retain the existing nonzero-error handling for actual lint failures.
- Around line 61-64: Add a pre-write directory guard in the report-generation
flow of scripts/automation/ai-improve.ts: import existsSync and mkdirSync from
node:fs, then ensure docs/ exists with mkdirSync(..., { recursive: true })
before the writeFileSync call that creates continuous-improvement-report.md,
matching the sibling automation scripts.
In `@scripts/automation/ai-pr-review.ts`:
- Around line 24-26: Add time limits to both external operations: configure a
finite timeout in the `execFileSync` invocation for `gh pr diff`, and pass an
abort signal with a matching timeout to the Gemini API request. Update the
relevant Gemini call alongside the diff retrieval so stalled subprocesses or
network requests terminate cleanly.
- Around line 49-52: Handle the missing response text in the review-generation
flow before writing the artifact: when `response.text` is absent, report the
failure and exit with a non-zero status instead of using the `"Failed to
generate review."` fallback; only call `writeFileSync` with valid review content
so downstream workflows do not post an unhelpful comment.
In `@scripts/automation/ai-triage.ts`:
- Around line 52-61: Validate the labels parsed in the label-processing block
against the predefined allowed-label list before invoking gh. Trim each label,
retain only exact allowed matches, and use the filtered list for logging and gh
issue edit; skip the command when no valid labels remain.
- Around line 47-50: Add 30-second timeouts to both external calls in the AI
triage flow: pass config: { abortSignal: AbortSignal.timeout(30_000) } to
ai.models.generateContent(), and set timeout: 30_000 in the options passed to
execFileSync() for the gh invocation.
In `@scripts/automation/generate-knowledge-graph.ts`:
- Around line 37-45: The JSON fence handling in the response post-processing can
leave stray backticks with trailing newlines, and the result is written without
validation. Update the processing around jsonString in the knowledge-graph
generation flow to robustly extract fenced content using a regex that tolerates
whitespace and trailing newlines, then call JSON.parse before writeFileSync to
validate it and log a clear error if parsing fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 348a5ff4-468d-4c6d-af2e-8a33f5804be6
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (24)
.github/ISSUE_TEMPLATE/bug_report.md.github/ISSUE_TEMPLATE/feature_request.md.github/PULL_REQUEST_TEMPLATE.md.github/workflows/ai-issue-triage.yml.github/workflows/ai-pr-reviewer.yml.github/workflows/continuous-improvement.ymlAGENTS.mdCHANGELOG.mdCONTRIBUTING.mdapi/_lib/__tests__/analyze-core.test.tsapi/_lib/limits.tsapi/_lib/mcp-tools.tsapi/analyze.tspackage.jsonscripts/automation/ai-improve.tsscripts/automation/ai-pr-review.tsscripts/automation/ai-triage.tsscripts/automation/analyze-repo.tsscripts/automation/generate-diagrams.tsscripts/automation/generate-knowledge-graph.tssrc/App.tsxsrc/services/__tests__/analysisService.test.tssrc/services/analysisService.tsvercel.json
💤 Files with no reviewable changes (2)
- src/App.tsx
- src/services/analysisService.ts
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: AI PR Reviewer / 0_ai-review.txt: feat: Autonomous AI Repository Automation
Conclusion: failure
##[group]Run npm run ai:pr-review
�[36;1mnpm run ai:pr-review�[0m
shell: /usr/bin/bash -e {0}
env:
GEMINI_***REDACTED*** 110
GH_***REDACTED***
##[endgroup]
> intelli-credit@1.0.0 ai:pr-review
> tsx scripts/automation/ai-pr-review.ts
Starting AI PR Review...
GEMINI_API_KEY environment variable is missing.
##[error]Process completed with exit code 1.
GitHub Actions: AI PR Reviewer / ai-review: feat: Autonomous AI Repository Automation
Conclusion: failure
##[group]Run npm run ai:pr-review
�[36;1mnpm run ai:pr-review�[0m
shell: /usr/bin/bash -e {0}
env:
GEMINI_***REDACTED*** 110
GH_***REDACTED***
##[endgroup]
> intelli-credit@1.0.0 ai:pr-review
> tsx scripts/automation/ai-pr-review.ts
Starting AI PR Review...
GEMINI_API_KEY environment variable is missing.
##[error]Process completed with exit code 1.
🧰 Additional context used
📓 Path-based instructions (4)
!docs/architecture/**
📄 CodeRabbit inference engine (AGENTS.md)
Do not manually edit files in
docs/architecture/or auto-generated diagram files; regenerate them usingnpm run analyze:repo,npm run generate:diagrams, ornpm run generate:knowledge-graph.
