Autonomous Repository Management & AI Automation - #122
Conversation
This commit adds a suite of automated tools and GitHub workflows to transform the repository into a self-maintaining ecosystem: - AI Issue Triager (`scripts/automation/ai-triage.ts`) - AI Pull Request Reviewer (`scripts/automation/ai-pr-review.ts`) - AI Continuous Improvement Loop (`scripts/automation/ai-improve.ts`) - Repository Architecture Intelligence (`scripts/automation/analyze-repo.ts`, `generate-diagrams.ts`, `generate-knowledge-graph.ts`) - GitHub workflows to execute these scripts autonomously - Dependabot configuration for automated dependency updates - `AGENTS.md` file providing comprehensive guidelines for AI assistants and automation tools. All scripts use the Google GenAI SDK and run via `tsx`. Tests, formatting, and linting have been verified. Code review feedback implemented to ensure robust environment setups (e.g. installing Graphviz) and safe string handling in GitHub Actions (reading from filesystem directly instead of via Env vars). Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's GuideIntroduces a suite of AI-driven automation capabilities (issue triage, PR review, continuous improvement, repo analysis and diagram/knowledge graph generation) via new scripts and GitHub Actions, adds supporting dependencies and documentation for agents, and adjusts existing configs/workflows for autonomy and safety while keeping AI-related scripts non-breaking when secrets are absent. Sequence diagram for AI Issue Triage workflowsequenceDiagram
actor IssueAuthor
participant GitHub
participant AI_Triage_Workflow
participant AI_Triage_Script
participant GoogleGenAI
IssueAuthor->>GitHub: Open issue
GitHub-->>AI_Triage_Workflow: issues.opened event
AI_Triage_Workflow->>AI_Triage_Script: npm run ai:triage
AI_Triage_Script->>AI_Triage_Script: fs.readFileSync(GITHUB_EVENT_PATH)
AI_Triage_Script->>GoogleGenAI: models.generateContent
GoogleGenAI-->>AI_Triage_Script: triage response
AI_Triage_Script->>AI_Triage_Script: fs.writeFileSync(triage-comment.txt)
AI_Triage_Workflow->>GitHub: create-or-update-comment@v4 (body-path=triage-comment.txt)
GitHub-->>IssueAuthor: AI triage comment added
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![greptile-apps[bot]](https://avatars.github.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
github-actions
Bot
added
documentation
|
Warning Review limit reached
Next review available in: 51 seconds Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (14)
📝 WalkthroughWalkthroughAdds Gemini-powered issue triage, PR review, continuous improvement, and repository analysis automation through new scripts, npm commands, and GitHub Actions workflows. It also adds operational guidance, daily Dependabot checks, architecture artifact generation, and formatting-only updates. ChangesAI Automation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub
participant Workflow
participant AutomationScript
participant Gemini
participant IssueOrPullRequest
GitHub->>Workflow: trigger issue, pull request, or scheduled run
Workflow->>AutomationScript: execute npm automation command
AutomationScript->>Gemini: submit issue, diff, or repository prompt
Gemini-->>AutomationScript: return generated Markdown
AutomationScript->>IssueOrPullRequest: publish generated report or comment
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.github.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The AI scripts that send issue bodies and full PR diffs to Gemini (
ai-triage.ts,ai-pr-review.ts) don’t currently bound or truncate input size, which could lead to oversized payloads or higher cost; consider enforcing a max length and summarizing or trimming content before sending to the model. - The
repo-analysis.ymlworkflow auto-commits tomainon every push, which can create noisy commit history and potential race conditions with concurrent pushes; consider running only on a schedule or using a separate docs/automation branch to avoid CI modifying the main development branch.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The AI scripts that send issue bodies and full PR diffs to Gemini (`ai-triage.ts`, `ai-pr-review.ts`) don’t currently bound or truncate input size, which could lead to oversized payloads or higher cost; consider enforcing a max length and summarizing or trimming content before sending to the model.
