Skip to content

REVIEW.md

Latest commit

 

History

History
68 lines (50 loc) · 2.28 KB

REVIEW.md

File metadata and controls

68 lines (50 loc) · 2.28 KB

REVIEW.md — AI PR Review Guidelines

This document defines how the AI-powered code review works in this repository.

What Gets Reviewed

Every Pull Request automatically triggers an AI review that checks:

Kubernetes YAML Files (k8s/)

  • ✅ Correct apiVersion for each resource kind
  • ✅ Namespace consistency across related resources
  • ✅ No hardcoded secrets or API keys
  • ✅ Resource names follow kebab-case convention
  • ✅ Required labels and annotations present
  • ✅ Secret references use correct key names (e.g. Authorization for agentgateway)

agentgateway Resources

  • ✅ AgentgatewayBackend uses agentgateway.dev/v1alpha1 apiVersion
  • ✅ Model name is cost-effective (prefer claude-3-haiku-* over claude-sonnet or claude-opus)
  • ✅ Auth policy uses secretRef (not inline credentials)
  • ✅ Gateway name matches parentRefs in HTTPRoute

kagent Resources

  • ✅ ModelConfig points to agentgateway (not directly to Anthropic API)
  • ✅ baseUrl uses internal K8s service DNS (.svc.cluster.local)
  • ✅ API key references use Kubernetes Secret, not plain text

GitHub Actions Workflows

  • ✅ Secrets accessed via ${{ secrets.* }} — never hardcoded
  • ✅ Workflow triggers are appropriate (not too broad)
  • ✅ Steps have meaningful names

Security Checks

  • 🔴 BLOCK: Any file containing sk-ant-api03- (real Anthropic key)
  • 🔴 BLOCK: Secrets in stringData with real values
  • 🟡 WARN: Missing resource limits in pod specs
  • 🟡 WARN: Using latest image tag

Review Output Format

The AI review posts a comment on the PR with this structure:

## 🤖 AI Code Review

### Summary
[Brief description of changes]

### Issues Found
| Severity | File | Line | Issue |
|----------|------|------|-------|
| 🔴 CRITICAL | k8s/secret.yaml | 8 | Real API key detected! |
| 🟡 WARNING | k8s/backend.yaml | 12 | Expensive model selected |
| 🟢 INFO | k8s/gateway.yaml | - | Consider adding resource limits |

### Recommendations
[Specific actionable suggestions]

### Verdict
✅ APPROVED / ⚠️ NEEDS CHANGES / 🔴 BLOCKED

How to Configure

Set the following GitHub repository secrets:

  • ANTHROPIC_API_KEY — your Anthropic API key for running reviews

Configure review sensitivity in .github/workflows/ai-review.yaml.