Files:
.github/PULL_REQUEST_TEMPLATE.md.github/workflows/ai-pr-reviewer.yml.github/workflows/ai-issue-triage.yml.github/ISSUE_TEMPLATE/bug_report.mdapi/_lib/limits.tsvercel.jsonapi/analyze.tsAGENTS.mdapi/_lib/mcp-tools.tsCONTRIBUTING.mdscripts/automation/analyze-repo.tsscripts/automation/generate-knowledge-graph.tsscripts/automation/ai-pr-review.ts.github/ISSUE_TEMPLATE/feature_request.mdapi/_lib/__tests__/analyze-core.test.tsscripts/automation/generate-diagrams.tssrc/services/__tests__/analysisService.test.tspackage.jsonCHANGELOG.md.github/workflows/continuous-improvement.ymlscripts/automation/ai-triage.tsscripts/automation/ai-improve.ts
.github/workflows/**/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
.github/workflows/**/*.{yml,yaml}: In GitHub Actions workflows handling pull requests, assigngithub.base_refandgithub.head_refto environment variables and reference those variables in run scripts instead of directly interpolating${{ }}expressions.
When configuringthollander/actions-comment-pull-request@v3, use kebab-case inputs such asfile-pathandcomment-tag, not camelCase or snake_case.
Files:
.github/workflows/ai-pr-reviewer.yml.github/workflows/ai-issue-triage.yml.github/workflows/continuous-improvement.yml
**/*
📄 CodeRabbit inference engine (AGENTS.md)
Automate repetitive tasks whenever possible.
Files:
api/_lib/limits.tsvercel.jsonapi/analyze.tsAGENTS.mdapi/_lib/mcp-tools.tsCONTRIBUTING.mdscripts/automation/analyze-repo.tsscripts/automation/generate-knowledge-graph.tsscripts/automation/ai-pr-review.tsapi/_lib/__tests__/analyze-core.test.tsscripts/automation/generate-diagrams.tssrc/services/__tests__/analysisService.test.tspackage.jsonCHANGELOG.mdscripts/automation/ai-triage.tsscripts/automation/ai-improve.ts
**/*.{js,jsx,ts,tsx,mjs,cjs}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{js,jsx,ts,tsx,mjs,cjs}: In automation scripts, do not useexecSyncwith concatenated command strings; useexecFileSyncwith separated executable and argument arrays to prevent command injection.
BecauseexecFileSyncdoes not invoke a shell or support pipes, rewrite piped commands using native Node.js logic.
Do not useconsole.log; useconsole.info,console.warn, orconsole.errorinstead.
Files:
api/_lib/limits.tsapi/analyze.tsapi/_lib/mcp-tools.tsscripts/automation/analyze-repo.tsscripts/automation/generate-knowledge-graph.tsscripts/automation/ai-pr-review.tsapi/_lib/__tests__/analyze-core.test.tsscripts/automation/generate-diagrams.tssrc/services/__tests__/analysisService.test.tsscripts/automation/ai-triage.tsscripts/automation/ai-improve.ts
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-10T17:24:52.701Z
Learning: Use `npm run fix` for automated self-healing whenever possible.
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-10T17:24:52.701Z
Learning: Before committing code changes, run and pass `npm test`, `npm run format`, and `npm run lint`.
🪛 ast-grep (0.44.1)
scripts/automation/analyze-repo.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/generate-knowledge-graph.ts
[warning] 2-2: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/ai-pr-review.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/generate-diagrams.ts
[warning] 2-2: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/ai-triage.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/ai-improve.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🪛 GitHub Actions: AI PR Reviewer / 0_ai-review.txt
scripts/automation/ai-pr-review.ts
[error] 1-1: Command failed: npm run ai:pr-review (tsx scripts/automation/ai-pr-review.ts). Review process aborted due to missing GEMINI_API_KEY.
🪛 GitHub Actions: AI PR Reviewer / ai-review
scripts/automation/ai-pr-review.ts
[error] 1-1: AI PR review failed because the GEMINI_API_KEY environment variable is missing. Process completed with exit code 1.
🪛 GitHub Check: SonarCloud Code Analysis
.github/workflows/ai-pr-reviewer.yml
[failure] 36-36: Use full commit SHA hash for this dependency.
scripts/automation/analyze-repo.ts
[warning] 19-19: Make sure the "PATH" variable only contains fixed, unwriteable directories.