- The `repo-analysis.yml` workflow auto-commits to `main` on every push, which can create noisy commit history and potential race conditions with concurrent pushes; consider running only on a schedule or using a separate docs/automation branch to avoid CI modifying the main development branch.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-continuous-improvement.yml:
- Around line 15-34: Pin every third-party GitHub Action to a full immutable
commit SHA instead of a mutable version tag: update actions/checkout,
actions/setup-node, and peter-evans/create-issue-from-file in
.github/workflows/ai-continuous-improvement.yml lines 15-34; actions/checkout,
actions/setup-node, and thollander/actions-comment-pull-request in
.github/workflows/ai-pr-reviewer.yml lines 14-43; and actions/checkout,
actions/setup-node, and peter-evans/create-or-update-comment in
.github/workflows/ai-triage.yml lines 14-33.
In @.github/workflows/ai-pr-reviewer.yml:
- Around line 28-32: Update the “Get PR diff” step to assign github.base_ref
directly in its env block, then reference that environment variable in the git
fetch and git diff commands with proper shell quoting; remove the inline GitHub
expression from the run script while preserving the existing diff behavior.
In @.github/workflows/repo-analysis.yml:
- Around line 3-7: Add a workflow-level concurrency group to the
repository-analysis workflow, covering both push-to-main and workflow_dispatch
triggers, so only one publishing run executes at a time and concurrent runs are
serialized.
- Around line 44-46: Update the workflow’s commit/push step to check explicitly
whether the staged index has changes before committing. Skip the commit only
when no generated files are staged, remove the `|| echo` failure masking, and
allow genuine `git commit` and `git push` failures to fail the job.
- Around line 16-20: Update the Checkout repository and Setup Node.js steps to
pin actions/checkout and actions/setup-node to their full immutable commit SHAs
instead of mutable version tags, preserving the corresponding version comments
for readability.
- Around line 9-10: Update the workflow’s checkout and permissions configuration
so the repository token is not persisted during npm ci or generator execution:
set checkout’s persist-credentials to false, and scope contents: write only to
the final commit/push step while keeping generation steps read-only.
In `@scripts/automation/ai-improve.ts`:
- Around line 14-18: Update the prompt construction in the automation script to
gather bounded repository evidence—such as relevant code, configuration, test
results, and metadata—and include it before recommendation generation. Clearly
delimit this material as untrusted repository context, preserve the requirement
for exactly three actionable Markdown recommendations, and ensure the generated
report remains the only published output.
In `@scripts/automation/analyze-repo.ts`:
- Around line 15-16: Update the file-list generation in
scripts/automation/analyze-repo.ts at lines 15-16 and
scripts/automation/generate-knowledge-graph.ts at lines 14-15: invoke git
ls-files with NUL-delimited output using -z, then split the result on \0 instead
of newline characters. Preserve the existing filtering of empty entries in both
generators.
In `@scripts/automation/generate-knowledge-graph.ts`:
- Line 18: Update the node mapping in the knowledge-graph generation flow so
extensionless entries from git ls-files receive a file-specific group instead of
the 'folder' fallback. Preserve extension-based groups for files with
extensions, and only classify actual directory nodes as folders if directory
nodes are derived separately.
- Around line 17-20: Update the graph construction in the knowledge-graph
generation workflow so links contains the intended repository relationships
rather than always being an empty array; ensure generated artifacts represent
connected file relationships. If relationship generation is not implemented,
rename the artifact and workflow step to describe a file inventory instead of a
knowledge graph.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 89134b48-c84b-46cd-83d1-3957e13ff7df
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (23)
.github/dependabot.yml.github/workflows/ai-continuous-improvement.yml.github/workflows/ai-pr-reviewer.yml.github/workflows/ai-triage.yml.github/workflows/repo-analysis.ymlAGENTS.mdCHANGELOG.mdCONTRIBUTING.mdapi/_lib/__tests__/analyze-core.test.tsapi/_lib/limits.tsapi/_lib/mcp-tools.tsapi/analyze.tspackage.jsonscripts/automation/ai-improve.tsscripts/automation/ai-pr-review.tsscripts/automation/ai-triage.tsscripts/automation/analyze-repo.tsscripts/automation/generate-diagrams.tsscripts/automation/generate-knowledge-graph.tssrc/App.tsxsrc/services/__tests__/analysisService.test.tssrc/services/analysisService.tsvercel.json
💤 Files with no reviewable changes (2)
- src/services/analysisService.ts
- src/App.tsx
📜 Review details
🧰 Additional context used
📓 Path-based instructions (3)
scripts/automation/**
📄 CodeRabbit inference engine (AGENTS.md)
scripts/automation/**: Automate repetitive tasks by creating scripts inscripts/automation/or GitHub workflows instead of performing repetitive work manually.
