Closed
Conversation
📝 WalkthroughWalkthroughAdds a new AI-driven PR description system: a reusable PR description library, an orchestrating script that calls OpenAI and updates PRs, optional LangSmith tracing utilities, unit tests, a GitHub Actions workflow, and package.json additions for LangSmith. Changes
Sequence DiagramssequenceDiagram
participant GitHub as GitHub (Events & API)
participant Script as PR AI Script
participant OpenAI as OpenAI Chat API
participant LangSmith as LangSmith (Optional)
participant GH_Client as GitHub API Client
GitHub->>Script: PR opened/reopened/updated
Script->>Script: Init config, logging, tracing
Script->>GH_Client: Fetch PR details & repo labels
GH_Client-->>Script: Labels & PR metadata
Script->>Script: Compute diff (compare API or git)
Script->>Script: Filter files, mask secrets, truncate
Script->>OpenAI: Send chat request with schema & diff
alt AI Success
OpenAI-->>Script: JSON summary
Script->>Script: Validate & extract title/labels/summary
else AI Failure
OpenAI-->>Script: Error/timeout
Script->>Script: Log & handle gracefully
end
Script->>GH_Client: Apply labels, update PR body/title
GH_Client-->>Script: ACK
opt LangSmith enabled
Script->>LangSmith: create/update trace runs
LangSmith-->>Script: Trace responses
end
Script->>GitHub: Write step summary
sequenceDiagram
participant Caller as Caller
participant Config as resolveLangSmithTraceConfig()
participant Tracer as createLangSmithTracer()
participant LangSmithClient as LangSmith SDK
Caller->>Config: Read env
Config-->>Caller: {enabled, reason, apiKey, endpoint, projectName, workspaceId}
Caller->>Tracer: Initialize with env/logger/clientFactory
alt Tracing enabled
Tracer->>LangSmithClient: Create or use provided client
LangSmithClient-->>Tracer: Client instance
else Tracing disabled
Tracer-->>Caller: No-op tracer
end
Caller->>Tracer: withRun({name,...}, executeFn)
Tracer->>LangSmithClient: createRun(startPayload)
LangSmithClient-->>Tracer: Run ID
Tracer->>Caller: Execute function
alt Success
Caller-->>Tracer: Result
Tracer->>LangSmithClient: updateRun(outputs, end_time)
else Failure
Caller-->>Tracer: Error
Tracer->>LangSmithClient: updateRun(error, end_time)
end
LangSmithClient-->>Tracer: Ack
Tracer-->>Caller: Return result or rethrow error
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/scripts/pr-ai-description-lib.mjs:
- Around line 6-14: DEFAULT_EXCLUDE_GLOBS is missing common secret-bearing
filename patterns; update the array to include sensitive file globs (e.g.,
'.env*', '*.pem', '*.key', '*.p12', '*.crt', '*.asc', 'id_rsa', 'id_dsa',
'.aws/**', '.gnupg/**', '.ssh/**', '.docker/**', 'secrets/**', 'private*') so
any PR diff scanned for AI description generation (see pr-ai-description.mjs
usage surrounding DEFAULT_EXCLUDE_GLOBS) will skip these files; add the patterns
to the DEFAULT_EXCLUDE_GLOBS constant and ensure they are normalized as globs
consistent with existing entries.
- Around line 402-417: The maskSensitiveContent function's regexes are too
narrow; expand them to cover common key names (api_key, api-key, client_secret,
access_token, refresh_token, private_key, client_id, etc.) in
snake_case/kebab-case and mixed case by adding case-insensitive patterns (e.g.,
/(?:"?(?:password|secret|token|apiKey|api_key|api-key|client_secret|access_token|private_key|refresh_token|client_id)"?\s*[:=]\s*).../gim)
and add a dedicated multiline PEM/block masker that matches -----BEGIN [A-Z
]+-----[\s\S]*?-----END [A-Z ]+-----/gim to replace the entire block with
[REDACTED PEM]. Also widen the Bearer/Authorization rules to catch variants like
"authorization: bearer ..." and ensure all regexes use global and multiline
flags so replaceAll removes single- and multi-line credentials consistently;
update the existing replaceAll calls in maskSensitiveContent accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e17050c9-2fd4-4455-afdd-6045ddf061af
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (7)
.github/scripts/__tests__/langsmith-tracer.spec.mjs.github/scripts/__tests__/pr-ai-description-lib.spec.mjs.github/scripts/langsmith-tracer.mjs.github/scripts/pr-ai-description-lib.mjs.github/scripts/pr-ai-description.mjs.github/workflows/pr-ai-description.ymlpackage.json
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/scripts/pr-ai-description.mjs:
- Line 143: The file .github/scripts/pr-ai-description.mjs has Prettier
formatting violations (e.g., the line creating `const error = new
Error(\`github-api-error:${response.status}:${routePath}\`)` and other ranges
listed); run the project's formatter (prettier --write) or your editor's format
command on this file to fix all `prettier/prettier` errors, re-save the file,
and re-run lint/CI to ensure ranges (319-324, 350, 378-382, etc.) are cleared;
no code logic changes are needed—only apply Prettier formatting to the file
containing symbols like `error`, `response`, and `routePath`.