[warning] 48-48: Prefer top-level await over an async function analyzeRepo call.
scripts/automation/generate-knowledge-graph.ts
[warning] 53-53: Prefer top-level await over an async function generateKnowledgeGraph call.
[warning] 19-19: Make sure the "PATH" variable only contains fixed, unwriteable directories.
scripts/automation/ai-pr-review.ts
[warning] 60-60: Prefer top-level await over an async function runPRReview call.
[warning] 24-24: Make sure the "PATH" variable only contains fixed, unwriteable directories.
scripts/automation/generate-diagrams.ts
[warning] 19-19: Make sure the "PATH" variable only contains fixed, unwriteable directories.
[warning] 48-48: Prefer top-level await over an async function generateDiagrams call.
scripts/automation/ai-triage.ts
[warning] 61-61: Make sure the "PATH" variable only contains fixed, unwriteable directories.
[warning] 61-61: Make sure that this user-controlled command argument doesn't lead to unwanted behavior.
[warning] 55-55: Change this code to not log user-controlled data.
[warning] 75-75: Prefer top-level await over an async function runTriage call.
scripts/automation/ai-improve.ts
[warning] 17-17: Make sure the "PATH" variable only contains fixed, unwriteable directories.
[warning] 74-74: Prefer top-level await over an async function runImprovementLoop call.
🪛 LanguageTool
.github/PULL_REQUEST_TEMPLATE.md
[style] ~3-~3: Consider using a different verb for a more formal wording.
Context: ...ummary of the change and which issue is fixed. Please also include relevant motivatio...
(FIX_RESOLVE)
[style] ~11-~11: Consider using a different verb for a more formal wording.
Context: ... [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaki...
(FIX_RESOLVE)
AGENTS.md
[uncategorized] ~13-~13: The official name of this software platform is spelled with a capital “H”.
Context: ... handling pull requests, variables like github.base_ref and github.head_ref MUST be...
(GITHUB)
[uncategorized] ~13-~13: The official name of this software platform is spelled with a capital “H”.
Context: ...s, variables like github.base_ref and github.head_ref MUST be assigned to environme...
(GITHUB)
🪛 markdownlint-cli2 (0.22.1)
.github/PULL_REQUEST_TEMPLATE.md
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🪛 zizmor (1.26.1)
.github/workflows/ai-pr-reviewer.yml
[warning] 15-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 8-8: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 8-8: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 12-12: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
.github/workflows/ai-issue-triage.yml
[warning] 15-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 8-8: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 8-8: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 12-12: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
.github/workflows/continuous-improvement.yml
[warning] 16-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 9-9: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[error] 10-10: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 13-13: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-6: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🔇 Additional comments (22)
.github/ISSUE_TEMPLATE/bug_report.md (1)
1-34: LGTM!.github/ISSUE_TEMPLATE/feature_request.md (1)
1-20: LGTM!AGENTS.md (1)
1-42: LGTM!CHANGELOG.md (2)
11-14: LGTM!Also applies to: 27-27, 43-50, 58-59
16-17: 🎯 Functional CorrectnessNo changelog change needed. This bullet describes AI automation that was removed, so
Removedis the right section.> Likely an incorrect or invalid review comment.CONTRIBUTING.md (1)
150-162: LGTM!package.json (2)
32-40: LGTM!
42-42: 🎯 Functional CorrectnessVerify both dependency upgrades before merging.
Because
@google/genaiis used by the analysis core/configuration andtsxruns the new automation scripts, validate lockfile resolution and compatibility by runningnpm ci,npm test,npm run lint, andnpm run build.Also applies to: 80-80
.github/PULL_REQUEST_TEMPLATE.md (1)
1-32: 🎯 Functional CorrectnessNo path update needed. The CONTRIBUTING.md link points to an existing PR template path.
