Feature/ai code reviewer - #75
Merged
Merged
Conversation
…publish permissions
* feat: add AI code reviewer using Gemini API * fix: change secret name to GEMINI_KEY * feat: upgrade AI code reviewer to Gemini 3.5 Flash using official SDK * fix: use snake_case for thinking_level parameter * feat: switch AI reviewer from Gemini to Mistral Agent * fix: add missing bun install step to AI reviewer workflow * fix: resolve AI review duplication and GenAI config issues * fix: require all CI jobs in branch protection and fix NPM provenance publish permissions * fix(ci): correct unresolved job dependency perf -> performance * fix(lint): resolve typescript strict typing errors and unused variables * fix(perf): respect SKIP_REDIS_CHECK and run baseline on built server * fix(health): ensure storage directory exists before checking access * test: fix health route unit test mock for fs.mkdir * fix(health): use proper getDatabase to fix 503 error on health endpoint * ci: add server warmup curls before running perf tests * ci: disable rate limiter during perf baseline check
UI/UX: - GitHub-style settings layout with clean sidebar navigation - Responsive design across all pages (mobile-first) - Profile page redesigned to match GitHub's layout - Header navbar cleaned up with proper active states - Settings pages (profile, account, security) rewritten - API documentation page with 100+ endpoint categories - Trending repos section responsive on mobile - Hero section stats stack on small screens Documentation: - Complete docs-site sidebar with 70+ pages - Configuration reference with all 165 env vars - Architecture page updated with accurate system design - Installation guide with correct ports and secrets - AI review docs updated with 10+ providers - Quick start and first-repo guides rewritten - Local dev setup with all scripts - Database schema docs for 38 tables - Contributing guide with project structure Security (Critical Fixes): - Git HTTP routes now require authentication - RCE via new Function() replaced with safe evaluator - CSRF bypass via fake Bearer header fixed - PR number race condition fixed with atomic SQL - PR title/body input validation added - Password strength enforced on registration - process.env leak to workflows prevented - Docker stream parsing fixed for multi-frame - require() in ESM modules converted to import - Command injection via execSync fixed (execFileSync) - Path traversal in git-storage rejected - SSH rate limiter memory leak fixed (max 10K entries) SSH/Git: - SSH server reads GIT_SSH_PORT, GIT_REPOS_PATH, GIT_SSH_HOST_KEY - Admin permissions passed via SSH - Docker Compose SSH service added - Pkt-line length calculation fixed Deployment: - render.yaml Blueprint for Render (Singapore region) - Dockerfile.worker for background jobs - FREE-DEPLOYMENT.md guide (Oracle, Fly.io, etc.) - RENDER-DEPLOYMENT.md step-by-step guide - Upstash Redis + Render PostgreSQL free tier setup
# Conflicts: # package.json
- Fix count() usage in index.astro with proper type cast - Fix schema.activity -> schema.activities in profile page - Fix HTMLElement.disabled cast in security settings - Add missing docs to docs-site for parity check - All CI checks should now pass
* feat: add AI code reviewer using Gemini API * fix: change secret name to GEMINI_KEY * feat: upgrade AI code reviewer to Gemini 3.5 Flash using official SDK * fix: use snake_case for thinking_level parameter * feat: switch AI reviewer from Gemini to Mistral Agent * fix: add missing bun install step to AI reviewer workflow * fix: resolve AI review duplication and GenAI config issues * fix: require all CI jobs in branch protection and fix NPM provenance publish permissions * fix(ci): correct unresolved job dependency perf -> performance * fix(lint): resolve typescript strict typing errors and unused variables * fix(perf): respect SKIP_REDIS_CHECK and run baseline on built server * fix(health): ensure storage directory exists before checking access * test: fix health route unit test mock for fs.mkdir * fix(health): use proper getDatabase to fix 503 error on health endpoint * ci: add server warmup curls before running perf tests * ci: disable rate limiter during perf baseline check * fix: comprehensive UI, docs, security, and deployment improvements UI/UX: - GitHub-style settings layout with clean sidebar navigation - Responsive design across all pages (mobile-first) - Profile page redesigned to match GitHub's layout - Header navbar cleaned up with proper active states - Settings pages (profile, account, security) rewritten - API documentation page with 100+ endpoint categories - Trending repos section responsive on mobile - Hero section stats stack on small screens Documentation: - Complete docs-site sidebar with 70+ pages - Configuration reference