feat: Add comprehensive AI repository automation workflows - #126
feat: Add comprehensive AI repository automation workflows#126NITISH-R-G wants to merge 1 commit into
Conversation
…s improvement loops - Implements an AI Issue Triage agent using Gemini (`scripts/automation/ai-issue-triage.ts`) to auto-reply to issues. - Implements an AI PR Reviewer agent using Gemini (`scripts/automation/ai-pr-reviewer.ts`) to review PR diffs and provide suggestions. - Implements an AI Continuous Improvement script (`scripts/automation/ai-continuous-improvement.ts`) to regularly review codebase health and open issues. - Implements knowledge graph and diagram generation scripts using `madge`. - Adds `AGENTS.md` containing core guidelines for repository automation. - Updates GitHub workflows (`ai-issue-triage.yml`, `ai-pr-reviewer.yml`, `ai-continuous-improvement.yml`) to schedule these scripts. - Updates existing workflow files to utilize explicitly pinned commit SHAs for better security posture (`actions/checkout`, `actions/setup-node`). - Fixes minor React warnings (`type="button"`) in existing UI components. - Adds `tsx`, `madge`, `cross-env` dependencies in `package.json`. Co-authored-by: NITISH-R-G <225521762+NITISH-R-G@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![greptile-apps[bot]](https://avatars.github.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
github-actions
Bot
added
documentation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis change adds Gemini-powered issue triage, pull request review, continuous improvement, and architecture-generation automation. It also pins selected GitHub Actions and applies explicit button types plus formatting-only updates across application, API, documentation, and configuration files. ChangesAI Automation
Repository Cleanup
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub
participant Actions
participant Automation
participant Gemini
participant CommentOrReport
GitHub->>Actions: Trigger issue, pull request, or scheduled workflow
Actions->>Automation: Run npm automation command
Automation->>Gemini: Send issue, PR diff, or repository context
Gemini-->>Automation: Return generated markdown or report
Automation->>CommentOrReport: Write comment or improvement report
Actions->>GitHub: Publish comment, issue, or repository updates
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![sourcery-ai[bot]](https://avatars.github.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @NITISH-R-G, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-continuous-improvement.yml:
- Around line 3-6: Add workflow-level concurrency controls to the event triggers
in .github/workflows/ai-continuous-improvement.yml lines 3-6, using a shared
group and cancel-in-progress: false so runs queue; add issue-number-based
concurrency to .github/workflows/ai-issue-triage.yml lines 3-5 with
cancel-in-progress enabled; and add pull-request-number-based concurrency to
.github/workflows/ai-pr-reviewer.yml lines 3-5 with cancel-in-progress enabled.
- Around line 42-48: Update the “Commit Updated Architecture Docs” workflow step
to handle the no-changes-to-commit case explicitly while allowing actual git
commit and push errors to fail the job. Remove the unconditional failure
suppression from the git commit and git push commands, and only skip committing
when the staged documentation changes are absent.
In @.github/workflows/ai-issue-triage.yml:
- Around line 14-15: Add with.persist-credentials set to false on each checkout
step in .github/workflows/ai-issue-triage.yml (lines 14-15),
.github/workflows/ai-pr-reviewer.yml (lines 14-17),
.github/workflows/ci-cd-automation.yml (line 18), .github/workflows/codeql.yml
(lines 28-29), and .github/workflows/dependency-review.yml (lines 11-12). Do not
change the checkout configuration in the continuous-improvement workflow because
it requires Git push credentials.
- Around line 31-36: Update the Post comment step in the workflow so issue edits
do not create duplicate triage comments: either restrict the workflow trigger to
opened issues or locate the bot’s existing comment and provide its ID via
comment-id to peter-evans/create-or-update-comment. Preserve posting behavior
for newly opened issues.
In @.github/workflows/ai-pr-reviewer.yml:
- Around line 27-28: Update the “Generate PR Diff” workflow step to pass
github.base_ref through the step environment and reference the environment
variable in the git diff command instead of interpolating the context value
directly into shell source; preserve the existing origin base-ref comparison and
pr-diff.txt output.
- Around line 30-40: Update the workflow around “Run AI PR Review” and “Comment
on PR” to support fork-originated pull requests by moving secret- and
write-token-dependent work to an approved workflow_run path that generates
pr-comment.txt and posts the comment. If fork support is not intended,
explicitly document and enforce that only same-repository pull requests are
supported instead.
In `@get_sha.sh`:
- Line 2: Update the get_sha.sh command to safely quote both repository and tag
arguments, query both the direct tag ref and its peeled ^{} ref, and select the
peeled SHA when available while falling back to the direct SHA for lightweight
tags.
In `@scripts/automation/ai-issue-triage.ts`:
- Around line 34-48: Separate instructions from untrusted repository data in all
three prompt builders: scripts/automation/ai-issue-triage.ts lines 34-48 must
isolate issueAuthor, issueTitle, and issueBody;
scripts/automation/ai-pr-reviewer.ts lines 40-58 must isolate pull request
title/body and diff contents; and
scripts/automation/ai-continuous-improvement.ts lines 36-59 must isolate commit
log and manifest contents. Clearly label embedded values as untrusted data,
quote or delimit them, and instruct Gemini not to follow directives contained
within them while preserving the intended generated outputs.
In `@scripts/automation/generate-knowledge-graph.ts`:
- Around line 16-18: Update the madge invocation in the knowledge-graph
generation flow to prevent unbounded execution and output truncation: configure
execFileSync with a verified timeout and an explicit maxBuffer sized for large
graphs, or stream the subprocess output directly to the destination file.