> Likely an incorrect or invalid review comment.api/_lib/__tests__/analyze-core.test.ts (1)
69-71: LGTM!api/_lib/limits.ts (1)
30-31: LGTM!api/_lib/mcp-tools.ts (1)
27-27: LGTM!Also applies to: 126-133
api/analyze.ts (1)
196-196: LGTM!src/services/__tests__/analysisService.test.ts (1)
541-547: LGTM!Also applies to: 558-562
vercel.json (1)
30-30: LGTM!scripts/automation/ai-triage.ts (1)
1-45: LGTM!Also applies to: 69-75
scripts/automation/ai-pr-review.ts (1)
1-19: LGTM!Also applies to: 29-42, 54-60
.github/workflows/ai-issue-triage.yml (1)
1-14: LGTM!Also applies to: 23-31
.github/workflows/ai-pr-reviewer.yml (2)
1-14: LGTM!Also applies to: 25-26, 37-39
28-33: Configure GEMINI_API_KEY secret to resolve pipeline failure.The AI PR Reviewer workflow is failing because
GEMINI_API_KEYis not set. The script correctly validates and exits on the missing key, but the secret needs to be added to the repository settings under Settings → Secrets and variables → Actions.Source: Pipeline failures
scripts/automation/analyze-repo.ts (1)
5-46: LGTM!scripts/automation/generate-diagrams.ts (1)
5-46: LGTM!
| @@ -0,0 +1,31 @@ | |||
| ## Description | |||
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use a top-level heading for the template title.
Change ## Description to an H1, or add a preceding # Pull Request heading, to satisfy the repository’s markdownlint configuration.
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/PULL_REQUEST_TEMPLATE.md at line 1, Update the pull request
template’s heading structure by changing the top-level `## Description` heading
to `# Description`, or add a preceding `# Pull Request` heading before it, so
the template satisfies the markdownlint requirement for a top-level heading.
Source: Linters/SAST tools
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin actions to commit SHA and disable credential persistence.
Actions are referenced by mutable tags (@v4), which is a supply chain risk. Additionally, actions/checkout persists the GITHUB_TOKEN in the git config by default.
🔒️ Proposed fix
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@<full-commit-sha>
with:
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v4
+ uses: actions/setup-node@<full-commit-sha>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: Checkout code | |
| uses: actions/checkout@<full-commit-sha> | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js | |
| uses: actions/setup-node@<full-commit-sha> | |
| with: | |
| node-version: 20 |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 15-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-issue-triage.yml around lines 15 - 21, Pin both
actions/checkout and actions/setup-node to immutable commit SHAs instead of the
mutable `@v4` tags, preserving their current major-version behavior. In the
checkout step, set persist-credentials to false under with so the GITHUB_TOKEN
is not stored in git configuration.
Source: Linters/SAST tools
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin actions to commit SHA and disable credential persistence.
Actions are referenced by mutable tags (@v4, @v3), which is a supply chain risk. actions/checkout also persists the GITHUB_TOKEN in the git config by default. The thollander/actions-comment-pull-request@v3 action at line 36 is similarly unpinned.
🔒️ Proposed fix
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@<full-commit-sha>
with:
fetch-depth: 0
+ persist-credentials: false
- name: Set up Node.js
- uses: actions/setup-node@v4
+ uses: actions/setup-node@<full-commit-sha> - name: Post AI Review as Comment
- uses: thollander/actions-comment-pull-request@v3
+ uses: thollander/actions-comment-pull-request@<full-commit-sha>Also applies to: 36-36
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 15-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-pr-reviewer.yml around lines 15 - 23, Pin all workflow
actions, including actions/checkout, actions/setup-node, and
thollander/actions-comment-pull-request, to immutable commit SHAs instead of
mutable version tags. Add persist-credentials: false to the checkout step’s with
block while preserving fetch-depth: 0.
Source: Linters/SAST tools
| on: | ||
| schedule: | ||
| - cron: '0 0 * * *' # Run daily at midnight | ||
| workflow_dispatch: # Allow manual triggers |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Add concurrency control to prevent overlapping runs.
The workflow triggers on both a daily schedule and manual dispatch. Without a concurrency block, overlapping runs can produce conflicting git pushes, where the second push fails because the remote HEAD has advanced. This leaves the workflow in a failed state with partial work.
🛡️ Proposed fix
on:
schedule:
- cron: '0 0 * * *' # Run daily at midnight
workflow_dispatch: # Allow manual triggers
+concurrency:
+ group: continuous-improvement
+ cancel-in-progress: true
+
permissions:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: | |
| schedule: | |
| - cron: '0 0 * * *' # Run daily at midnight | |
| workflow_dispatch: # Allow manual triggers | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' # Run daily at midnight | |
| workflow_dispatch: # Allow manual triggers | |
| concurrency: | |
| group: continuous-improvement | |
| cancel-in-progress: true | |
| permissions: |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 3-6: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/continuous-improvement.yml around lines 3 - 6, Add a
top-level concurrency configuration to the workflow containing a stable group
name, such as the workflow name or a fixed identifier, and configure
cancellation behavior as appropriate to ensure scheduled and manually dispatched
runs cannot overlap. Place it alongside the existing `on` and `jobs` sections.
| permissions: | ||
| contents: write | ||
| pull-requests: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove unnecessary pull-requests: write permission.