AI scripts must exit gracefully with status code0whenGEMINI_API_KEYis missing.
Automation scripts must not useconsole.log; useconsole.info,console.warn, orconsole.errorinstead.
AvoidexecSyncwith concatenated strings; useexecFileSyncwith separate executable and argument arrays.
When invokingnpxthroughexecFileSyncin automated scripts, always include the--yesflag.
AI scripts that provide data to GitHub Actions must write final comments or output directly to dedicated files usingfs.writeFileSync, rather than piping standard output.
Automation scripts must create required parent directories, such asdocs/history/anddocs/architecture/, withfs.mkdirSync(dir, { recursive: true })before writing outputs.
Files:
scripts/automation/generate-diagrams.tsscripts/automation/generate-knowledge-graph.tsscripts/automation/analyze-repo.tsscripts/automation/ai-triage.tsscripts/automation/ai-pr-review.tsscripts/automation/ai-improve.ts
scripts/automation/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
AI automation scripts using the Google GenAI SDK must use the
gemini-2.0-flashmodel for repository tasks, including triage, PR review, and improvement loops.
Files:
scripts/automation/generate-diagrams.tsscripts/automation/generate-knowledge-graph.tsscripts/automation/analyze-repo.tsscripts/automation/ai-triage.tsscripts/automation/ai-pr-review.tsscripts/automation/ai-improve.ts
.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
.github/workflows/*.{yml,yaml}: GitHub Actions event variables must be assigned directly in a step'senvblock and referenced in run scripts, rather than injected inline with${{ }}.
When usingthollander/actions-comment-pull-request@v3, use kebab-case input names such asfile-pathandcomment-tag.
Conditionally skip action steps using file-presence checks such asif: hashFiles('triage-comment.txt') != '', rather than step-scoped environment variables.
Files:
.github/workflows/ai-triage.yml.github/workflows/repo-analysis.yml.github/workflows/ai-continuous-improvement.yml.github/workflows/ai-pr-reviewer.yml
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-21T18:01:50.753Z
Learning: Run `npm run fix` before manually correcting formatting or linting issues.
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-21T18:01:50.753Z
Learning: Before committing changes, run `npm test`, `npm run format`, and `npm run lint`.
🪛 ast-grep (0.44.1)
scripts/automation/generate-diagrams.ts
[warning] 2-2: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/generate-knowledge-graph.ts
[warning] 2-2: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] 22-22: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(graphPath, JSON.stringify(graph, null, 2))
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
scripts/automation/analyze-repo.ts
[warning] 2-2: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] 27-27: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(reportPath, JSON.stringify(stats, null, 2))
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
scripts/automation/ai-triage.ts
[warning] 16-16: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(eventPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
scripts/automation/ai-pr-review.ts
[warning] 12-12: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(diffFile, 'utf-8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
🪛 GitHub Check: SonarCloud Code Analysis
scripts/automation/generate-diagrams.ts
[warning] 17-17: Make sure the "PATH" variable only contains fixed, unwriteable directories.
scripts/automation/generate-knowledge-graph.ts
[warning] 14-14: Make sure the "PATH" variable only contains fixed, unwriteable directories.
scripts/automation/analyze-repo.ts
[warning] 15-15: Make sure the "PATH" variable only contains fixed, unwriteable directories.
scripts/automation/ai-triage.ts
[warning] 60-60: Prefer top-level await over an async function triage call.
