-
Notifications
You must be signed in to change notification settings - Fork 3.7k
Continuous ai review bot #7099
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Continuous ai review bot #7099
Conversation
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cubic analysis
1 issue found across 1 file • Review in cubic
React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.
.github/workflows/cli-review.yaml
Outdated
| # Run the CLI with a hardcoded prompt and output text directly | ||
| echo "Review this pull request and provide feedback on code quality" | cn -p --org continuedev | ||
| env: | ||
| CONTINUE_API_KEY: ${{ secrets.CONTINUE_API_KEY }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Referencing a required secret in a pull-request workflow without a fallback or conditional guard will make the job fail for contributions from forks.
Prompt for AI agents
Address the following comment on .github/workflows/cli-review.yaml at line 36:
<comment>Referencing a required secret in a pull-request workflow without a fallback or conditional guard will make the job fail for contributions from forks.</comment>
<file context>
@@ -0,0 +1,36 @@
+name: CLI Review
+
+on:
+ pull_request:
+ branches:
+ - main
+
+ push:
+ branches:
</file context>
Code Review Summary✅ Strengths
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cubic analysis
2 issues found across 2 files • Review in cubic
React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.
.github/workflows/cli-review.yaml
Outdated
| @@ -0,0 +1,36 @@ | |||
| name: CLI Review | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This workflow duplicates the existing continue-review workflow, causing redundant CI runs and potential duplicate PR comments.
Prompt for AI agents
Address the following comment on .github/workflows/cli-review.yaml at line 1:
<comment>This workflow duplicates the existing continue-review workflow, causing redundant CI runs and potential duplicate PR comments.</comment>
<file context>
@@ -0,0 +1,36 @@
+name: CLI Review
+
+on:
</file context>
.github/workflows/cli-review.yaml
Outdated
| echo "" | ||
|
|
||
| # Run the CLI with a hardcoded prompt and output text directly | ||
| echo "Review this pull request and provide feedback on code quality" | cn -p --org continuedev |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Running the CLI in interactive mode will block the workflow because no TTY is available in GitHub Actions.
Prompt for AI agents
Address the following comment on .github/workflows/cli-review.yaml at line 34:
<comment>Running the CLI in interactive mode will block the workflow because no TTY is available in GitHub Actions.</comment>
<file context>
@@ -0,0 +1,36 @@
+name: CLI Review
+
+on:
+ pull_request:
+ branches:
+ - main
+
+ push:
+ branches:
</file context>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cubic analysis
3 issues found across 2 files • Review in cubic
React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.
.github/workflows/cli-review.yaml
Outdated
| branches: | ||
| - main | ||
|
|
||
| jobs: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Workflow omits an explicit permissions: section, so it runs with the default broad permissions instead of the minimal set required.
Prompt for AI agents
Address the following comment on .github/workflows/cli-review.yaml at line 12:
<comment>Workflow omits an explicit `permissions:` section, so it runs with the default broad permissions instead of the minimal set required.</comment>
<file context>
@@ -0,0 +1,36 @@
+name: CLI Review
+
+on:
+ pull_request:
+ branches:
+ - main
+
+ push:
+ branches:
</file context>
.github/workflows/cli-review.yaml
Outdated
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-node@v4 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Action version is not pinned to an immutable reference, which can allow unexpected or malicious changes to be introduced if the tag is retagged.
Prompt for AI agents
Address the following comment on .github/workflows/cli-review.yaml at line 18:
<comment>Action version is not pinned to an immutable reference, which can allow unexpected or malicious changes to be introduced if the tag is retagged.</comment>
<file context>
@@ -0,0 +1,36 @@
+name: CLI Review
+
+on:
+ pull_request:
+ branches:
+ - main
+
+ push:
+ branches:
</file context>
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, ready_for_review] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Workflow is not re-run when new commits are pushed, so the AI review comment can fall out-of-date.
Prompt for AI agents
Address the following comment on .github/workflows/continue-review.yaml at line 5:
<comment>Workflow is not re-run when new commits are pushed, so the AI review comment can fall out-of-date.</comment>
<file context>
@@ -0,0 +1,164 @@
+name: Continue CLI Code Review
+
+on:
+ pull_request:
+ types: [opened, ready_for_review]
+
+permissions:
</file context>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In my experience. Only "ready to review" is great to limit credit spend, but I don't think contributors will start with a draft. So makes sense to have this as opened, but probably makes sense"ready to review" unnecessary
Code Review Summary✅ Strengths
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cubic analysis
1 issue found across 1 file • Review in cubic
React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.
| echo "" | ||
|
|
||
| # Run the CLI with hardcoded assistant and pipe output to code_review.md | ||
| cat review_prompt.txt | cn --auto --org continuedev --config continuedev/review-bot -p > code_review.md |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This step assumes review_prompt.txt exists, but it is skipped for draft PRs, so the job will crash for every draft pull request.
Prompt for AI agents
Address the following comment on .github/workflows/continue-review.yaml at line 91:
<comment>This step assumes review_prompt.txt exists, but it is skipped for draft PRs, so the job will crash for every draft pull request.</comment>
<file context>
@@ -0,0 +1,137 @@
+name: Continue CLI Code Review
+
+on:
+ pull_request:
+ types: [opened, ready_for_review]
+
+permissions:
+ contents: read
+ pull-requests: write
</file context>
|
@continue-review please review |
Code Review Summary✅ Strengths
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cubic analysis
2 issues found across 2 files • Review in cubic
React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.
|
|
||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
External actions are referenced only by version tags (e.g., actions/checkout@v4) instead of immutable commit SHAs. Tag drift can introduce unreviewed changes or malicious code into your workflow and is discouraged by GitHub’s security guidelines.
(Based on your team's feedback about pinning third-party GitHub Actions to commit SHAs for supply-chain security.)
Prompt for AI agents
Address the following comment on .github/workflows/continue-review.yaml at line 36:
<comment>External actions are referenced only by version tags (e.g., `actions/checkout@v4`) instead of immutable commit SHAs. Tag drift can introduce unreviewed changes or malicious code into your workflow and is discouraged by GitHub’s security guidelines.
(Based on your team's feedback about pinning third-party GitHub Actions to commit SHAs for supply-chain security.)</comment>
<file context>
@@ -0,0 +1,172 @@
+name: Continue CLI Code Review
+
+on:
+ pull_request:
+ types: [opened, ready_for_review]
+ issue_comment:
+ types: [created]
+
+permissions:
</file context>
| # Only run if: | ||
| # - It's a PR event from a team member (with write/admin permissions) | ||
| # - OR it's a comment with @continue-review on a PR from a team member | ||
| if: | |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Using the literal block indicator | preserves the newline characters, so the if expression is passed to the runner with embedded new-lines. GitHub Actions fails to parse multi-line if expressions containing newlines, causing the job to be skipped or to error. Use the folded style (>) so the expression is evaluated as a single line.
Prompt for AI agents
Address the following comment on .github/workflows/continue-review.yaml at line 22:
<comment>Using the literal block indicator `|` preserves the newline characters, so the `if` expression is passed to the runner with embedded new-lines. GitHub Actions fails to parse multi-line `if` expressions containing newlines, causing the job to be skipped or to error. Use the folded style (`>`) so the expression is evaluated as a single line.</comment>
<file context>
@@ -0,0 +1,172 @@
+name: Continue CLI Code Review
+
+on:
+ pull_request:
+ types: [opened, ready_for_review]
+ issue_comment:
+ types: [created]
+
+permissions:
</file context>
Code Review Summary✅ Strengths
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cubic analysis
No issues found across 2 files. Review in cubic
| node-version: 20 | ||
|
|
||
| - name: Install Continue CLI | ||
| run: npm install -g @continuedev/[email protected] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we want to pin to this CLI version?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, that's by design. I think we should pretty much always do this when using a dependency with ad-hoc npm install. Otherwise, we may end up using a version with a breaking change, or even a version with a security issue.
|
|
||
| You can use the available tools to explore the codebase and understand context better. | ||
|
|
||
| Format your response as a markdown code review with the following structure: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
My hunch is that this will get annoying with it following the exact structure even when unnecessary. Might be helpful to add a comment like "You do not need to follow this exact structure, use it for inspiration while still keeping your review concise and focused."
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I made it more rigid on purpose - the odds are most people won't read this thoroughly but will skim it. The more consistent the structure, the easier it will be to find the exact data you need.
| 1. **Code Quality**: Are there any bugs, performance issues, or code smells? | ||
| 2. **Best Practices**: Does the code follow established patterns and conventions? | ||
| 3. **Security**: Are there any potential security vulnerabilities? | ||
| 4. **Testing**: Are appropriate tests included or updated? | ||
| 5. **Documentation**: Is documentation adequate for the changes? | ||
| 6. **Architecture**: Do the changes fit well with the existing codebase structure? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since we have the repo cloned, will the agent be following our rules in the .continue folder? If not, could we just cat them into the context window or something?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I thought about this but we have a lot of different rules with different triggers, we'd have to either put all the rules in the context (noisy), or handle rule resolution for each file individually (complicated). I'm not against it but it feels out of the scope of this PR.
|
@continue-review hello |
|
🎉 This PR is included in version 1.5.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 1.7.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
Description
The bot is triggered when the PR opens or when a draft PR is converted to a regular PR.
Checklist
Screen recording or screenshot
[ When applicable, please include a short screen recording or screenshot - this makes it much easier for us as contributors to review and understand your changes. See this PR as a good example. ]
Tests
[ What tests were added or updated to ensure the changes work as expected? ]
Summary by cubic
Added a GitHub Actions workflow to automatically run the Continue CLI for code review on pull requests and pushes to main.