- Around line 459-465: AI_RESPONSE_JSON_SCHEMA's required array is missing the
'labels' entry which conflicts with the schema's declared properties and causes
OpenAI strict json_schema errors; update the AI_RESPONSE_JSON_SCHEMA definition
to include 'labels' in its required array (ensure the 'labels' property already
defined in the schema remains unchanged) so the schema's required list matches
declared properties used by the json_schema call in response_format.
- Line 22: Replace the hardcoded TARGET_ASSIGNEE constant with a configurable
value (read from process.env.TARGET_ASSIGNEE with a sensible default) so
assignee can be set per-environment, and update the assignee handling logic in
addAssignee to treat GitHub 422 responses as non-fatal: either extend
isPermissionError to consider status 422 or catch the 422 error in addAssignee,
log a warning including the error details, and continue without failing the
workflow (leave existing behavior for 401/403 intact). Ensure references to
TARGET_ASSIGNEE and addAssignee/isPermissionError are updated consistently.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3de7286b-e5c7-4df9-854a-ffa5ddf47c87
📒 Files selected for processing (1)
.github/scripts/pr-ai-description.mjs
github-actions
bot
changed the title
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (2)
.github/scripts/pr-ai-description-lib.mjs (2)
6-14:⚠️ Potential issue | 🟠 MajorHarden default exclusions to prevent accidental secret exfiltration.
This still omits common secret-bearing files at Line 6-Line 14, so sensitive diffs can be sent to external AI processing.
🔐 Proposed hardening
export const DEFAULT_EXCLUDE_GLOBS = [ 'yarn.lock', 'package-lock.json', 'pnpm-lock.yaml', '**/*.snap', 'dist/**', 'coverage/**', '**/*.map', + '.env', + '.env.*', + '**/*.pem', + '**/*.key', + '**/*.p12', + '**/*.jks', + '**/*id_rsa*', + '**/*id_ed25519*', + '**/.aws/**', + '**/.ssh/**', + '**/secrets/**', ];🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/scripts/pr-ai-description-lib.mjs around lines 6 - 14, DEFAULT_EXCLUDE_GLOBS is too permissive and may allow secret-bearing files to be sent; update the array to include common secret and credential patterns such as .env and .env.* files, .npmrc, .netrc, .git-credentials, .docker/config.json, AWS and cloud credentials (e.g., **/aws/credentials, **/gcloud/**), SSH keys and known_hosts (e.g., **/.ssh/**, **/*.pem, **/*.key, **/*.crt), kube configs and Helm secrets, and any secrets.* or *.secret.* patterns so these are never included in AI-processing diffs. Modify the DEFAULT_EXCLUDE_GLOBS constant accordingly and ensure patterns are broad (globstar) and account for dotfiles and nested paths to prevent accidental exfiltration.
402-417:⚠️ Potential issue | 🟠 MajorBroaden masking rules for common credential formats and PEM blocks.
maskSensitiveContentat Line 402-Line 417 remains too narrow and can miss frequent key variants and multiline private key blocks.🛡️ Proposed masking expansion
return text .replaceAll(/(Authorization\s*[:=]\s*)([^\n\r]+)/gi, '$1[REDACTED]') .replaceAll(/Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi, 'Bearer [REDACTED]') + .replaceAll( + /-----BEGIN [A-Z0-9 ]+-----[\s\S]*?-----END [A-Z0-9 ]+-----/g, + '[REDACTED_PEM]', + ) .replaceAll( - /(\"?(?:password|secret|token|apiKey)\"?\s*[:=]\s*)\"([^\"\n\r]*)\"/gi, + /(\"?(?:password|secret|token|api[_-]?key|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?id)\"?\s*[:=]\s*)\"([^\"\n\r]*)\"/gi, '$1"[REDACTED]"', ) .replaceAll( - /(\"?(?:password|secret|token|apiKey)\"?\s*[:=]\s*)([^\s,\n\r]+)/gi, + /(\"?(?:password|secret|token|api[_-]?key|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?id)\"?\s*[:=]\s*)([^\s,\n\r]+)/gi, '$1[REDACTED]', );🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/scripts/pr-ai-description-lib.mjs around lines 402 - 417, The maskSensitiveContent function currently misses many credential name variants and multiline PEM blocks; update its replacement rules to (1) expand the key-name patterns in the existing regexes used in maskSensitiveContent to include common variants like api_key, api-key, client_secret, clientId, access_token, refresh_token (case-insensitive, with optional quotes and separators), (2) add a dedicated regex to detect and redact PEM/private-key blocks between "-----BEGIN (RSA|PRIVATE|ENCRYPTED|OPENSSH) KEY-----" and the matching "-----END ... KEY-----" using a multiline/dotall-aware pattern, and (3) ensure regex flags include global and dotAll (or [\s\S] as needed) so multiline secrets are captured; apply these changes within maskSensitiveContent so existing replaceAll calls are extended/replaced to cover these variants and PEM blocks.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/scripts/pr-ai-description-lib.mjs:
- Around line 30-706: Prettier/formatting errors are failing CI; run the
repository formatter (Prettier) on this file and re-save so formatting matches
project rules (fixes around declarations like IMPACT_KEYS, functions
globToRegExp, parseAdditionalExcludeGlobs, renderTruncationNotice/composeDiff,
buildLimitedDiff, maskSensitiveContent, renderSummaryBlock, upsertSummaryBlock,
filterKnownLabels and shouldApplyTitle), then commit the formatted file so
ESLint/Prettier violations (reported on lines near the functions above) are
resolved.