[warning] 18-18: Prefer using an optional chain expression instead, as it's more concise and easier to read.
.github/workflows/ai-triage.yml
[failure] 33-33: Use full commit SHA hash for this dependency.
[warning] 24-24: Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
.github/workflows/repo-analysis.yml
[warning] 26-26: Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
.github/workflows/ai-continuous-improvement.yml
[failure] 34-34: Use full commit SHA hash for this dependency.
[warning] 25-25: Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
scripts/automation/ai-pr-review.ts
[warning] 48-48: Prefer top-level await over an async function reviewPR call.
scripts/automation/ai-improve.ts
[warning] 37-37: Prefer top-level await over an async function improveRepo call.
.github/workflows/ai-pr-reviewer.yml
[warning] 26-26: Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
[failure] 43-43: Use full commit SHA hash for this dependency.
🪛 LanguageTool
AGENTS.md
[style] ~19-~19: Try using a synonym here to strengthen your wording.
Context: ...pr-review.ts`) should write their final comment or output directly to a dedicated file ...
(COMMENT_REMARK)
🪛 zizmor (1.26.1)
.github/workflows/ai-triage.yml
[warning] 14-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 8-8: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 33-33: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 8-8: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 11-11: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
[info] 33-33: action functionality is already included by the runner (superfluous-actions): use gh pr comment or gh issue comment in a script step
(superfluous-actions)
.github/workflows/repo-analysis.yml
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 10-10: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 13-13: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-7: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
.github/workflows/ai-continuous-improvement.yml
[warning] 15-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 9-9: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 34-34: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 12-12: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-6: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
.github/workflows/ai-pr-reviewer.yml
[warning] 14-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 8-8: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[error] 31-31: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 32-32: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 43-43: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 8-8: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 11-11: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🔇 Additional comments (15)
AGENTS.md (1)
1-29: LGTM!.github/dependabot.yml (1)
6-8: LGTM!Also applies to: 11-13
CHANGELOG.md (1)
11-17: LGTM!Also applies to: 27-27, 43-50, 59-59
CONTRIBUTING.md (1)
150-162: LGTM!api/_lib/__tests__/analyze-core.test.ts (1)
69-71: LGTM!api/_lib/limits.ts (1)
30-31: LGTM!api/_lib/mcp-tools.ts (1)
27-27: LGTM!Also applies to: 126-133
api/analyze.ts (1)
196-196: LGTM!src/services/__tests__/analysisService.test.ts (1)
541-547: LGTM!Also applies to: 558-562
vercel.json (1)
30-30: LGTM!package.json (1)
32-39: LGTM!Also applies to: 78-78
scripts/automation/ai-pr-review.ts (1)
1-48: LGTM!scripts/automation/ai-triage.ts (1)
1-60: LGTM!scripts/automation/analyze-repo.ts (1)
1-14: LGTM!Also applies to: 17-36
scripts/automation/generate-diagrams.ts (1)
1-29: LGTM!
| - name: Get PR diff | ||
| id: pr_diff | ||
| run: | | ||
| git fetch origin ${{ github.base_ref }} | ||
| git diff origin/${{ github.base_ref }}...HEAD > pr-diff.txt |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Move the base ref into the step environment.
The inline expression is rendered into shell source, so a metacharacter-bearing branch name can alter the commands. Bind it once and quote its uses.
Proposed fix
- name: Get PR diff
id: pr_diff
+ env:
+ BASE_REF: ${{ github.base_ref }}
run: |
- git fetch origin ${{ github.base_ref }}
- git diff origin/${{ github.base_ref }}...HEAD > pr-diff.txt
+ git fetch origin "$BASE_REF"
+ git diff "origin/$BASE_REF...HEAD" > pr-diff.txtAs per coding guidelines, GitHub Actions event variables must be assigned directly in a step's env block and referenced in run scripts, rather than injected inline with ${{ }}.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Get PR diff | |
| id: pr_diff | |
| run: | | |
| git fetch origin ${{ github.base_ref }} | |
| git diff origin/${{ github.base_ref }}...HEAD > pr-diff.txt | |
| - name: Get PR diff | |
| id: pr_diff | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| git fetch origin "$BASE_REF" | |
| git diff "origin/$BASE_REF...HEAD" > pr-diff.txt |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 31-31: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 32-32: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-pr-reviewer.yml around lines 28 - 32, Update the “Get
PR diff” step to assign github.base_ref directly in its env block, then
reference that environment variable in the git fetch and git diff commands with
proper shell quoting; remove the inline GitHub expression from the run script
while preserving the existing diff behavior.