Preserve UTF-8 output handling and existing madge arguments.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6d9b9211-acf8-448c-a9d9-25e7e77a0077
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (27)
.github/workflows/ai-continuous-improvement.yml.github/workflows/ai-issue-triage.yml.github/workflows/ai-pr-reviewer.yml.github/workflows/ci-cd-automation.yml.github/workflows/codeql.yml.github/workflows/dependency-review.ymlAGENTS.mdCHANGELOG.mdCONTRIBUTING.mdapi/_lib/__tests__/analyze-core.test.tsapi/_lib/limits.tsapi/_lib/mcp-tools.tsapi/analyze.tsget_sha.shpackage.jsonscripts/automation/ai-continuous-improvement.tsscripts/automation/ai-issue-triage.tsscripts/automation/ai-pr-reviewer.tsscripts/automation/generate-diagrams.tsscripts/automation/generate-knowledge-graph.tssrc/App.tsxsrc/components/CAMReport.tsxsrc/components/DataIngestion.tsxsrc/components/ErrorDisplay.tsxsrc/services/__tests__/analysisService.test.tssrc/services/analysisService.tsvercel.json
💤 Files with no reviewable changes (1)
- src/services/analysisService.ts
📜 Review details
⚠️ CI failures not shown inline (4)
GitHub Actions: CI/CD Automation / build-and-test (20.x): feat: Add comprehensive AI repository automation workflows
Conclusion: failure
##[group]Run npm run typecheck
�[36;1mnpm run typecheck�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> intelli-credit@1.0.0 typecheck
> tsc --noEmit
##[error]The operation was canceled.
GitHub Actions: CI/CD Automation / build-and-test (22.x): feat: Add comprehensive AI repository automation workflows
Conclusion: failure
##[group]Run npm audit --audit-level=high
�[36;1mnpm audit --audit-level=high�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
# npm audit report
body-parser <1.20.6
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement - https://github.com/advisories/GHSA-v422-hmwv-36x6
fix available via `npm audit fix`
node_modules/body-parser
brace-expansion <=5.0.7
Severity: high
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
fix available via `npm audit fix`
node_modules/@eslint/config-array/node_modules/brace-expansion
node_modules/@eslint/eslintrc/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/eslint-plugin-react/node_modules/brace-expansion
node_modules/eslint/node_modules/brace-expansion
dompurify <=3.4.11
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. - https://github.com/advisories/GHSA-c2j3-45gr-mqc4
fix available via `npm audit fix`
node_modules/dompurify
js-yaml 4.0.0 - 4.2.0
Severity: high
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
fix available via `npm audit fix`
node_modules/js-yaml
protobufjs 7.5.0 - 7.6.4
Severity: moderate
protobufjs: Denial of Service via infinite loop in .proto option parsing - https://github.com/advisories/GHSA-j3f2-48v5-ccww
fix available via `npm audit fix`
node_modules/protobufjs
5 vulnerabilities (2 low, 1 moderate, 2 high)
To address all issues, run:
npm audit fix
##[error]Process completed with exit code 1.
GitHub Actions: CI/CD Automation / 1_build-and-test (22.x).txt: feat: Add comprehensive AI repository automation workflows
Conclusion: failure
##[group]Run npm audit --audit-level=high
�[36;1mnpm audit --audit-level=high�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
# npm audit report
body-parser <1.20.6
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement - https://github.com/advisories/GHSA-v422-hmwv-36x6
fix available via `npm audit fix`
node_modules/body-parser
brace-expansion <=5.0.7
Severity: high
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
fix available via `npm audit fix`
node_modules/@eslint/config-array/node_modules/brace-expansion
node_modules/@eslint/eslintrc/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/eslint-plugin-react/node_modules/brace-expansion
node_modules/eslint/node_modules/brace-expansion
dompurify <=3.4.11
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. - https://github.com/advisories/GHSA-c2j3-45gr-mqc4
fix available via `npm audit fix`
node_modules/dompurify
js-yaml 4.0.0 - 4.2.0
Severity: high
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
fix available via `npm audit fix`
node_modules/js-yaml
protobufjs 7.5.0 - 7.6.4
Severity: moderate
protobufjs: Denial of Service via infinite loop in .proto option parsing - https://github.com/advisories/GHSA-j3f2-48v5-ccww
fix available via `npm audit fix`
node_modules/protobufjs
5 vulnerabilities (2 low, 1 moderate, 2 high)
To address all issues, run:
npm audit fix
##[error]Process completed with exit code 1.
GitHub Actions: CI/CD Automation / 0_build-and-test (20.x).txt: feat: Add comprehensive AI repository automation workflows
Conclusion: failure
##[group]Run npm run typecheck
�[36;1mnpm run typecheck�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
> intelli-credit@1.0.0 typecheck
> tsc --noEmit
##[error]The operation was canceled.
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{js,mjs,cjs,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{js,mjs,cjs,ts,tsx}: When running automation scripts inside Node.js usingexecFileSync, explicitly cast the response to a string and avoid command concatenation that could enable command injection.
Do not useconsole.loganywhere in the codebase; useconsole.info,console.warn, orconsole.errorinstead.
Files:
api/_lib/__tests__/analyze-core.test.tsapi/_lib/mcp-tools.tsapi/analyze.tsscripts/automation/generate-knowledge-graph.tsapi/_lib/limits.tsscripts/automation/generate-diagrams.tssrc/components/ErrorDisplay.tsxsrc/components/DataIngestion.tsxsrc/components/CAMReport.tsxsrc/services/__tests__/analysisService.test.tsscripts/automation/ai-issue-triage.tsscripts/automation/ai-pr-reviewer.tsscripts/automation/ai-continuous-improvement.tssrc/App.tsx
scripts/automation/**/*.{js,mjs,cjs,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
All AI automation scripts in
scripts/automation/must gracefully exit with status code0whenGEMINI_API_KEYis absent, so workflows do not fail for external open-source forks.
Files:
scripts/automation/generate-knowledge-graph.tsscripts/automation/generate-diagrams.tsscripts/automation/ai-issue-triage.tsscripts/automation/ai-pr-reviewer.tsscripts/automation/ai-continuous-improvement.ts
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-25T18:05:58.915Z
Learning: Automate repetitive tasks wherever possible.
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-25T18:05:58.915Z
Learning: When performing repository tasks, always attempt to run `npm run fix`, which executes `npm run lint:fix` and `npm run format`, to let the repository self-heal.
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-25T18:05:58.915Z
Learning: Before concluding any code modification step, validate changes by running `npm test`, `npm run format`, and `npm run lint`.
Learnt from: CR
Repo: NITISH-R-G/Intelli-Credit-V2
Timestamp: 2026-07-25T18:05:58.915Z
Learning: Use `docs/architecture/knowledge-graph.json` and its diagrams to understand and navigate the application.
🪛 ast-grep (0.44.1)
scripts/automation/generate-knowledge-graph.ts
[warning] 19-19: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(outPath, output, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1-1: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/generate-diagrams.ts
[warning] 1-1: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
scripts/automation/ai-issue-triage.ts
[warning] 21-21: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(eventPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
scripts/automation/ai-pr-reviewer.ts
[warning] 21-21: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(diffPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 30-30: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(eventPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
scripts/automation/ai-continuous-improvement.ts
[warning] 2-2: Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFileSync } from 'node:child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] 75-75: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(path.join(docsDir, improvement_${dateStr}.md), report, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
🪛 GitHub Check: SonarCloud Code Analysis
scripts/automation/generate-knowledge-graph.ts
[warning] 16-16: Make sure the "PATH" variable only contains fixed, unwriteable directories.
scripts/automation/generate-diagrams.ts
[warning] 16-16: Make sure the "PATH" variable only contains fixed, unwriteable directories.
.github/workflows/ai-pr-reviewer.yml
[warning] 25-25: Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
scripts/automation/ai-issue-triage.ts
[warning] 68-68: Prefer top-level await over an async function triage call.
[warning] 2-2: Remove this unused import of 'path'.
scripts/automation/ai-pr-reviewer.ts
[warning] 2-2: Remove this unused import of 'path'.
[warning] 78-78: Prefer top-level await over an async function reviewPR call.
.github/workflows/ai-continuous-improvement.yml
[warning] 27-27: Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
.github/workflows/ai-issue-triage.yml
[warning] 23-23: Omitting "--ignore-scripts" allows lifecycle scripts to run during package installation.
scripts/automation/ai-continuous-improvement.ts
[warning] 88-88: Prefer top-level await over an async function runImprovementLoop call.
[warning] 22-22: Make sure the "PATH" variable only contains fixed, unwriteable directories.
🪛 Shellcheck (0.11.0)
get_sha.sh
[info] 2-2: Double quote to prevent globbing and word splitting.
(SC2086)
[info] 2-2: Double quote to prevent globbing and word splitting.
(SC2086)
🪛 zizmor (1.26.1)
.github/workflows/dependency-review.yml
[warning] 11-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/codeql.yml
[warning] 28-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/ci-cd-automation.yml
[warning] 18-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/ai-pr-reviewer.yml
[warning] 14-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 1-42: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[error] 28-28: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 11-11: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 8-8: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
.github/workflows/ai-continuous-improvement.yml
[warning] 16-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 1-57: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 12-12: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 9-9: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-6: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
.github/workflows/ai-issue-triage.yml
[warning] 14-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 1-37: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 11-11: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 8-8: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
[info] 33-33: action functionality is already included by the runner (superfluous-actions): use gh pr comment or gh issue comment in a script step
(superfluous-actions)
🔇 Additional comments (16)
src/App.tsx (1)
264-264: LGTM!src/components/CAMReport.tsx (1)
24-24: LGTM!Also applies to: 31-31
src/components/DataIngestion.tsx (1)
59-59: LGTM!Also applies to: 135-135
src/components/ErrorDisplay.tsx (1)
48-48: LGTM!Also applies to: 70-70
CHANGELOG.md (1)
11-17: LGTM!Also applies to: 27-27, 43-50, 59-59
CONTRIBUTING.md (1)
150-162: LGTM!api/_lib/__tests__/analyze-core.test.ts (1)
69-71: LGTM!api/_lib/limits.ts (1)
31-31: LGTM!api/_lib/mcp-tools.ts (1)
27-27: LGTM!Also applies to: 126-133
api/analyze.ts (1)
196-196: LGTM!src/services/__tests__/analysisService.test.ts (1)
541-547: LGTM!Also applies to: 558-562
vercel.json (1)
30-30: LGTM!AGENTS.md (1)
1-19: LGTM!package.json (1)
32-39: LGTM!Also applies to: 69-82
scripts/automation/generate-diagrams.ts (1)
16-19: 📐 Maintainability & Code QualityNo change needed here.
execFileSyncalready returns an empty string withencoding: 'utf-8', andstdio: 'inherit'streams madge output directly to the parent without needing command concatenation..github/workflows/ai-continuous-improvement.yml (1)
11-14: 🔒 Security & PrivacyVerify that
pull-requests: writeis required.The visible workflow only creates issues and pushes documentation. If
npm run ai:improvedoes not update pull requests, remove this permission and retain least-privilege access.Source: Linters/SAST tools
| on: | ||
| schedule: | ||
| - cron: '0 0 * * *' | ||
| workflow_dispatch: |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Add concurrency controls to all event-driven automation workflows.
Without workflow-level concurrency, overlapping runs can publish stale AI results, duplicate comments, and race with repository updates.
.github/workflows/ai-continuous-improvement.yml#L3-L6: add a concurrency group and queue runs withcancel-in-progress: false..github/workflows/ai-issue-triage.yml#L3-L5: group by issue number and cancel superseded edits..github/workflows/ai-pr-reviewer.yml#L3-L5: group by pull-request number and cancel superseded reviews.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 3-6: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
📍 Affects 3 files
.github/workflows/ai-continuous-improvement.yml#L3-L6(this comment).github/workflows/ai-issue-triage.yml#L3-L5.github/workflows/ai-pr-reviewer.yml#L3-L5
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-continuous-improvement.yml around lines 3 - 6, Add
workflow-level concurrency controls to the event triggers in
.github/workflows/ai-continuous-improvement.yml lines 3-6, using a shared group
and cancel-in-progress: false so runs queue; add issue-number-based concurrency
to .github/workflows/ai-issue-triage.yml lines 3-5 with cancel-in-progress
enabled; and add pull-request-number-based concurrency to
.github/workflows/ai-pr-reviewer.yml lines 3-5 with cancel-in-progress enabled.
Source: Linters/SAST tools
| - name: Commit Updated Architecture Docs | ||
| run: | | ||
| git config --global user.name "github-actions[bot]" | ||
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | ||
| git add docs/architecture/ docs/history/ | ||
| git commit -m "docs: auto-generate architecture diagrams and knowledge graph" || true | ||
| git push || true |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not suppress commit and push failures.
Lines [47]-[48] allow the workflow to succeed even when generated documentation is not committed or pushed. Handle the no-change case explicitly, but let actual commit and push failures fail the job.
Proposed fix
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]`@users.noreply.github.com`"
git add docs/architecture/ docs/history/
- git commit -m "docs: auto-generate architecture diagrams and knowledge graph" || true
- git push || true
+ if ! git diff --cached --quiet; then
+ git commit -m "docs: auto-generate architecture diagrams and knowledge graph"
+ git push
+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Commit Updated Architecture Docs | |
| run: | | |
| git config --global user.name "github-actions[bot]" | |
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | |
| git add docs/architecture/ docs/history/ | |
| git commit -m "docs: auto-generate architecture diagrams and knowledge graph" || true | |
| git push || true | |
| - name: Commit Updated Architecture Docs | |
| run: | | |
| git config --global user.name "github-actions[bot]" | |
| git config --global user.email "github-actions[bot]`@users.noreply.github.com`" | |
| git add docs/architecture/ docs/history/ | |
| if ! git diff --cached --quiet; then | |
| git commit -m "docs: auto-generate architecture diagrams and knowledge graph" | |
| git push | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-continuous-improvement.yml around lines 42 - 48, Update
the “Commit Updated Architecture Docs” workflow step to handle the
no-changes-to-commit case explicitly while allowing actual git commit and push
errors to fail the job. Remove the unconditional failure suppression from the
git commit and git push commands, and only skip committing when the staged
documentation changes are absent.
| - name: Checkout repository | ||
| uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Opt out of persisted checkout credentials where no Git write is needed.
actions/checkout persists the token by default; the affected workflows do not visibly need authenticated Git commands after checkout. The continuous-improvement workflow is excluded because it performs git push. (github.com)
.github/workflows/ai-issue-triage.yml#L14-L15: addwith: persist-credentials: false..github/workflows/ai-pr-reviewer.yml#L14-L17: addpersist-credentials: falseto the checkout step..github/workflows/ci-cd-automation.yml#L18-L18: add awithblock containingpersist-credentials: false..github/workflows/codeql.yml#L28-L29: addpersist-credentials: false..github/workflows/dependency-review.yml#L11-L12: addpersist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 14-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 5 files
.github/workflows/ai-issue-triage.yml#L14-L15(this comment).github/workflows/ai-pr-reviewer.yml#L14-L17.github/workflows/ci-cd-automation.yml#L18-L18.github/workflows/codeql.yml#L28-L29.github/workflows/dependency-review.yml#L11-L12
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-issue-triage.yml around lines 14 - 15, Add
with.persist-credentials set to false on each checkout step in
.github/workflows/ai-issue-triage.yml (lines 14-15),
.github/workflows/ai-pr-reviewer.yml (lines 14-17),
.github/workflows/ci-cd-automation.yml (line 18), .github/workflows/codeql.yml
(lines 28-29), and .github/workflows/dependency-review.yml (lines 11-12). Do not
change the checkout configuration in the continuous-improvement workflow because
it requires Git push credentials.
Source: Linters/SAST tools
| - name: Post comment | ||
| if: hashFiles('triage-comment.txt') != '' | ||
| uses: peter-evans/create-or-update-comment@6b65298e27703bd026057331221d8bec87659ee3 | ||
| with: | ||
| issue-number: ${{ github.event.issue.number }} | ||
| body-path: triage-comment.txt |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows | sed -n '1,100p'
echo
echo "== target workflow =="
cat -n .github/workflows/ai-issue-triage.yml
echo
echo "== related search =="
rg -n "create-or-update-comment|comment-id|triage-comment|post comment|opened|edited" .github/workflows .github 2>/dev/null | sed -n '1,200p'
echo
echo "== workflow context around ai-issue-triage =="
cat -n .github/workflows/ai-issue-triage.yml | sed -n '1,90p'Repository: NITISH-R-G/Intelli-Credit-V2
Length of output: 4180
🌐 Web query:
peter-evans create-or-update-comment input comment-id documented update flow
💡 Result:
The peter-evans/create-or-update-comment action does not automatically determine whether to create or update a comment based solely on its own logic; it requires an external check to decide [1]. To implement an "update if exists, otherwise create" flow, it is standard practice to use the peter-evans/find-comment action in conjunction with it [2][3]. The workflow pattern documented by the maintainer is as follows: 1. Use find-comment to search for an existing comment (e.g., by searching for a specific body string or author) [2][4]. 2. Capture the output comment-id from the find-comment step [2]. 3. Use conditional 'if' statements on subsequent create-or-update-comment steps to branch based on whether the comment-id is present [2][3]. Example Workflow Pattern: - name: Find Comment uses: peter-evans/find-comment@v3 id: fc with: issue-number: ${{ github.event.pull_request.number }} body-includes: This comment was written by a bot! - name: Create comment if: steps.fc.outputs.comment-id == '' uses: peter-evans/create-or-update-comment@v5 with: issue-number: ${{ github.event.pull_request.number }} body: | This comment was written by a bot! - name: Update comment if: steps.fc.outputs.comment-id!= '' uses: peter-evans/create-or-update-comment@v5 with: comment-id: ${{ steps.fc.outputs.comment-id }} body: | This comment has been updated! edit-mode: replace If the comment-id input is provided, the action will update the existing comment [2][1]. If comment-id is omitted, it will create a new comment [1]. When updating, you can specify an edit-mode of replace (to overwrite the existing body) or append (to add to the existing content) [2][5].
