Skip to content

Commit cb88d74

Browse files
jonit-devjonit-dev
committed
goauth
1 parent 8c96bff commit cb88d74

4 files changed

Lines changed: 220 additions & 75 deletions

File tree

‎README.md‎

Lines changed: 106 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,59 @@
22

33
AI-powered PR reviews using OpenRouter's language models. Get automated code reviews, suggestions, and vulnerability scanning on your pull requests.
44

5+
## How It Works
6+
7+
1. When a PR is opened or updated, the action automatically runs
8+
2. It analyzes the PR's diff using your chosen AI model
9+
3. Posts a detailed analysis as a PR comment, including:
10+
- Potential bugs and vulnerabilities
11+
- Code improvement suggestions
12+
- Performance implications
13+
- Security concerns
14+
- Best practices violations
15+
- Overall score and final comments
16+
17+
Example PR comment:
18+
19+
```markdown
20+
## OpenRouter AI Analysis
21+
22+
### Potential Issues
23+
24+
- The database query in `users.service.ts` isn't properly parameterized, creating a SQL injection risk
25+
- Async operation in `handleSubmit()` lacks error handling
26+
27+
### Improvements Suggested
28+
29+
- Consider using prepared statements for database queries
30+
- Add try/catch block around async operations
31+
- Extract form validation logic into a separate utility
32+
33+
### Performance
34+
35+
- The `heavyComputation()` function could benefit from memoization
36+
- Consider lazy loading for the imported analytics module
37+
38+
### Security Concerns
39+
40+
- API endpoint lacks input validation
41+
- Sensitive data exposure in error logs
42+
43+
### Best Practices
44+
45+
- Follow consistent naming convention for interface props
46+
- Add type annotations for function parameters
47+
- Consider breaking down large component into smaller ones
48+
49+
### Overall score
50+
51+
⭐⭐⭐⭐ (4/5) - Good PR with some minor improvements needed. The code is well-structured but could benefit from additional security measures and error handling.
52+
53+
---
54+
55+
_Analyzed using anthropic/claude-2_
56+
```
57+
558
## ⚠️ Security First: Managing Secrets
659

760
This action requires an OpenRouter API key. **NEVER** commit API keys or sensitive data directly in your workflow files.
@@ -18,9 +71,9 @@ This action requires an OpenRouter API key. **NEVER** commit API keys or sensiti
1871

1972
The `GITHUB_TOKEN` is automatically provided by GitHub Actions - you don't need to set it up manually.
2073

21-
## Quick Start
74+
## Complete Workflow Example
2275

23-
Create `.github/workflows/pr-review.yml` in your project:
76+
Create `.github/workflows/pr-review.yml` in your project with all available options:
2477

2578
```yaml
2679
name: PR Review
@@ -37,43 +90,69 @@ jobs:
3790
- name: AI PR Review
3891
uses: jonit-dev/openrouter-github-action@main
3992
with:
93+
# Required inputs
4094
github_token: ${{ secrets.GITHUB_TOKEN }} # Automatically provided
4195
open_router_key: ${{ secrets.OPEN_ROUTER_KEY }} # Must be set in repository secrets
42-
model_id: 'anthropic/claude-2'
96+
97+
# Optional inputs with defaults
98+
model_id: 'anthropic/claude-2' # Default model
99+
max_tokens: '2048' # Default max tokens
100+
101+
# Optional custom prompt
102+
custom_prompt: |
103+
You are a security-focused reviewer. Analyze this PR with emphasis on:
104+
1. Security vulnerabilities
105+
2. Authentication issues
106+
3. Data validation
107+
4. Input sanitization
108+
5. Best practices
109+
110+
Provide a 1-5 star rating for the overall quality.
43111
```
44112
45-
## Features
113+
## Configuration Reference
114+
115+
| Input | Description | Required | Default | Notes |
116+
| ----------------- | --------------------------- | -------- | -------------------------- | ---------------------------------------- |
117+
| `github_token` | GitHub token for API access | Yes | `${{ github.token }}` | Automatically provided by GitHub Actions |
118+
| `open_router_key` | Your OpenRouter API key | Yes | - | Must be stored in GitHub Secrets |
119+
| `model_id` | Model ID to use | No | `anthropic/claude-2` | See available models below |
120+
| `custom_prompt` | Custom prompt for analysis | No | Default code review prompt | Can be multiline YAML |
121+
| `max_tokens` | Maximum tokens in response | No | `2048` | Adjust based on review complexity |
46122

47-
- Automated PR code review using AI
48-
- Customizable AI models through OpenRouter
49-
- Vulnerability and bug detection
50-
- Code improvement suggestions
51-
- Custom prompts for specialized analysis
52-
- Performance and security insights
123+
### Minimal Configuration
53124

54-
## Configuration Options
125+
If you only want to use the defaults, this is the minimal configuration needed:
55126

56-
| Input | Description | Required | Default | Security Note |
57-
| ----------------- | --------------------------- | -------- | --------------------- | ---------------------------------------- |
58-
| `github_token` | GitHub token for API access | Yes | `${{ github.token }}` | Automatically provided by GitHub Actions |
59-
| `open_router_key` | Your OpenRouter API key | Yes | - | Must be stored in GitHub Secrets |
60-
| `model_id` | Model ID to use | Yes | anthropic/claude-2 | Safe to include in workflow file |
61-
| `custom_prompt` | Custom prompt for analysis | No | Default prompt | Safe to include in workflow file |
62-
| `max_tokens` | Maximum tokens in response | No | 2048 | Safe to include in workflow file |
127+
```yaml
128+
name: PR Review
129+
on:
130+
pull_request:
131+
types: [opened, synchronize]
63132
64-
## Advanced Usage
133+
jobs:
134+
review:
135+
runs-on: ubuntu-latest
136+
steps:
137+
- uses: actions/checkout@v3
138+
- uses: jonit-dev/openrouter-github-action@main
139+
with:
140+
github_token: ${{ secrets.GITHUB_TOKEN }}
141+
open_router_key: ${{ secrets.OPEN_ROUTER_KEY }}
142+
```
65143

66-
### Custom Model
144+
### Custom Model Example
67145

68146
```yaml
69147
- uses: jonit-dev/openrouter-github-action@main
70148
with:
71149
github_token: ${{ secrets.GITHUB_TOKEN }}
72150
open_router_key: ${{ secrets.OPEN_ROUTER_KEY }}
73-
model_id: 'openai/gpt-4' # Safe to customize
151+
model_id: 'openai/gpt-4'
152+
max_tokens: '4096' # Increased for more detailed reviews
74153
```
75154

76-
### Custom Prompt
155+
### Custom Prompt Example
77156

78157
```yaml
79158
- uses: jonit-dev/openrouter-github-action@main
@@ -88,15 +167,15 @@ jobs:
88167
3. Data validation
89168
4. Input sanitization
90169
5. Best practices
170+
171+
Rate the overall quality from 1-5 stars and provide final comments.
91172
```
92173

93174
## Available Models
94175

95-
Some recommended models:
176+
Recommended models:
96177

97-
- `anthropic/claude-2`: Excellent for detailed code analysis
98-
- `openai/gpt-4`: Strong general-purpose code review
99-
- `anthropic/claude-instant-v1`: Faster, more economical option
178+
- Check best programming ones on [openrouter](https://openrouter.ai/rankings/programming/scripting?view=week)
100179

101180
## Testing Locally
102181

@@ -109,7 +188,7 @@ Some recommended models:
109188
- Never commit the API key directly
110189
- Never include it in environment files
111190
- Always use GitHub Secrets
112-
7. The action will run automatically on your PR
191+
7. The action will run automatically on your PR and post its analysis as a comment
113192

114193
## Security Best Practices
115194

‎dist/index.js‎

Lines changed: 56 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -41626,28 +41626,48 @@ const github = __nccwpck_require__(5438);
4162641626
const axios = __nccwpck_require__(8757);
4162741627