Sources: Coding guidelines, Linters/SAST tools
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| workflow_dispatch: |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Serialize repository-analysis runs before pushing.
A push to main and a manual dispatch can run concurrently, causing both jobs to generate from the same revision and race at git push. Add a workflow concurrency group so publishing runs are serialized.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 3-7: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/repo-analysis.yml around lines 3 - 7, Add a workflow-level
concurrency group to the repository-analysis workflow, covering both
push-to-main and workflow_dispatch triggers, so only one publishing run executes
at a time and concurrent runs are serialized.
Source: Linters/SAST tools
| permissions: | ||
| contents: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/repo-analysis.yml"
wc -l "$file"
sed -n '1,220p' "$file"Repository: NITISH-R-G/Intelli-Credit-V2
Length of output: 1348
Limit write access to the publish step.
contents: write plus the default actions/checkout credential persistence makes the repo token available to npm ci and the generators. Set persist-credentials: false on checkout and pass write access only to the final commit/push step, or split generation and publishing into separate jobs.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 10-10: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/repo-analysis.yml around lines 9 - 10, Update the
workflow’s checkout and permissions configuration so the repository token is not
persisted during npm ci or generator execution: set checkout’s
persist-credentials to false, and scope contents: write only to the final
commit/push step while keeping generation steps read-only.
Source: Linters/SAST tools
| git add docs/architecture/ | ||
| git commit -m "docs: auto-generate repository architecture and knowledge graph" || echo "No changes to commit" | ||
| git push |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not hide commit failures behind || echo.
git commit returns non-zero for real failures as well as for an empty index. The current command masks errors and can let the workflow appear successful without publishing generated files. Check whether the index is clean explicitly, then let genuine commit and push failures fail the job.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/repo-analysis.yml around lines 44 - 46, Update the
workflow’s commit/push step to check explicitly whether the staged index has
changes before committing. Skip the commit only when no generated files are
staged, remove the `|| echo` failure masking, and allow genuine `git commit` and
`git push` failures to fail the job.
| const prompt = `You are an autonomous AI Continuous Improvement agent for an open-source repository. | ||
| Your task is to suggest repository improvements. | ||
| Think about potential refactoring, test additions, documentation enhancements, automation improvements, security hardening, etc. | ||
|
|
||
| Generate a Markdown report detailing 3 actionable recommendations for improving this repository. Include code snippets or configuration examples where appropriate. Output only the Markdown content.`; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Provide repository context before generating recommendations.
This prompt supplies no code, configuration, test results, or repository metadata, so the daily workflow will create generic recommendations rather than repository-specific improvements. Gather bounded repository evidence and delimit it as untrusted context in the prompt before publishing an issue.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/ai-improve.ts` around lines 14 - 18, Update the prompt
construction in the automation script to gather bounded repository evidence—such
as relevant code, configuration, test results, and metadata—and include it
before recommendation generation. Clearly delimit this material as untrusted
repository context, preserve the requirement for exactly three actionable
Markdown recommendations, and ensure the generated report remains the only
published output.
| const allFilesOutput = execFileSync('git', ['ls-files'], { encoding: 'utf-8' }); | ||
| const files = allFilesOutput.split('\n').filter(Boolean); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use NUL-delimited Git output in both generators.