with all 165 env vars - Architecture page updated with accurate system design - Installation guide with correct ports and secrets - AI review docs updated with 10+ providers - Quick start and first-repo guides rewritten - Local dev setup with all scripts - Database schema docs for 38 tables - Contributing guide with project structure Security (Critical Fixes): - Git HTTP routes now require authentication - RCE via new Function() replaced with safe evaluator - CSRF bypass via fake Bearer header fixed - PR number race condition fixed with atomic SQL - PR title/body input validation added - Password strength enforced on registration - process.env leak to workflows prevented - Docker stream parsing fixed for multi-frame - require() in ESM modules converted to import - Command injection via execSync fixed (execFileSync) - Path traversal in git-storage rejected - SSH rate limiter memory leak fixed (max 10K entries) SSH/Git: - SSH server reads GIT_SSH_PORT, GIT_REPOS_PATH, GIT_SSH_HOST_KEY - Admin permissions passed via SSH - Docker Compose SSH service added - Pkt-line length calculation fixed Deployment: - render.yaml Blueprint for Render (Singapore region) - Dockerfile.worker for background jobs - FREE-DEPLOYMENT.md guide (Oracle, Fly.io, etc.) - RENDER-DEPLOYMENT.md step-by-step guide - Upstash Redis + Render PostgreSQL free tier setup * docs: rewrite README to be concise and professional * fix: resolve CI failures - lint errors, docs parity, type casts - Fix count() usage in index.astro with proper type cast - Fix schema.activity -> schema.activities in profile page - Fix HTMLElement.disabled cast in security settings - Add missing docs to docs-site for parity check - All CI checks should now pass --------- Co-authored-by: JustAPI Bot <bot@justapi.dev>
- Regenerate bun.lock to sync with package.json (fixes frozen lockfile CI error) - Fix ThemeToggle.tsx type narrowing error (activeTheme: string)
- Fix markdown test to account for syntax highlighting spans - Mock validatePasswordStrength in auth register test - Add pipelineRunners to admin-stats test schema mock
- Darken docs accent color (#2dd4bf -> #0d9488) for WCAG AA contrast - Fix theme toggle test to click menu item instead of just button - Fix full-flow test password to meet strength requirements - Add missing frontmatter to deployment docs
- Darken docs accent color (#2dd4bf -> #0d9488) for WCAG AA contrast - Fix theme toggle test to click menu item instead of just button - Fix full-flow test password to meet strength requirements
Feature/ai code reviewer
…ngine & Docker Hub release workflow
…ity allowlist for CI security gates
…accepted vulnerability allowlist
…ment (#71) * ci: suppress Node 20 deprecation warning in docker publish * fix: optimize Dockerfile - use --production for deps, slim base image - Use bun install --production to exclude dev dependencies - Use oven/bun:1-slim instead of oven/bun:1 (smaller base) - Use --no-install-recommends for apt packages - Clean up apt cache in same layer - Rename REPOS_PATH to GIT_REPOS_PATH for consistency * docs: rich professional README with video placeholder and complete feature overview * 🤯fix: remove duplicate HTML structure from api-docs page causing build failure * docs: add Docker Hub description with logo and setup instructions * fix:🥟 replace @apply with plain CSS in layout style blocks - AdminLayout: replace @apply with explicit CSS properties - admin/index: remove :global() wrapper from style block - BaseLayout: replace @apply with plain CSS for container * fix: move admin styles to globals.css, remove all is:global style blocks from layouts blocks from layouts - Move glass-panel and custom-scrollbar styles to globals.css - Remove style block from admin/index.astro - Remove style block from AdminLayout.astro * fix: remove all CSS style blocks from pages causing Docker build failure - notification-preferences: remove checkbox style block - blob/[branch]/[...path]: remove shiki/scrollbar style block - blame/[branch]/[path]: remove shiki/scrollbar style block - ide/index: move inline styles to body attribute - globals.css: add shiki/scrollbar styles centrally * fix: remove highlight.js CSS import causing Docker build failure * fix: remove last style block from BaseLayout, move fonts/container to globals.css - Remove <style is:global> from BaseLayout.astro - Add font-family, container, scroll-behavior to globals.css - Zero style blocks remain in any Astro files * fix: use postcss transformer to resolve vite:css build failure Vite 8.x defaults to LightningCSS for CSS transformation, which conflicts with Tailwind CSS v3 directives (@tailwind, @apply, @layer). This caused 'Attempted to assign to readonly property' error during Docker build on src/styles/globals.css. Explicitly set css.transformer