4162841628
async function getPRDiff(octokit, context) {
41629-
const { data: diff } = await octokit.rest.pulls.get({
41630-
owner: context.repo.owner,
41631-
repo: context.repo.repo,
41632-
pull_number: context.payload.pull_request.number,
41633-
mediaType: {
41634-
format: 'diff',
41635-
},
41636-
});
41637-
return diff;
41629+
try {
41630+
const { data: pullRequest } = await octokit.rest.pulls.get({
41631+
owner: context.repo.owner,
41632+
repo: context.repo.repo,
41633+
pull_number: context.payload.pull_request.number,
41634+
mediaType: {
41635+
format: 'diff',
41636+
},
41637+
});
41638+
41639+
return pullRequest;
41640+
} catch (error) {
41641+
throw new Error(`Failed to fetch PR diff: ${error.message}`);
41642+
}
4163841643
}
4163941644

4164041645
async function analyzeDiff(diff, modelId, openRouterKey, customPrompt) {
4164141646
const defaultPrompt = `You are a highly skilled software engineer reviewing a pull request.
41642-
Please analyze the following code changes and provide:
41643-
1. Potential bugs or vulnerabilities
41644-
2. Code improvement suggestions
41645-
3. Performance implications
41646-
4. Security concerns
41647-
5. Best practices violations`;
41647+
Analyze the following code changes and provide a detailed review in the following format:
41648+
41649+
### Potential Issues
41650+
[List any bugs, vulnerabilities, or critical issues]
41651+
41652+
### Improvements Suggested
41653+
[List specific code improvements and refactoring suggestions]
41654+
41655+
### Performance
41656+
[Discuss performance implications and optimization opportunities]
41657+
41658+
### Security Concerns
41659+
[List security issues, if any]
41660+
41661+
### Best Practices
41662+
[Suggest adherence to coding standards and best practices]
41663+
41664+
### Overall score
41665+
[Give a 1-5 star rating for this PR] and final comments
41666+
41667+
Please be specific and provide actionable feedback.`;
4164841668

4164941669
const prompt = customPrompt || defaultPrompt;
41650-
const fullPrompt = `${prompt}\n\nHere's the diff:\n${diff}\n\nPlease provide your analysis in a clear, structured format.`;
41670+
const fullPrompt = `${prompt}\n\nHere's the diff:\n${diff}\n\nProvide your analysis in the specified format.`;
4165141671

4165241672
try {
4165341673
const response = await axios.post(
@@ -41670,24 +41690,37 @@ Please analyze the following code changes and provide:
4167041690
}
4167141691
);
4167241692

41693+
if (!response.data?.choices?.[0]?.message?.content) {
41694+
throw new Error('Invalid response format from OpenRouter API');
41695+
}
41696+
4167341697
return response.data.choices[0].message.content;
4167441698
} catch (error) {
41675-
throw new Error(`OpenRouter API error: ${error.message}`);
41699+
if (error.response?.data) {
41700+
throw new Error(
41701+
`OpenRouter API error: ${JSON.stringify(error.response.data)}`
41702+
);
41703+
}
41704+
throw new Error(`Failed to analyze diff: ${error.message}`);
4167641705
}
4167741706
}
4167841707

4167941708
async function createPRComment(octokit, context, analysis) {
41680-
await octokit.rest.issues.createComment({
41681-
owner: context.repo.owner,
41682-
repo: context.repo.repo,
41683-
issue_number: context.payload.pull_request.number,
41684-
body: `## OpenRouter AI Analysis
41709+
try {
41710+
await octokit.rest.issues.createComment({
41711+
owner: context.repo.owner,
41712+
repo: context.repo.repo,
41713+
issue_number: context.payload.pull_request.number,
41714+
body: `## OpenRouter AI Analysis
4168541715

4168641716
${analysis}
4168741717

4168841718
---
4168941719
*Analyzed using ${core.getInput('model_id')}*`,
41690-
});
41720+
});
41721+
} catch (error) {
41722+
throw new Error(`Failed to create PR comment: ${error.message}`);
41723+
}
4169141724
}
4169241725

4169341726
async function run() {

‎package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
"name": "openrouter-pr-review-action",
33
"version": "1.0.0",
44
"description": "GitHub Action for PR review using OpenRouter AI models",
5-
"main": "index.js",
5+
"main": "dist/index.js",
66
"scripts": {
77
"build": "ncc build src/index.js -o dist",
8-
"test": "jest"
8+
"prepare": "npm run build"
99
},
1010
"dependencies": {
1111
"@actions/core": "^1.10.0",

0 commit comments

Comments
 (0)