Citations:
- 1: Create works but update doesn't? peter-evans/create-or-update-comment#364
- 2: https://github.com/peter-evans/create-or-update-comment
- 3: peter-evans/create-or-update-comment@2435e87
- 4: https://github.com/peter-evans/create-or-update-comment/blob/093836e1fd546dae65ad8076add96b4c1fdb19e6/README.md
- 5: https://github.com/peter-evans/create-or-update-comment/blob/aec0e42814d0a561127d0eb2cc37cfdde6c60756/README.md
🌐 Web query:
"create-or-update-comment" "comment-id" required update comment
💡 Result:
In software development and API design, requiring a comment-id is the standard mechanism to distinguish an update operation from a creation operation [1][2][3][4]. When using the popular "create-or-update-comment" GitHub Action, the comment-id parameter is the specific key used to determine the action's behavior [5][6]. If a comment-id is provided, the action performs an update; if it is omitted, the action assumes a new comment should be created [5][7][8]. Because many automated workflows (such as CI/CD pipelines) do not know if a relevant comment already exists, a common pattern involves two distinct steps [5][9]: 1. Find: Use a search utility (like the find-comment action) to look for an existing comment based on criteria such as the author or body content [5][9]. 2. Create or Update: Pass the ID returned from the first step into the create-or-update-comment action [5][9]. If the find step returns an ID, the create-or-update-comment action uses that ID to perform an update; if it returns empty, the action performs a creation [5][10]. This "check-then-act" pattern is widely considered best practice because it keeps individual actions focused on single responsibilities while providing robust control over the workflow [7].
Citations:
- 1: https://docs.github.com/en/rest/issues/comments?apiVersion=--
- 2: https://www.finalroundai.com/interview-questions/facebook-live-api-design
- 3: https://developer.box.com/reference/put-comments-id
- 4: https://developers.notion.com/reference/update-a-comment
- 5: https://github.com/peter-evans/create-or-update-comment
- 6: https://github.com/marketplace/actions/create-or-update-comment
- 7: Create works but update doesn't? peter-evans/create-or-update-comment#364
- 8: https://github.com/peter-evans/create-or-update-comment/blob/af66e5eb29027c7ba4cfa34c4a0203d34bc1431e/README.md
- 9: https://stackoverflow.com/questions/71089424/github-action-update-existing-comment-if-one-exist-or-create-a-new-comment
- 10: If commentId is zero, add rather than update peter-evans/create-or-update-comment#73
🌐 Web query:
peter-evans/create-or-update-comment README comment-id update comment
💡 Result:
To update an existing comment using the peter-evans/create-or-update-comment action, you must provide the specific comment-id of the target comment [1][2]. When updating, you can specify how the body and reactions are handled using the edit-mode and reactions-edit-mode inputs [1][3]. Example workflow for updating a comment: - name: Update comment uses: peter-evans/create-or-update-comment@v5 with: comment-id: 123456789 # Replace with the actual ID of the comment to update body: | Edit: This is the updated content. edit-mode: replace reactions: eyes Key Considerations: - Required Input: You must provide the comment-id for the update operation [1][4]. If you do not provide a comment-id, the action will treat the execution as a request to create a new comment [4]. - Finding the ID: The maintainer recommends using the separate peter-evans/find-comment action to programmatically discover the comment-id before attempting an update [5][4]. - Edit Modes: The edit-mode input supports two values: append (default) or replace [1][3]. Append adds your new content to the existing comment, while replace overwrites the existing body [1][3]. - Permissions: Ensure the GitHub token used by the action has sufficient permissions (issues: write, pull-requests: write) for the repository [1][3].
Citations:
- 1: https://github.com/peter-evans/create-or-update-comment
- 2: https://github.com/marketplace/actions/create-or-update-comment
- 3: https://github.com/peter-evans/create-or-update-comment/blob/main/action.yml
- 4: Create works but update doesn't? peter-evans/create-or-update-comment#364
- 5: https://github.com/peter-evans/create-or-update-comment/blob/v2.0.1/README.md
🌐 Web query:
peter-evans create-or-update-comment@6b65298e27703bd026057331221d8bec87659ee3 action.yml comment-id
💡 Result:
The input comment-id is a configuration parameter for the peter-evans/create-or-update-comment GitHub Action [1][2][3]. It is used to specify the ID of an existing issue or pull request comment that you wish to update [2][3]. When this input is provided, the action will update the specified comment rather than creating a new one [2][4]. If comment-id is omitted, the action creates a new comment instead [4]. To obtain the comment-id of an existing comment, you typically need to use a separate action, such as peter-evans/find-comment, to search for the comment based on criteria like the author or content [4][5]. Once found, the ID can be passed to the comment-id input of the create-or-update-comment action [5]. Technical details regarding the comment-id input: - Purpose: Identifies the specific comment to be modified [1][2]. - Usage: Set this input in your workflow step to enable update functionality [2][3]. - Interaction with edit-mode: When updating a comment, you can control whether the new content replaces the existing body or is appended to it using the edit-mode input (default is append) [1][2]. The long alphanumeric string 6b65298e27703bd026057331221d8bec87659ee3 mentioned in your query does not appear to be a standard or recognized identifier associated with the create-or-update-comment action repository or its documentation; it may be a specific commit hash, transaction ID, or unrelated identifier [6][7][8][9][10].
Citations:
- 1: https://github.com/peter-evans/create-or-update-comment/blob/main/action.yml
- 2: https://github.com/peter-evans/create-or-update-comment
- 3: https://github.com/marketplace/actions/create-or-update-comment
- 4: Create works but update doesn't? peter-evans/create-or-update-comment#364
- 5: https://stackoverflow.com/questions/71089424/github-action-update-existing-comment-if-one-exist-or-create-a-new-comment
- 6: https://ordinals.com/tx/6b00909894b96adf73e219d5475e85bb90411d77b1dd9974cad5bd158a6e57e2
- 7: https://www.walletexplorer.com/txid/6b466b98d7d35b36a2a108219c530f4df12832b1189e3e16eec0ae52534655e9
- 8: https://www.walletexplorer.com/txid/3b652d9ced35a0fe443d8ebe0a5d5681104ac3ae44effc6909a9fb6b5b9c4fc8
- 9: https://ordinals.com/tx/6ee6523009534d1dc55be161f6bbad96ddb5029df654c015553c7f2ee06943d3
- 10: https://www.walletexplorer.com/txid/bb652618ffe6bbb4aa15200f9425f6264f83fc05177318b0f0c1cebc08aba605
Prevent duplicate triage comments on issue edits.
Line [4] runs this on edited as well as opened, and line [33] lacks comment-id, so create-or-update-comment creates a new comment for every edit. Find the bot’s existing comment and pass its ID with comment-id, or limit the trigger to opened.
🧰 Tools
🪛 zizmor (1.26.1)
[info] 33-33: action functionality is already included by the runner (superfluous-actions): use gh pr comment or gh issue comment in a script step
(superfluous-actions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-issue-triage.yml around lines 31 - 36, Update the Post
comment step in the workflow so issue edits do not create duplicate triage
comments: either restrict the workflow trigger to opened issues or locate the
bot’s existing comment and provide its ID via comment-id to
peter-evans/create-or-update-comment. Preserve posting behavior for newly opened
issues.
| - name: Generate PR Diff | ||
| run: git diff origin/${{ github.base_ref }}...HEAD > pr-diff.txt |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
Pass base_ref through the environment, not shell source.
Line [28] embeds a GitHub context value directly into a run command. Although base_ref is normally a repository branch, keeping context values out of shell source prevents shell interpretation and remains safe if this is later changed to a user-controlled ref.
Proposed fix
- name: Generate PR Diff
- run: git diff origin/${{ github.base_ref }}...HEAD > pr-diff.txt
+ env:
+ BASE_REF: ${{ github.base_ref }}
+ run: git diff "origin/${BASE_REF}...HEAD" > pr-diff.txt📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Generate PR Diff | |
| run: git diff origin/${{ github.base_ref }}...HEAD > pr-diff.txt | |
| - name: Generate PR Diff | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: git diff "origin/${BASE_REF}...HEAD" > pr-diff.txt |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 28-28: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-pr-reviewer.yml around lines 27 - 28, Update the
“Generate PR Diff” workflow step to pass github.base_ref through the step
environment and reference the environment variable in the git diff command
instead of interpolating the context value directly into shell source; preserve
the existing origin base-ref comparison and pr-diff.txt output.
Source: Linters/SAST tools
| - name: Run AI PR Review | ||
| env: | ||
| GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} | ||
| GITHUB_EVENT_PATH: ${{ github.event_path }} | ||
| run: npm run ai:pr-review | ||
|
|
||
| - name: Comment on PR | ||
| if: hashFiles('pr-comment.txt') != '' | ||
| uses: thollander/actions-comment-pull-request@e4a76dd2b0a3c2027c3fd84147a67c22ee4c90fa | ||
| with: | ||
| file-path: pr-comment.txt |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Workflow file =="
if [ -f .github/workflows/ai-pr-reviewer.yml ]; then
cat -n .github/workflows/ai-pr-reviewer.yml
else
echo ".github/workflows/ai-pr-reviewer.yml not found"
fi
echo
echo "== Workflow action pins =="
rg -n "uses: https://github\.com/|uses: [A-Za-z0-9._/-]+@[a-f0-9]{40}#|uses: [A-Za-z0-9._/-]+@[a-f0-9]{40}|on:|pull_request|pull_request_target|permissions:|GEMINI_API_KEY|actionlint|comment-pull-request|ai:pr-review" .github/workflows/ai-pr-reviewer.yml .github/workflows -g '*.yml' -g '*.yaml' || true
echo
echo "== Package script =="
if [ -f package.json ]; then
python3 - <<'PY'
import json
p=json.load(open('package.json'))
pck=p.get('scripts')
print(json.dumps({'scripts': pck, 'scripts.ai:pr_review': pck.get('ai:pr_review')}, indent=2))
PY
fi
echo
echo "== Actions settings in repository files =="
rg -n "GITHUB_TOKEN|GEMINI_API_KEY|npm run ai:pr-review|thollander/actions-comment-pull-request|pull_request_target|pull_request\(|GITHUB_ACTOR|github.event.pull_request\.head\.repo\.full_name|github.event.pull_request\.head\.repository\.full_name" .github . -g '!node_modules' || trueRepository: NITISH-R-G/Intelli-Credit-V2
Length of output: 11539
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== ai-pr-reviewer.ts =="
cat -n scripts/automation/ai-pr-reviewer.ts
echo
echo "== AI scripts key checks =="
python3 - <<'PY'
from pathlib import Path
for p in [
Path('scripts/automation/ai-pr-reviewer.ts'),
Path('scripts/automation/ai-issue-triage.ts'),
Path('scripts/automation/ai-continuous-improvement.ts'),
]:
text = p.read_text() if p.exists() else ''
print(f'\n--- {p} ---')
for i, line in enumerate(text.splitlines(), 1):
if 'GEMINI_API_KEY' in line or 'process.env.GEMINI_API_KEY' in line:
print(f'{i}: {line}')
PY
echo
echo "== Search for fork/head repo refs and error handling =="
rg -n "pull_request|GEMINI_API_KEY|process\.exit|exit\\(|console\.error|console\.info|npm run ai:pr-review|ai-pr-review|pr-comment\\.txt|set-output|github\\.\.setOutput|createPullRequest|create_review|comment" scripts/automation .github/workflows/ai-pr-reviewer.yml -g '*.ts' -g '*.yml' || trueRepository: NITISH-R-G/Intelli-Credit-V2
Length of output: 8286
🌐 Web query:
GitHub Actions pull_request fork GITHUB_TOKEN read-only secrets GITHUB_TOKEN
💡 Result:
When a workflow is triggered by a pull_request event from a forked repository, GitHub enforces strict security limitations to protect the base repository [1][2]. GITHUB_TOKEN Restrictions By default, the GITHUB_TOKEN issued to workflows triggered by pull requests from forks is restricted to read-only permissions [3][4]. This ensures that untrusted code in a pull request cannot modify the base repository [1]. Access to Secrets Workflows triggered by the standard pull_request event from a forked repository do not have access to the base repository's secrets [1][5]. This prevents malicious pull requests from exfiltrating sensitive credentials [5][6]. Configuration and Overrides 1. Send write tokens to workflows: Repository administrators can enable an option called Send write tokens to workflows from pull requests in the repository's Actions settings [2][7]. If enabled, workflows triggered by pull requests from forks may be granted write access to the GITHUB_TOKEN, though this is a security risk [2][7]. 2. pull_request_target event: The pull_request_target event triggers workflows in the context of the base repository, giving them access to the base repository's GITHUB_TOKEN (with write permissions by default) and its secrets [1][5]. Because this runs untrusted code from a fork with elevated privileges, it is highly susceptible to pwn request vulnerabilities [8]. 3. Safety for pull_request_target: To use pull_request_target safely, you should not check out, build, or run untrusted code from the pull request directly [1][5]. As of June 2026, actions/checkout version 7 and later includes enhanced protections that refuse to fetch code from fork pull requests in pull_request_target workflows to prevent common security incidents [8]. If a workflow requires access to secrets for a pull request from a fork, common practices include manual review and re-running the workflow by a user with write access to the repository, or using complex patterns that verify the triggering actor's permissions before checking out untrusted code [5][6].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
- 2: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository
- 3: Clarify Permissions Calculation for Workflow Jobs in Documentation github/docs#33566
- 4: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
- 5: https://stackoverflow.com/questions/76952023/how-to-make-github-actions-safely-access-secrets-for-prs-created-from-forks
- 6: https://michaelheap.com/access-secrets-from-forks/
- 7: https://docs.github.com/en/enterprise-server@3.2/actions/reference/authentication-in-a-workflow
- 8: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
Support fork workflows without secrets/token access.
This pull_request job checks out PR code, receives no GEMINI_API_KEY, and gets a read-only token for fork-originated PRs, so the review is skipped and the comment step cannot run. Either document that only same-repository PRs are supported or move the trusted work to an approved workflow_run path that creates pr-comment.txt before the pull_request job uses it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ai-pr-reviewer.yml around lines 30 - 40, Update the
workflow around “Run AI PR Review” and “Comment on PR” to support
fork-originated pull requests by moving secret- and write-token-dependent work
to an approved workflow_run path that generates pr-comment.txt and posts the
comment. If fork support is not intended, explicitly document and enforce that
only same-repository pull requests are supported instead.
| @@ -0,0 +1,2 @@ | |||
| #!/bin/bash | |||
| git ls-remote https://github.com/$1.git refs/tags/$2^{} | awk '{print $1}' | |||
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Resolve both lightweight and annotated tags, and quote inputs.
Line 2 returns nothing for lightweight tags and permits shell word splitting. Query both refs, prefer the peeled SHA when present, and quote both arguments.
Proposed fix
#!/bin/bash
-git ls-remote https://github.com/$1.git refs/tags/$2^{} | awk '{print $1}'
+set -euo pipefail
+
+repo=${1:?usage: get_sha.sh <owner/repo> <tag>}
+tag=${2:?usage: get_sha.sh <owner/repo> <tag>}
+
+git ls-remote "https://github.com/${repo}.git" \
+ "refs/tags/${tag}" "refs/tags/${tag}^{}" |
+ awk '
+ /\^\{\}$/ { peeled = $1; next }
+ { direct = $1 }
+ END {
+ if (peeled) print peeled
+ else if (direct) print direct
+ else exit 1
+ }'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| git ls-remote https://github.com/$1.git refs/tags/$2^{} | awk '{print $1}' | |
| #!/bin/bash | |
| set -euo pipefail | |
| repo=${1:?usage: get_sha.sh <owner/repo> <tag>} | |
| tag=${2:?usage: get_sha.sh <owner/repo> <tag>} | |
| git ls-remote "https://github.com/${repo}.git" \ | |
| "refs/tags/${tag}" "refs/tags/${tag}^{}" | | |
| awk ' | |
| /\^\{\}$/ { peeled = $1; next } | |
| { direct = $1 } | |
| END { | |
| if (peeled) print peeled | |
| else if (direct) print direct | |
| else exit 1 | |
| }' |
🧰 Tools
🪛 Shellcheck (0.11.0)
[info] 2-2: Double quote to prevent globbing and word splitting.
(SC2086)
[info] 2-2: Double quote to prevent globbing and word splitting.
(SC2086)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@get_sha.sh` at line 2, Update the get_sha.sh command to safely quote both
repository and tag arguments, query both the direct tag ref and its peeled ^{}
ref, and select the peeled SHA when available while falling back to the direct
SHA for lightweight tags.
Source: Linters/SAST tools
| const prompt = ` | ||
| You are an expert AI repository maintainer for "Intelli-Credit Terminal", an AI-powered corporate credit appraisal system using Google Gemini. | ||
| A new issue has been opened by @${issueAuthor}. | ||
|
|
||
| Issue Title: ${issueTitle} | ||
| Issue Body: ${issueBody} | ||
|
|
||
| Please provide a helpful, welcoming, and concise response to the user. | ||
| 1. Acknowledge the issue. | ||
| 2. Provide initial triage (e.g., if it's a bug, ask for repro steps if missing; if it's a feature, discuss its potential). | ||
| 3. If relevant to the repository's context (React, Node, Express, Google GenAI), offer a preliminary suggestion or pointer to where the code might be affected. | ||
| 4. Keep the response professional and maintainer-like. | ||
|
|
||
| Output ONLY the raw markdown text for the GitHub comment. Do not use markdown code blocks to wrap the entire response. | ||
| `; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '^scripts/automation/(ai-issue-triage|ai-pr-reviewer|ai-continuous-improvement)\.ts$|^package\.json$'
echo "== outlines =="
for f in scripts/automation/ai-issue-triage.ts scripts/automation/ai-pr-reviewer.ts scripts/automation/ai-continuous-improvement.ts; do
echo "--- $f"
ast-grep outline "$f" --view compact || true
wc -l "$f"
done
echo "== relevant script sections =="
sed -n '1,180p' scripts/automation/ai-issue-triage.ts
printf '\n---\n'
sed -n '1,180p' scripts/automation/ai-pr-reviewer.ts
printf '\n---\n'
sed -n '1,180p' scripts/automation/ai-continuous-improvement.ts
echo "== prompt/data injection searches =="
rg -n "issueBody|issueTitle|prInfo|diffContent|gitLog|pkgJson|GEMINI_API_KEY|execFileSync|comment|issue|PR|prompt|generate" scripts/automation scripts/package.json package.json 2>/dev/null || true
echo "== changed files stat =="
git diff --stat || trueRepository: NITISH-R-G/Intelli-Credit-V2
Length of output: 15792
Treat repository contents as untrusted prompt data.
Issue bodies, PR metadata/diffs, commit messages, and package.json are injected directly into Gemini prompts before the scripts write generated results. Add clear data/control separation, quote embedded payloads, and prevent injected text from overriding the system instructions.
scripts/automation/ai-issue-triage.ts: isolateissue.title/bodyandissue.user.loginas untrusted data before generating the issue comment.scripts/automation/ai-pr-reviewer.ts: isolatepull_request.title/bodyand the diff contents as untrusted data before generating the PR comment.scripts/automation/ai-continuous-improvement.ts: isolate commit log and manifest contents as untrusted repository data before generating the report.
📍 Affects 3 files
scripts/automation/ai-issue-triage.ts#L34-L48(this comment)scripts/automation/ai-pr-reviewer.ts#L40-L58scripts/automation/ai-continuous-improvement.ts#L36-L59
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/ai-issue-triage.ts` around lines 34 - 48, Separate
instructions from untrusted repository data in all three prompt builders:
scripts/automation/ai-issue-triage.ts lines 34-48 must isolate issueAuthor,
issueTitle, and issueBody; scripts/automation/ai-pr-reviewer.ts lines 40-58 must
isolate pull request title/body and diff contents; and
scripts/automation/ai-continuous-improvement.ts lines 36-59 must isolate commit
log and manifest contents. Clearly label embedded values as untrusted data,
quote or delimit them, and instruct Gemini not to follow directives contained
within them while preserving the intended generated outputs.
| const output = execFileSync('npx', ['--yes', 'madge', '--json', 'src/', 'api/'], { | ||
| encoding: 'utf-8', | ||
| }) as string; |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate file =="
git ls-files | grep -F 'scripts/automation/generate-knowledge-graph.ts' || true
echo "== file excerpt =="
if [ -f scripts/automation/generate-knowledge-graph.ts ]; then
nl -ba scripts/automation/generate-knowledge-graph.ts | sed -n '1,120p'
fi
echo "== timeout/maxBuffer in automation scripts =="
rg -n "execFileSync|execFile|spawn|timeout:|maxBuffer:" scripts/automation || true
echo "== package scripts/deps relevant to madge =="
for f in package.json pnpm-lock.yaml package-lock.json yarn.lock; do
if [ -f "$f" ]; then
echo "--- $f ---"
rg -n '"madge"|"devDependencies"|"scripts"|timeout:|maxBuffer:' "$f" || true
fi
doneRepository: NITISH-R-G/Intelli-Credit-V2
Length of output: 290
🌐 Web query:
Node.js execFileSync default maxBuffer timeout buffer exceeded behavior
💡 Result:
In Node.js, the child_process.execFileSync method uses a default maxBuffer of 1024 * 1024 bytes (1 MiB) [1][2]. When this limit is exceeded, the behavior is as follows: 1. The child process is terminated [1][3]. 2. Any output captured up to that point is truncated [1][3]. 3. The method throws an error, which typically includes the code 'ENOBUFS' to indicate the buffer limit was surpassed [4][5]. Regarding the timeout option, it defaults to 0 (no timeout) [1][2]. If a timeout is provided and the process exceeds it, the child process is killed using the signal specified by killSignal (defaulting to 'SIGTERM') [1][3]. In this case, execFileSync will wait until the process has fully exited before returning [1][3]. Historical Note: While older versions of Node.js had different or sometimes undocumented default behaviors (at one point defaulting to 200 * 1024 bytes, and earlier than that having an effective default of Infinity) [6][4][5], the current authoritative standard is 1 MiB [1][2].
Citations:
- 1: https://nodejs.org/api/child_process.html
- 2: https://nodejs.org/download/release/latest-v24.x/docs/api/child_process.html
- 3: https://nodejs.org/api/child_process.md
- 4: nodejs/node@eb8a51a35c
- 5: nodejs/node@ceb80f4
- 6: child_process: use non-infinite maxBuffer defaults nodejs/node#23027
Bound the synchronous madge subprocess.
execFileSync uses timeout: 0 by default and the 1 MiB default maxBuffer, so a larger dependency graph can hang or exit prematurely. Add a verified timeout and an explicit maxBuffer, or stream madge output directly to the destination file.
🧰 Tools
🪛 GitHub Check: SonarCloud Code Analysis
[warning] 16-16: Make sure the "PATH" variable only contains fixed, unwriteable directories.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/automation/generate-knowledge-graph.ts` around lines 16 - 18, Update
the madge invocation in the knowledge-graph generation flow to prevent unbounded
execution and output truncation: configure execFileSync with a verified timeout
and an explicit maxBuffer sized for large graphs, or stream the subprocess
output directly to the destination file. Preserve UTF-8 output handling and
existing madge arguments.
1 participant
This PR introduces a comprehensive set of automated repository tools requested by the user. It transforms the repository into an intelligent, self-maintaining space utilizing GitHub Actions, Node.js scripts, and the Google Gemini API. New workflows automatically triage issues, review pull requests, generate architecture diagrams, and run daily AI codebase improvement routines. Additionally, existing UI buttons were corrected with
type="button", and GitHub Action versions were pinned to secure SHAs based on best practices.PR created automatically by Jules for task 12324463503077510737 started by @NITISH-R-G