This workflow only commits and pushes to the default branch — it does not create, comment on, or modify pull requests. The pull-requests: write permission violates least-privilege and expands the token's attack surface unnecessarily.
🛡️ Proposed fix
permissions:
contents: write
- pull-requests: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: write | |
| pull-requests: write | |
| permissions: | |
| contents: write |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 9-9: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[error] 10-10: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/continuous-improvement.yml around lines 8 - 10, Remove the
unnecessary pull-requests: write permission from the workflow permissions block,
retaining only contents: write for the commit and push operations.
| const diff = execFileSync('gh', ['pr', 'diff', prNumber], { | ||
| encoding: 'utf8', | ||
| }); |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Add timeouts to external calls.
Neither the gh pr diff call nor the Gemini API call specify a timeout. Add timeout to execFileSync and an abort signal to the Gemini call to prevent stalled workflows.
⏱️ Proposed fix
const diff = execFileSync('gh', ['pr', 'diff', prNumber], {
encoding: 'utf8',
+ timeout: 30_000,
}); const response = await ai.models.generateContent({
model: 'gemini-2.5-flash',
contents: prompt,
+ config: { abortSignal: AbortSignal.timeout(60_000) },
});Also applies to: 44-47
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🪛 GitHub Check: SonarCloud Code Analysis
[warning] 24-24: Make sure the "PATH" variable only contains fixed, unwriteable directories.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/ai-pr-review.ts` around lines 24 - 26, Add time limits to
both external operations: configure a finite timeout in the `execFileSync`
invocation for `gh pr diff`, and pass an abort signal with a matching timeout to
the Gemini API request. Update the relevant Gemini call alongside the diff
retrieval so stalled subprocesses or network requests terminate cleanly.
| const reviewFeedback = response.text || 'Failed to generate review.'; | ||
|
|
||
| // Save to artifact for thollander/actions-comment-pull-request@v3 | ||
| writeFileSync('pr_review.md', reviewFeedback); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Avoid posting error fallback as PR comment.
When Gemini returns no text, the script writes "Failed to generate review." to pr_review.md, which gets posted as a PR comment via the downstream workflow. Exit with error instead so the workflow fails visibly without posting an unhelpful comment.
💚 Proposed fix
- const reviewFeedback = response.text || 'Failed to generate review.';
-
- // Save to artifact for thollander/actions-comment-pull-request@v3
- writeFileSync('pr_review.md', reviewFeedback);
+ const reviewFeedback = response.text;
+ if (!reviewFeedback) {
+ console.error('Failed to generate review.');
+ process.exit(1);
+ }
+
+ // Save to artifact for thollander/actions-comment-pull-request@v3
+ writeFileSync('pr_review.md', reviewFeedback);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| const reviewFeedback = response.text || 'Failed to generate review.'; | |
| // Save to artifact for thollander/actions-comment-pull-request@v3 | |
| writeFileSync('pr_review.md', reviewFeedback); | |
| const reviewFeedback = response.text; | |
| if (!reviewFeedback) { | |
| console.error('Failed to generate review.'); | |
| process.exit(1); | |
| } | |
| // Save to artifact for thollander/actions-comment-pull-request@v3 | |
| writeFileSync('pr_review.md', reviewFeedback); |
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/ai-pr-review.ts` around lines 49 - 52, Handle the missing
response text in the review-generation flow before writing the artifact: when
`response.text` is absent, report the failure and exit with a non-zero status
instead of using the `"Failed to generate review."` fallback; only call
`writeFileSync` with valid review content so downstream workflows do not post an
unhelpful comment.
| const response = await ai.models.generateContent({ | ||
| model: 'gemini-2.5-flash', | ||
| contents: prompt, | ||
| }); |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
What is the latest available model identifier for Google Gemini flash models in @google/genai SDK v1.52.0? Is "gemini-2.5-flash" a valid model?
💡 Result:
Yes, gemini-2.5-flash is a valid and stable model identifier [1][2]. In the context of the @google/genai SDK v1.52.0, the latest available Google Gemini Flash model depends on the evolution of the model family as of July 2026. While gemini-2.5-flash is a stable, generally available model [3][2], the Gemini 3.5 Flash model (gemini-3.5-flash) is also available and serves as a more recent, intelligent offering for sustained performance in agentic and coding tasks [4][5][6]. The @google/genai SDK v1.52.0 is capable of using these model identifiers (e.g., gemini-2.5-flash, gemini-3.5-flash) via standard client methods such as generateContent [4][7][6]. Note that official documentation strongly recommends updating to SDK version 2.0.0 or later to access the latest features and handle breaking changes, particularly if you are using the Interactions API [8][6].
Citations:
- 1: https://ai.google.dev/gemini-api/docs/models/gemini-2.5-flash?hl=tr
- 2: https://goo.gle/4efYuVh
- 3: https://blog.google/products-and-platforms/products/gemini/gemini-2-5-model-family-expands/
- 4: https://ai.google.dev/gemini-api/docs/generate-content/whats-new-gemini-3.5
- 5: https://ai.google.dev/gemini-api/docs/changelog
- 6: https://ai.google.dev/gemini-api/docs/interactions/whats-new-gemini-3.5
- 7: https://googleapis.github.io/js-genai/release_docs/
- 8: https://raw.githubusercontent.com/googleapis/js-genai/main/CHANGELOG.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- scripts/automation/ai-triage.ts ---\n'
nl -ba scripts/automation/ai-triage.ts | sed -n '1,140p'
printf '\n--- package.json refs ---\n'
rg -n '"`@google/genai`"|google/genai|gemini-2.5-flash|AbortSignal\.timeout|execFileSync|timeout' package.json scripts/automation/ai-triage.tsRepository: NITISH-R-G/Intelli-Credit-V2
Length of output: 257
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- scripts/automation/ai-triage.ts ---'
nl -ba scripts/automation/ai-triage.ts | sed -n '1,140p'
echo
echo '--- package.json refs ---'
rg -n '"`@google/genai`"|google/genai|gemini-2.5-flash|AbortSignal\.timeout|execFileSync|timeout' package.json scripts/automation/ai-triage.tsRepository: NITISH-R-G/Intelli-Credit-V2
Length of output: 246
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- scripts/automation/ai-triage.ts ---'
awk 'NR>=1 && NR<=160 { printf "%6d %s\n", NR, $0 }' scripts/automation/ai-triage.ts
echo
echo '--- package.json refs ---'
rg -n '"`@google/genai`"|google/genai|gemini-2.5-flash|AbortSignal\.timeout|execFileSync|timeout' package.json scripts/automation/ai-triage.tsRepository: NITISH-R-G/Intelli-Credit-V2
Length of output: 3663
🌐 Web query:
@google/genai v1.52.0 generateContent abortSignal config timeout AbortSignal.timeout
💡 Result:
In the @google/genai SDK, you can cancel an active generateContent request using the AbortSignal interface [1][2]. This is supported by passing an AbortSignal instance through the config object when calling generateContent or generateContentStream [1][3][2]. To use this, create an AbortController and pass its signal to the request configuration [3][4]: const abortController = new AbortController; const abortSignal = abortController.signal; const response = await ai.models.generateContent({ model: 'gemini-2.0-flash', contents: 'Your prompt here', config: { abortSignal: abortSignal, }, }); // To cancel the request: abortController.abort; Important considerations: 1. Client-Side Only: The AbortSignal is a client-side operation [1]. Aborting the request prevents the SDK from processing the response, but it does not send a cancellation signal to the Gemini service itself [1]. You will still be charged for the usage of the operation [1]. 2. Timeouts: You can also use AbortSignal.timeout(ms) for automatic cancellation after a specified duration [2]: config: { abortSignal: AbortSignal.timeout(5000), // Aborts after 5 seconds } 3. HttpOptions: While the SDK also supports httpOptions.timeout, note that there have been reports of inconsistencies regarding how this is applied (e.g., in some versions, it may not correctly send the X-Server-Timeout header to the backend) [5][6]. Using AbortSignal directly as shown above is the standard and recommended way to manage request cancellation within the SDK [2].
Citations:
- 1: https://googleapis.github.io/js-genai/release_docs/interfaces/types.GenerateContentConfig.html
- 2: https://deepwiki.com/googleapis/js-genai/12.3-abort-signals-and-timeouts
- 3: https://github.com/googleapis/js-genai/blob/89400098/sdk-samples/abort_signal.ts
- 4: https://github.com/googleapis/js-genai/blob/eb3ef504/sdk-samples/abort_signal.ts
- 5: Support for
config.httpOptions.timeoutoption is broken formodels.generateContentgoogleapis/js-genai#1277 - 6: X-Server-Timeout header not sent when httpOptions.timeout is set without httpOptions.headers googleapis/js-genai#1489
🌐 Web query:
@google/genai v1.52.0 gemini-2.5-flash valid model identifier official docs
💡 Result:
The valid and official model identifier for Gemini 2.5 Flash is gemini-2.5-flash [1][2]. This identifier is recognized across Google's generative AI platforms, including the Gemini Developer API and the Gemini Enterprise Agent Platform [3][1]. Regarding your technical environment: - The @google/genai SDK (for TypeScript/JavaScript) is the official Google DeepMind SDK for these models [4][3]. - While you mentioned v1.52.0 in your query, please note that as of July 10, 2026, the current production versions of the Google Gen AI SDK are significantly more advanced (e.g., v2.11.0 was published on July 9, 2026) [5]. - The SDK is designed to support Gemini 2.0+ features, including all stable Gemini 2.5 models [4][6]. You can use the identifier directly in your code when initializing or calling model methods, for example: import { GoogleGenAI } from '@google/genai'; const ai = new GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY }); const response = await ai.models.generateContent({ model: 'gemini-2.5-flash', contents: 'Hello, world!', }); Official documentation for this SDK can be found at https://googleapis.github.io/js-genai/ [4][3].
Citations:
- 1: https://googleapis-python-genai-70.mintlify.app/concepts/models
- 2: https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/2-5-flash
- 3: https://github.com/googleapis/js-genai?tab=readme-ov-file
- 4: https://googleapis.github.io/js-genai/release_docs/index.html
- 5: https://www.npmjs.com/package/@google/genai
- 6: https://npmx.dev/package/@google/genai/v/%5E1.48.0
Add request timeouts to both external calls. generateContent() should pass config: { abortSignal: AbortSignal.timeout(30_000) }, and execFileSync() should set timeout: 30_000 so a stalled Gemini request or gh invocation doesn't block the workflow.
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/ai-triage.ts` around lines 47 - 50, Add 30-second timeouts
to both external calls in the AI triage flow: pass config: { abortSignal:
AbortSignal.timeout(30_000) } to ai.models.generateContent(), and set timeout:
30_000 in the options passed to execFileSync() for the gh invocation.
| const labelsText = response.text?.trim() || ''; | ||
| if (labelsText) { | ||
| const labels = labelsText.split(',').map((l) => l.trim()); | ||
| console.info(`Determined labels: ${labels.join(', ')}`); | ||
|
|
||
| // Execute gh CLI to add labels | ||
| // In a real runner `gh` would be authenticated via GITHUB_TOKEN | ||
| // We catch errors just in case `gh` is not set up correctly in the environment | ||
| try { | ||
| execFileSync('gh', ['issue', 'edit', issueNumber, '--add-label', labels.join(',')], { |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Validate AI-generated labels against the allowed list.
The AI response is split into labels but not filtered against the allowed list defined in the prompt. A prompt-injected issue body could cause the model to return arbitrary labels, which would be applied to the issue via gh issue edit --add-label.
🛡️ Proposed fix
- const labels = labelsText.split(',').map((l) => l.trim());
+ const allowedLabels = ['bug', 'enhancement', 'documentation', 'question', 'help wanted', 'good first issue', 'security'];
+ const labels = labelsText
+ .split(',')
+ .map((l) => l.trim().toLowerCase())
+ .filter((l) => allowedLabels.includes(l));📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| const labelsText = response.text?.trim() || ''; | |
| if (labelsText) { | |
| const labels = labelsText.split(',').map((l) => l.trim()); | |
| console.info(`Determined labels: ${labels.join(', ')}`); | |
| // Execute gh CLI to add labels | |
| // In a real runner `gh` would be authenticated via GITHUB_TOKEN | |
| // We catch errors just in case `gh` is not set up correctly in the environment | |
| try { | |
| execFileSync('gh', ['issue', 'edit', issueNumber, '--add-label', labels.join(',')], { | |
| const labelsText = response.text?.trim() || ''; | |
| if (labelsText) { | |
| const allowedLabels = ['bug', 'enhancement', 'documentation', 'question', 'help wanted', 'good first issue', 'security']; | |
| const labels = labelsText | |
| .split(',') | |
| .map((l) => l.trim().toLowerCase()) | |
| .filter((l) => allowedLabels.includes(l)); | |
| console.info(`Determined labels: ${labels.join(', ')}`); | |
| // Execute gh CLI to add labels | |
| // In a real runner `gh` would be authenticated via GITHUB_TOKEN | |
| // We catch errors just in case `gh` is not set up correctly in the environment | |
| try { | |
| execFileSync('gh', ['issue', 'edit', issueNumber, '--add-label', labels.join(',')], { |
🧰 Tools
🪛 ast-grep (0.44.1)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🪛 GitHub Check: SonarCloud Code Analysis
[warning] 61-61: Make sure the "PATH" variable only contains fixed, unwriteable directories.
[warning] 61-61: Make sure that this user-controlled command argument doesn't lead to unwanted behavior.
[warning] 55-55: Change this code to not log user-controlled data.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/ai-triage.ts` around lines 52 - 61, Validate the labels
parsed in the label-processing block against the predefined allowed-label list
before invoking gh. Trim each label, retain only exact allowed matches, and use
the filtered list for logging and gh issue edit; skip the command when no valid
labels remain.
Source: Linters/SAST tools
| let jsonString = response.text || '{}'; | ||
| // Clean up potential markdown formatting | ||
| if (jsonString.startsWith('```json')) { | ||
| jsonString = jsonString.substring(7, jsonString.length - 3).trim(); | ||
| } else if (jsonString.startsWith('```')) { | ||
| jsonString = jsonString.substring(3, jsonString.length - 3).trim(); | ||
| } | ||
|
|
||
| writeFileSync('docs/knowledge-graph.json', jsonString); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Harden JSON fence stripping and validate before writing.
Two issues in the JSON post-processing:
-
Fence stripping bug:
substring(7, length - 3)assumes the closing```is exactly the last 3 characters. If the AI appends a trailing newline (common for LLMs),length - 3removesinstead of``` ``, leaving a stray backtick in the output and producing invalid JSON. -
No validation: The extracted string is written to
docs/knowledge-graph.jsonwithoutJSON.parsevalidation. If the AI returns malformed JSON, downstream consumers will fail silently.
🛡️ Proposed fix
let jsonString = response.text || '{}';
- // Clean up potential markdown formatting
- if (jsonString.startsWith('```json')) {
- jsonString = jsonString.substring(7, jsonString.length - 3).trim();
- } else if (jsonString.startsWith('```')) {
- jsonString = jsonString.substring(3, jsonString.length - 3).trim();
- }
+ // Clean up potential markdown formatting
+ const fenceMatch = jsonString.match(/```(?:json)?\s*\n([\s\S]*?)\n?```/);
+ if (fenceMatch) {
+ jsonString = fenceMatch[1].trim();
+ }
+
+ // Validate JSON before writing
+ try {
+ JSON.parse(jsonString);
+ } catch {
+ console.error('Generated knowledge graph is not valid JSON. Writing raw output for inspection.');
+ }
writeFileSync('docs/knowledge-graph.json', jsonString);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| let jsonString = response.text || '{}'; | |
| // Clean up potential markdown formatting | |
| if (jsonString.startsWith('```json')) { | |
| jsonString = jsonString.substring(7, jsonString.length - 3).trim(); | |
| } else if (jsonString.startsWith('```')) { | |
| jsonString = jsonString.substring(3, jsonString.length - 3).trim(); | |
| } | |
| writeFileSync('docs/knowledge-graph.json', jsonString); | |
| let jsonString = response.text || '{}'; | |
| // Clean up potential markdown formatting | |
| const fenceMatch = jsonString.match(/ |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/generate-knowledge-graph.ts` around lines 37 - 45, The
JSON fence handling in the response post-processing can leave stray backticks
with trailing newlines, and the result is written without validation. Update the
processing around jsonString in the knowledge-graph generation flow to robustly
extract fenced content using a regex that tolerates whitespace and trailing
newlines, then call JSON.parse before writeFileSync to validate it and log a
clear error if parsing fails.
- Add AI PR Reviewer workflow and script using Gemini - Add AI Issue Triage workflow and script - Add continuous improvement workflow and loop - Automate architecture diagram and knowledge graph generation - Add standard GitHub issue and PR templates - Add AI Assistant Guidelines to AGENTS.md Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
1 participant
Implemented comprehensive GitHub Actions workflows and Node.js (
tsx) automation scripts.Key changes:
.github/workflowsfor PR reviews, issue triage, and continuous improvement.@google/genai) to generate reviews, label issues, and create architectural diagrams and knowledge graphs.execFileSyncto adhere to security best practices.AGENTS.mdand updatedpackage.jsonwith automation scripts (npm run fix,npm run ai:triage, etc.).PR created automatically by Jules for task 11110863678598997906 started by @NITISH-R-G