Both scripts incorrectly assume tracked filenames cannot contain newlines, causing incorrect statistics and corrupted graph node IDs.
scripts/automation/analyze-repo.ts#L15-L16: invokegit ls-files -zand split on\0.scripts/automation/generate-knowledge-graph.ts#L14-L15: invokegit ls-files -zand split on\0.
🧰 Tools
🪛 GitHub Check: SonarCloud Code Analysis
[warning] 15-15: Make sure the "PATH" variable only contains fixed, unwriteable directories.
📍 Affects 2 files
scripts/automation/analyze-repo.ts#L15-L16(this comment)scripts/automation/generate-knowledge-graph.ts#L14-L15
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/analyze-repo.ts` around lines 15 - 16, Update the
file-list generation in scripts/automation/analyze-repo.ts at lines 15-16 and
scripts/automation/generate-knowledge-graph.ts at lines 14-15: invoke git
ls-files with NUL-delimited output using -z, then split the result on \0 instead
of newline characters. Preserve the existing filtering of empty entries in both
generators.
| const graph = { | ||
| nodes: files.map((file) => ({ id: file, group: path.extname(file) || 'folder' })), | ||
| links: [], // Advanced link generation logic could be added here | ||
| }; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Generate relationships before calling this a knowledge graph.
links is permanently empty, so every generated artifact contains only disconnected file nodes. This does not satisfy the stated knowledge-graph objective; either generate the intended repository relationships or rename the artifact and workflow step to describe a file inventory.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/generate-knowledge-graph.ts` around lines 17 - 20, Update
the graph construction in the knowledge-graph generation workflow so links
contains the intended repository relationships rather than always being an empty
array; ensure generated artifacts represent connected file relationships. If
relationship generation is not implemented, rename the artifact and workflow
step to describe a file inventory instead of a knowledge graph.
| const files = allFilesOutput.split('\n').filter(Boolean); | ||
|
|
||
| const graph = { | ||
| nodes: files.map((file) => ({ id: file, group: path.extname(file) || 'folder' })), |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not classify extensionless files as folders.
git ls-files returns tracked files only, so files such as LICENSE or Dockerfile are incorrectly assigned group: 'folder'. Use a file-specific fallback or derive directory nodes separately.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/generate-knowledge-graph.ts` at line 18, Update the node
mapping in the knowledge-graph generation flow so extensionless entries from git
ls-files receive a file-specific group instead of the 'folder' fallback.
Preserve extension-based groups for files with extensions, and only classify
actual directory nodes as folders if directory nodes are derived separately.
…ypeScript code - Pinned all GitHub Actions to exact commit SHAs in workflow files to meet the "C Security Rating on New Code" requirements. - Fixed TypeScript unawaited Promise warnings in automation scripts by explicitly marking top-level function calls with `void` (e.g., `void triage();`). - Fixed missing `type="button"` attribute on `<button>` elements in React components (`src/App.tsx`). - Added optional chaining to prevent potential null dereference exceptions in `analysisService.test.ts`. Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
- Pinned remaining GitHub Actions (in `ci-cd-automation.yml`) to exact commit SHAs to address SonarCloud's "Security Rating on New Code" Quality Gate rule. - Explicitly typed the return value of `execFileSync` to `string` in `analyze-repo.ts` and `generate-knowledge-graph.ts` to fix SonarCloud TypeScript warnings where the union type `Buffer | string` was inferred. Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
Removes `void` cast from synchronous functions to satisfy SonarCloud vulnerabilities, and adds `as string` casts to `execFileSync` to avoid `Buffer | string` return types where only strings are generated. Tests, lint and types check all pass. Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
1 participant
Implementation of the user's objective to make the repository completely autonomous, self-healing, and self-documenting. Includes AI triaging, AI PR reviews, an AI-powered improvement loop, dependency tracking, automated repo stats generation, and automated architecture diagram generation.
PR created automatically by Jules for task 8966888486129833830 started by @NITISH-R-G
Summary by Sourcery
Introduce AI-driven automation and repository analysis workflows to make the project more autonomous while tightening contributor and agent guidelines.
New Features:
Enhancements:
Build:
CI:
Documentation:
Tests:
Chores: