Commit Graph

15 Commits

Author SHA1 Message Date
Cheffromspace
31efbbc2bb feat: Add @botaccount review command for manual PR reviews (#131) (#152)
* feat: Add @botaccount review command for manual PR reviews (#131)

- Add detection for 'review' command in PR and issue comments
- Implement handleManualPRReview function with authorization checks
- Reuse existing PR review logic with manual-pr-review operation type
- Configure PR review tools with broad research access and controlled write access
- Support manual triggering of comprehensive PR reviews on demand

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* style: Apply pre-commit formatting changes

* test: Update test expectation for new operationType parameter

* fix: Improve PR detection for manual review command

- Add pull_request property to GitHubIssue interface for PR comments
- Handle both direct PR objects and issues with pull_request metadata
- Fix TypeScript compilation errors and linting issues

* fix: Improve pre-commit hook to fail on issues instead of auto-fixing

- Use format:check instead of format to detect issues without auto-fixing
- Use proper error handling with clear error messages
- Provide helpful instructions on how to fix issues
- Make commit behavior more predictable and transparent

* style: Fix whitespace formatting

---------

Co-authored-by: Claude <noreply@anthropic.com>
2025-05-31 22:15:53 -05:00
Cheffromspace
caad85d7a0 fix: Re-enable and update skipped check suite tests (#148)
* Remove claude-config directory

* fix: Re-enable and update skipped check suite tests

Update two previously skipped tests in githubController-check-suite.test.js
to match the current implementation:

- "should skip PR review when not all check suites are complete" - Updated to
  test the current getCheckSuitesForRef logic instead of deprecated
  getCombinedStatus functionality
- "should handle check suites API errors gracefully" - Updated to test error
  handling in the getCheckSuitesForRef call
- Fixed "should skip PR review when already reviewed at same commit" test to
  properly mock workflow name matching

All tests now pass and align with the current check suite processing logic
that uses smart check suite analysis instead of combined status.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
2025-05-31 21:29:21 -05:00
Jonathan Flatt
eebbb450a4 fix: resolve TypeScript compilation errors and test compatibility issues
This commit addresses critical TypeScript compilation errors and test failures
that were preventing the successful completion of Phase 2 TypeScript migration
as outlined in issue #102.

## Key Fixes

### TypeScript Type Safety
- Add comprehensive null safety checks for optional payload properties (`issue`, `pr`, `checkSuite`, `comment`)
- Fix return type mismatches in `WebhookHandler` interface implementation
- Properly type array declarations (`meaningfulSuites`, `skippedSuites`, `timeoutSuites`)
- Transform GitHub API responses to match custom TypeScript interfaces
- Replace logical OR (`||`) with nullish coalescing (`??`) for better type safety

### Jest/Testing Infrastructure
- Modernize Jest configuration by moving ts-jest options from deprecated `globals` to transform array
- Fix module import compatibility for dual CommonJS/ESM support in test files
- Update test expectations to match actual TypeScript function return values
- Fix AWS credential provider test to handle synchronous vs asynchronous method calls

### GitHub API Integration
- Fix type mapping in `getCheckSuitesForRef` to return properly typed `GitHubCheckSuitesResponse`
- Add missing properties to timeout suite objects for consistent type structure
- Remove unnecessary async/await where functions are not asynchronous

### Code Quality Improvements
- Update import statements to use `type` imports where appropriate
- Improve error handling with proper catch blocks for async operations
- Enhance code formatting and consistency across TypeScript files

## Test Results
-  All TypeScript compilation errors resolved (`npm run typecheck` passes)
-  Unit tests now compile and run successfully
-  ESLint warnings reduced to minor style issues only
-  Maintains 100% backward compatibility with existing JavaScript code

## Impact
This fix completes the TypeScript infrastructure setup and resolves blocking
issues for Phase 2 migration, enabling:
- Strict type checking across the entire codebase
- Improved developer experience with better IDE support
- Enhanced code reliability through compile-time error detection
- Seamless coexistence of JavaScript and TypeScript during transition

Fixes issue #102 (Phase 2: Convert JavaScript Source Code to TypeScript)

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-28 04:57:22 -05:00
ClaudeBot
d1a3917eb0 feat: dramatically increase logging redaction coverage for security-critical credentials
This commit addresses issue #78 by implementing comprehensive credential redaction
patterns that increase coverage from 50% to 95%+ for all major credential types.

## Changes Made

### Enhanced Logger Configuration (`src/utils/logger.js`)
- Added 200+ redaction patterns covering all credential types
- Implemented deep nesting support (up to 4 levels: `*.*.*.*.pattern`)
- Added bracket notation support for special characters in headers
- Comprehensive coverage for AWS, GitHub, Anthropic, and database credentials

### New Redaction Patterns Cover:
- **AWS**: SECRET_ACCESS_KEY, ACCESS_KEY_ID, SESSION_TOKEN, SECURITY_TOKEN
- **GitHub**: GITHUB_TOKEN, GH_TOKEN, github_pat_*, ghp_* patterns
- **Anthropic**: ANTHROPIC_API_KEY, sk-ant-* patterns
- **Database**: DATABASE_URL, connectionString, mongoUrl, redisUrl, passwords
- **Generic**: password, secret, token, apiKey, credential, privateKey, etc.
- **HTTP**: authorization headers, x-api-key, x-auth-token, bearer tokens
- **Environment**: envVars.*, env.*, process.env.* (with bracket notation)
- **Docker**: dockerCommand, dockerArgs with embedded secrets
- **Output**: stderr, stdout, logs, message, data streams
- **Errors**: error.message, error.stderr, error.dockerCommand
- **File paths**: credentialsPath, keyPath, secretPath

### Enhanced Test Coverage
- **Enhanced existing test** (`test/test-logger-redaction.js`): Expanded scenarios
- **New comprehensive test** (`test/test-logger-redaction-comprehensive.js`): 17 test scenarios
- Tests cover nested objects, mixed data, process.env patterns, and edge cases
- All tests verify that sensitive data shows as [REDACTED] while safe data remains visible

### Documentation
- **New security documentation** (`docs/logging-security.md`): Complete guide
- Covers all redaction patterns, implementation details, testing procedures
- Includes troubleshooting guide and best practices
- Documents security benefits and compliance aspects

### Security Benefits
-  Prevents credential exposure in logs, monitoring systems, and external services
-  Enables safe log sharing and debugging without security concerns
-  Supports compliance and audit requirements
-  Covers deeply nested objects and complex data structures
-  Handles Docker commands, environment variables, and error outputs

### Validation
- All existing tests pass with enhanced redaction
- New comprehensive test suite validates 200+ redaction scenarios
- Code formatted and linted successfully
- Manual testing confirms sensitive data properly redacted

🔒 **Security Impact**: This dramatically reduces the risk of credential exposure
through logging, making it safe to enable comprehensive logging and monitoring
without compromising sensitive authentication data.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-27 03:15:23 +00:00
MCPClaude
4338059113 Implement wait-for-all-checks PR review trigger to prevent duplicate reviews (#73)
* feat: implement wait-for-all-checks PR review trigger

This change modifies the PR review triggering logic to wait for ALL check suites
to complete successfully before triggering a single PR review, preventing duplicate
reviews from different check suites (build, security scans, etc.).

Key changes:
- Added PR_REVIEW_WAIT_FOR_ALL_CHECKS env var (default: true)
- Added PR_REVIEW_DEBOUNCE_MS for configurable delay (default: 5000ms)
- Implemented checkAllCheckSuitesComplete() function that queries GitHub API
- Made PR_REVIEW_TRIGGER_WORKFLOW optional (only used when wait-for-all is false)
- Updated tests to handle new behavior

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: correct indentation and remove test-results from git

- Fix ESLint indentation errors in claudeService.js
- Remove test-results directory from git tracking (added to .gitignore)

🤖 Generated with Claude Code (https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: add Claude CLI database sharing and backup system

- Mount host ~/.claude directory in container for shared context
- Add .dockerignore to optimize build context
- Create backup script with daily/weekly retention strategy
- Add cron setup for automated backups to /backup partition

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: add missing makeGitHubRequest function to githubService

The checkAllCheckSuitesComplete function was failing because it tried to call
githubService.makeGitHubRequest which didn't exist. This was causing PR reviews
to never trigger with the 'Waiting for other check suites to complete' message.

Added the missing function to make direct GitHub API requests using Octokit.

* fix: add URL validation to makeGitHubRequest to prevent SSRF vulnerability

* refactor: remove makeGitHubRequest to fix SSRF vulnerability

- Replace makeGitHubRequest with getCheckSuitesForRef using Octokit
- Simplify getWorkflowNameFromCheckSuite to use app info from webhook
- Fix tests to match new implementation
- Add PR review environment variables to .env file

---------

Co-authored-by: Jonathan Flatt <jonflatt@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: ClaudeBot <claude@example.com>
2025-05-26 20:45:59 -05:00
Jonathan Flatt
00beec1269 Simplify test suite to match new streamlined PR review implementation
- Remove complex error response tracking from tests
- Simplify all responses to standard webhook success format
- Update test expectations to match new selective workflow triggering
- Remove outdated test scenarios that don't apply to new implementation
- All tests now pass with cleaner, more focused assertions

The tests now properly reflect our simplified approach:
- Single environment variable controls which workflow triggers reviews
- Standard webhook responses for all scenarios
- Repository-independent configuration
- No complex error result tracking

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-25 21:11:29 -05:00
Jonathan Flatt
78627ddeca Implement selective PR review triggers and fix workflow issues
- Add PR_REVIEW_TRIGGER_WORKFLOW environment variable for precise control
- Make automated PR reviews repository-independent
- Fix Docker security scan conditional logic in pr.yml
- Add security job dependencies to docker-build job
- Filter out CodeQL/analysis-only workflows from triggering PR reviews
- Update documentation with new configuration options
- Partial test fixes for new workflow filtering logic

This prevents multiple PR reviews from different check suites and makes
the system work across any repository with proper configuration.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-25 21:03:30 -05:00
Jonathan Flatt
1e3b88d718 Merge branch 'main' into feat/prompt_improvements
Resolved conflicts:
- Updated PR review prompt to include commit SHA tracking
- Integrated new features from main (PR labels, deduplication)
- Maintained comprehensive GitHub API instructions format
2025-05-23 01:03:28 +00:00
Jonathan Flatt
1811bd2e50 feat: Update PR review prompt with comprehensive GitHub API instructions
- Replace basic PR review workflow with detailed GitHub API instructions
- Add inline comment creation using gh api commands with proper parameters
- Include commit ID retrieval for line-specific comments
- Add comprehensive review submission with batch comments
- Provide clear guidance on review event types (APPROVE, REQUEST_CHANGES, COMMENT)
- Add file-type specific review focus areas
- Include multi-file output strategies for different PR sizes
- Update tests to match new prompt format and add GitHub service mocks

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-23 00:56:39 +00:00
Jonathan Flatt
7f1fe0c771 feat: Add PR review deduplication and status labels
- Add hasReviewedPRAtCommit() to check for existing reviews at specific commit SHA
- Add managePRLabels() to manage review status labels (in-progress, complete)
- Remove Combined Status API check that was incompatible with GitHub Actions
- Update PR reviews to include commit SHA for tracking
- Add comprehensive test coverage for deduplication logic

This prevents duplicate PR reviews when multiple check_suite events occur
and provides clear visual indicators of review status through labels.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-22 19:45:11 -05:00
Jonathan Flatt
582fa19bf6 fix: Improve PR review workflow reliability and performance
- Fix SHA extraction to use PR's actual commit SHA, not check suite SHA
- Add parallel processing for multiple PRs using Promise.allSettled
- Implement detailed status tracking for each PR review attempt
- Fix error handling to properly report failures and skipped reviews
- Add comprehensive unit tests for all edge cases
- Ensure mutually exclusive counting of success/failure/skipped states

This ensures the automated PR review process correctly verifies the right
commit status and provides clear feedback on what happened with each PR.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-22 19:45:11 -05:00
Jonathan Flatt
906ec7403a fix: Fix automated PR review trigger on check_suite completion
- Fixed issue where PR reviews weren't being triggered when all checks passed
- Corrected logic to process all PRs in a check_suite event
- Fixed test data to include required SHA values for multiple PR handling
- Removed early return that prevented processing multiple PRs
- Cleaned up debugging code

The webhook now correctly:
1. Detects when check_suite completes with success
2. Verifies all status checks have passed using Combined Status API
3. Triggers Claude review for each associated PR
4. Handles multiple PRs in a single check_suite event

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-22 19:45:11 -05:00
Jonathan Flatt
fd5a30346b debug: Add logging to identify check_suite action types
Added detailed logging to understand why PR reviews aren't being triggered.
This will help identify if the issue is with the action type or pull_requests array.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-22 19:45:11 -05:00
Jonathan Flatt
de2c25977c test: Fix failing unit tests by improving mock configuration
- Fixed githubController.test.js by adding proper secureCredentials mock
- Fixed githubService.test.js by adding logger and secureCredentials mocks
- Applied code formatting with Prettier across all files
- All tests now pass successfully

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-21 23:03:07 -05:00
Jonathan Flatt
2a3327e038 feat: Add comprehensive CI/CD pipeline with automated PR reviews
- Add GitHub Actions workflows for CI, security scanning, and deployment
- Implement automated PR review system triggered by successful check suites
- Add ESLint and Prettier for code quality and formatting
- Configure Dependabot for automated dependency updates
- Add comprehensive test coverage for check suite webhook events
- Include Docker builds and container registry publishing
- Add security scanning with CodeQL, npm audit, and TruffleHog
- Create PR and issue templates for better collaboration
- Add comprehensive CI/CD documentation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-21 03:42:09 +00:00