to 'postcss' in the Vite config to ensure compatibility with Tailwind CSS v3. * fix: pin postcss to 8.4.x to fix Docker build failure The Docker build uses Astro 4.x which depends on Vite 5.4.21. PostCSS 8.5.x introduced frozen/readonly AST node properties that Vite 5.4.21's compileCSS function tries to mutate, causing: 'Attempted to assign to readonly property' on globals.css Pin PostCSS to ~8.4.49 (both in devDependencies and overrides) to ensure compatibility until Astro upgrades to Vite 6+. * fix: resolve docker build error and overhaul UI with premium github-like design - Fixed Vite 5 / PostCSS 8.5.x frozen AST bug by removing @astrojs/tailwind integration and pinning postcss. - Moved CSS tools to dependencies and updated Dockerfile for multi-stage dependency installs. - Cleaned and modernized globals.css. - Merged duplicate class definitions (.glass-panel, .custom-scrollbar). - Overhauled light theme to reflect modern GitHub aesthetics. - Added missing Shadcn sidebar and chart tokens for all themes. - Updated scrollbar implementation to use standard `scrollbar-width` and `scrollbar-color` properties. * fix: resolve CSRF validation error when creating a repository - Added getCsrfToken to new.astro to generate the token and cookie on the server. - Passed the token into a hidden input field. - Extracted the token and included it in the X-CSRF-Token header in the client-side fetch request. * fix: implement global CSRF fetch interceptor - Extracted CSRF token generation to BaseLayout and AdminLayout. - Injected token via <meta name="csrf-token" /> tag. - Added global window.fetch interceptor to automatically append the 'x-csrf-token' header to all state-changing requests (POST, PUT, PATCH, DELETE). - Reverted manual CSRF handling in new.astro as it's now handled globally for all API requests (repo creation, profile updates, etc). * fix: inject INTERNAL_HOOK_SECRET and REMOTE_USER for internal git pushes - Updated createSimpleGit and getGit to use getSanitizedGitEnv. - Passed INTERNAL_HOOK_SECRET to ensure pre-receive and post-receive hooks authenticate correctly for system-initiated pushes like repository initialization. - Added a fallback 'system' REMOTE_USER to bypass path protections when no specific user is authenticated. * fix: use correct fallback port for internal git hooks - Updated installHooks to use port 4321 instead of 3000 as the fallback when SITE_URL is not set. - Fixes the issue where curl would fail to connect to the internal API during hook execution, resulting in an empty response body and a 'pre-receive hook declined' error. * fix: internal git hooks should always use 127.0.0.1 for local API calls - Updated installHooks to always point curl to 127.0.0.1 instead of SITE_URL. - This prevents connection timeouts when SITE_URL is an external IP that the host cannot route to itself. - Added -sS flag to curl to bubble up explicit connection errors rather than failing silently with an empty body. * 📦 chore: update .cron-lock * 📝 docs: update README * 📝 docs: update notimplemented * ✨ feat: improve IssueDetail.tsx * ✨ feat: update Header.astro page * ✨ feat: improve MilestonesList.tsx * ✨ feat: improve NewMilestoneForm.tsx * ✨ feat: improve CustomPRState.tsx * ✨ feat: improve InlineDiffReview.tsx * ✨ feat: improve PullRequestsList.tsx * ✨ feat: improve RepoSettings.tsx * ✨ feat: improve WorkflowSettings.tsx * ♻️ refactor: update index.ts * ♻️ refactor: update ci-gates.ts * ♻️ refactor: update codeowners-enforcement.ts * ♻️ refactor: update git.ts * ♻️ refactor: update middleware.ts * ♻️ refactor: update csrf.ts * ✨ feat: update [...path].astro page * ✨ feat: update [sha].astro page * ✨ feat: update new.astro page * ✨ feat: update [number].astro page * ✨ feat: update deploy-keys.astro page * ✨ feat: update [...ref].astro page * ✨ feat: update [...path].astro page * ✨ feat: update index.astro page * ♻️ refactor: update logout.ts * ♻️ refactor: update register.ts * ♻️ refactor: update [branch].ts * ♻️ refactor: update index.ts * ♻️ refactor: update [userId].ts * ♻️ refactor: update index.ts * ♻️ refactor: update push.ts * ♻️ refactor: update index.ts * ♻️ refactor: update [number].ts * ♻️ refactor: update comments.ts * ♻️ refactor: update index.ts * ♻️ refactor: update [labelId].ts * ♻️ refactor: update index.ts * ♻️ refactor: update index.ts * ♻️ refactor: update protection.ts * ♻️ refactor: update code-quality.ts * ♻️ refactor: update codeowner-enforcement.ts * ♻️ refactor: update comments.ts * ♻️ refactor: update file-approvals.ts * ♻️ refactor: update index.ts * ♻️ refactor: update merge.ts * ♻️ refactor: update index.ts * ♻️ refactor: update issue-statuses.ts * ♻️ refactor: update path-permissions.ts * ♻️ refactor: update states.ts * ♻️ refactor: update [id].ts * ♻️ refactor: update test.ts * ♻️ refactor: update index.ts * ♻️ refactor: update [slug].ts * ♻️ refactor: update [id].ts * ♻️ refactor: update index.ts * ♻️ refactor: update index.ts * ♻️ refactor: update [stackId].ts * ♻️ refactor: update sync.ts * ♻️ refactor: update index.ts * ♻️ refactor: update index.ts * ♻️ refactor: update user.ts * ♻️ refactor: update [id].ts * ♻️ refactor: update index.ts * ♻️ refactor: update index.ts * ♻️ refactor: update metrics.ts * ♻️ refactor: update [id].ts * ♻️ refactor: update metrics.ts * ✨ feat: update cli.astro page * ♻️ refactor: update refs.ts * ✨ feat: update ai-review-rules.astro page * ✨ feat: update ssh-keys.astro page * 🎨 style: improve globals.css * ♻️ refactor: update openapi-pulls-parity.test.ts * 📦 chore: update plans * 📝 docs: update cli * 📝 docs: update ssh-keys * 📦 chore: update smartcommit.sh * ✨ feat: improve CodeReviewPanel.tsx * ♻️ refactor: update review-analysis.ts * 📦 chore: update review * 📦 chore: update [id] * 🚀 api: update milestones * ♻️ refactor: update analysis.ts * feat(enterprise): add SAML 2.0, SCIM 2.0, OCI Registry, NPM package engine & Docker Hub release workflow * fix(ci): resolve vite import issue in astro.config.mjs for GitHub Actions runner * fix(security): update package overrides and known accepted vulnerability allowlist for CI security gates * fix(ci): update bun.lock to synchronize package.json and fix frozen-lockfile check * fix(security): resolve EOVERRIDE conflict and add brace-expansion to accepted vulnerability allowlist
- Darken --primary/--ring from hsl(212,100%,48%) to hsl(212,100%,37%)
to pass WCAG 2.1 AA contrast ratio (4.5:1 minimum)
- Replace broken axe-core disableRules() with options({ rules: {...} })
for reliable color-contrast rule disabling
- Replace flaky waitForTimeout() with deterministic waitForFunction()
in theme toggle E2E tests
Fixes Container Security (Trivy) CI failure where bun install --frozen-lockfile --production crashed with 'FileNotFound: failed copying files from cache for node-gyp' when compiling better-sqlite3. Clears Bun's install cache before and between retries to avoid stale/corrupt native module cache entries across Docker layers.
Adds docker/setup-buildx-action and switches to docker/build-push-action with GitHub Actions cache to avoid cold Docker builds and speed up the Trivy container security scan job.
…rics) - Remove .env.backup-2026-02-20 that contained real JWT/SESSION/INTERNAL_HOOK secrets - Harden docker-compose stacks: no hardcoded secrets (all required via .env), add ssh-git + worker services with PROCESS_TYPE branching, NAS variant using OCH_DATA_DIR bind mounts, optional cloudflare/tailscale profiles - Commit Drizzle migration baseline (drizzle/) + scripts/migrate.ts so containers apply schema deterministically at runtime (drizzle-kit is dev-only) - Require Bearer METRICS_TOKEN on /api/metrics (timing-safe compare) - Fix npm start to run the built server (was astro dev); add start:ssh/start:worker/migrate - Copy full src tree into the image so raw-TS ssh/worker entrypoints resolve @/ aliases; add wget for HEALTHCHECK - Canonicalize storage env vars to local + S3 only; update docs, docs-site, AGENTS.md, prometheus config, .env.example, and Docker/vercel guides accordingly
- Remove hardcoded default MinIO password (minioadmin) from docker-compose.yml and docker-compose.production.yml; use required variable syntax (?:) instead - Fix npm publish CI step: --provenance requires package to exist on registry, so fall back to standard publish for initial seed (fixes 404 on first publish)
- Remove 'override: true' from dotenv.config() in src/db/index.ts and scripts/migrate.ts so .env values never clobber CI env vars - Make loadConfig() in config.ts only set DATABASE_URL/DRIVER/REDIS_URL when they are NOT already present in process.env, preventing a stale data/config.json from overwriting CI-injected connection strings Fixes E2E 'FATAL: role root does not exist' where pg fell back to the OS username because the CI DATABASE_URL was silently overridden.
Co-authored-by: swadhinbiswas <107450069+swadhinbiswas@users.noreply.github.com>
The deps stage only installs node_modules and never copies source files. Add a 'source' stage that does COPY . . so the runner stage can COPY --from=source the files it needs (tsconfig.json, src/lib, src/db, scripts/worker.ts).
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 27968088 | Triggered | Generic Password | 6254919 | docker-compose.yml | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe pull request updates npm publishing behavior, Docker worker image staging, and configuration environment-variable precedence. Changesnpm publishing
Worker image build
Configuration precedence
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Bug Fixes
Chores