- Around line 645-697: The function filterKnownLabels currently assumes aiLabels
and repoLabelNames are iterable arrays and will throw if either is
null/undefined or not an array; update filterKnownLabels to defensively
normalize inputs by treating non-array values as empty arrays (e.g., if
!Array.isArray(repoLabelNames) set repoLabelNames = [] and likewise for
aiLabels) before the for...of loops, so the canonicalLabelMap and
label-processing loops never iterate over invalid values and the function
returns the existing shape ({ applicableLabels, unknownLabelsIgnoredCount })
safely.
- Around line 700-707: The function shouldApplyTitle calls labelNames.some and
can throw if labelNames is null/undefined; guard by normalizing labelNames to an
array (e.g., treat missing or non-array labelNames as [] ) before calling .some,
or add an early return when labelNames is falsy; update shouldApplyTitle to
reference the normalized array when checking for the 'ai-title-lock' label so
.some is never invoked on undefined.
---
Duplicate comments:
In @.github/scripts/pr-ai-description-lib.mjs:
- Around line 6-14: DEFAULT_EXCLUDE_GLOBS is too permissive and may allow
secret-bearing files to be sent; update the array to include common secret and
credential patterns such as .env and .env.* files, .npmrc, .netrc,
.git-credentials, .docker/config.json, AWS and cloud credentials (e.g.,
**/aws/credentials, **/gcloud/**), SSH keys and known_hosts (e.g., **/.ssh/**,
**/*.pem, **/*.key, **/*.crt), kube configs and Helm secrets, and any secrets.*
or *.secret.* patterns so these are never included in AI-processing diffs.
Modify the DEFAULT_EXCLUDE_GLOBS constant accordingly and ensure patterns are
broad (globstar) and account for dotfiles and nested paths to prevent accidental
exfiltration.
- Around line 402-417: The maskSensitiveContent function currently misses many
credential name variants and multiline PEM blocks; update its replacement rules
to (1) expand the key-name patterns in the existing regexes used in
maskSensitiveContent to include common variants like api_key, api-key,
client_secret, clientId, access_token, refresh_token (case-insensitive, with
optional quotes and separators), (2) add a dedicated regex to detect and redact
PEM/private-key blocks between "-----BEGIN (RSA|PRIVATE|ENCRYPTED|OPENSSH)
KEY-----" and the matching "-----END ... KEY-----" using a
multiline/dotall-aware pattern, and (3) ensure regex flags include global and
dotAll (or [\s\S] as needed) so multiline secrets are captured; apply these
changes within maskSensitiveContent so existing replaceAll calls are
extended/replaced to cover these variants and PEM blocks.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 62d100fe-e4da-453d-ada6-3baf87d1c041
📒 Files selected for processing (1)
.github/scripts/pr-ai-description-lib.mjs
chanwoo7
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Tests
Chores
AI PR 요약
제목 제안
PR AI Description 기능 추가 및 LangSmith 트레이싱 통합
요약
이 PR은 PR AI 요약 생성 기능을 새로 도입하고, LangSmith 트레이싱 기능을 통합하여 PR 변경사항을 자동으로 분석하고 요약하는 기능을 구현합니다. GitHub Actions 워크플로우를 통해 PR 이벤트 발생 시 AI 기반 요약을 생성하고, PR 본문과 라벨, 담당자를 자동으로 업데이트합니다.
변경사항
영향도
체크리스트
리스크
메타