docs: update README with v6.28 features + add adaptive_api_token support - #56
Conversation
…include adaptive_api_token
github-actions
Bot
changed the title
🤖 Review Buddy - General Code Review
Code Review for @AnkanSahaCode Quality Score: 8/10 ⭐ Arre bhai @AnkanSaha, kya baat hai! Version bump kar diya v6.27 se v6.28 tak — choti si change hai lekin documentation ka kaam solid hai. README.md mein itna detailed update? Shabash! 🎉 Kya Achha Hai:
Thoda Sa Improvement:
Verdict: Code changes minimal hain (sirf config + docs), lekin documentation quality top-notch hai. Title fix karo, baaki APPROVE kar denge! 👍 Generated by Review Buddy | Tone: roast | Language: hinglish |
⚡ Review Buddy - Performance Analysis
Performance Analysis — Hinglish Roast Edition 🚀Bhai @AnkanSaha, performance analyze karne ke liye code chahiye — yahan toh sirf documentation aur config changes hain! 😄 Koi algorithm, loop, database query, ya memory allocation wala code nahi dikh raha. Toh main documentation ke "performance claims" ka post-mortem karta hoon — kyunki README mein bade bade claims hain: 1. "Single AI API Call Per PR" Claim> **💰 Cost-Efficient**: Review Buddy makes only **ONE** AI API call per PR to generate the complete review reportReality Check: Naye README mein likha hai: > Small PRs get reviewed in a **single** AI call. Large PRs automatically split into a bounded per-file review...Analysis: Pehle "ONE call" claim tha, ab "bounded per-file" with "hard-capped file count". Ye map-reduce pattern hai — Performance Impact:
Recommendation: README mein "bounded concurrency" ka exact number mention karo (e.g., 2. Full-Repo Context vs Diff-Only> **🧠 Full-Repo Context**: Review Buddy checks out your repo and builds a full-file, import-aware viewCost: Optimization:
Suggestion: Workflow mein add karo: - uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history for git diff contextLekin 3. Map-Reduce Scaling ArchitectureNayi files:
Complexity Analysis:
Critical Path: API latency dominates.
Code Example (Expected in concurrency.js): // src/utils/concurrency.js
import pLimit from 'p-limit';
export const createBoundedMapper = (concurrency = 5) => {
const limit = pLimit(concurrency);
return async (items, mapper) => {
return Promise.all(items.map(item => limit(() => mapper(item))));
};
};Agar ye nahi hai toh add karo — warna 100 files ke PR mein API rate limit se fail hoga. 4. Token Budget Management
Formula (Expected): const availableTokens = modelContextTokens - systemPromptTokens - reserveTokens;
const tokensPerFile = avgTokensPerFileReview;
const maxFiles = Math.floor(availableTokens / tokensPerFile);Risk: 5. Caching & Incremental ReviewsREADME claim:
Implementation Needed:
Performance Win: Avoids re-reviewing unchanged files. Must have for large PRs with multiple pushes. 6. Memory & CPU in GitHub Actions Runner
7. Database/External Calls — N/AKoi database nahi, sirf GitHub API + AI Provider API. 8. N+1 Problem in GitHub API
9. Async PatternsExpected: 10. Summary & Score
Overall Performance Architecture: 7/10 — Good design, implementation details need verification in source files. Action Items for @AnkanSaha:
Bhai, architecture toh badiya likhi hai — ab implementation bhi waisi hi honi chahiye! 💪 Generated by Review Buddy | Tone: roast | Language: hinglish |
🔐 Review Buddy - Security Audit
Security Audit — Hinglish Roast Edition 🔒Bhai @AnkanSaha, security audit karne ke liye actual code chahiye — yahan toh sirf README, workflow, VERSION, aur ek config file delete hui hai. Koi authentication logic, input validation, SQL query, ya command execution ka code nahi dikh raha. Toh main supply chain, secrets management, aur documentation claims ka audit karta hoon: 🔴 CRITICAL Issues — NONE FOUND (Code changes mein)🟠 HIGH Issues — NONE FOUND🟡 MEDIUM Issues1. Secret Exposure Risk in Workflow LogsLocation: gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
adaptive_api_token: ${{ secrets.ADAPTIVE_API_TOKEN }}Issue: GitHub Actions masks secrets in logs automatically, lekin agar action internally
2. Unpinned Action Version —
|
| Check | Status | Priority |
|---|---|---|
| Secret logging prevention in adapters | ❓ Unknown | Critical |
| Prompt injection sanitization | ❓ Unknown | High |
| AI response sanitization before GitHub comment | ❓ Unknown | High |
| Pre-AI secret scanning (gitleaks) | ❓ Unknown | Medium |
| Pinned action versions in workflow | ❌ No (uses @main) | High |
| Dependency vulnerability scanning (npm audit) | ❓ Unknown | Medium |
| SAST on action code (CodeQL) | ❓ Unknown | Medium |
Supply chain: package.json dependencies pinned |
❓ Unknown | High |
🎯 Final Security Verdict
No critical/high issues IN THIS DIFF — kyunki diff mein sirf docs/config hai.
BUT @AnkanSaha bhai, asli security src/ folder mein hai! Ye diff sirf tip of iceberg hai. Main expect karta hoon:
- Pin
@mainto@v6.28in workflow — TURANT KARO - Secret scanning before AI call —
gitContext.jsmein add karo - Prompt injection defense —
toneInstructions.js+ prompt builders mein - Dependency audit —
npm auditCI mein add karo - CodeQL workflow —
.github/workflows/codeql.ymlbanao
Security Score for this PR: 7/10 (Only because workflow unpinned @main — baaki code review ke liye src/ chahiye)
Bhai, workflow pin karo pehle, baaki baad mein! 🔐
Generated by Review Buddy | Tone: roast | Language: hinglish
📊 Review Buddy - Code Quality & Maintainability Analysis
🎯 Overall Benchmark: 82/100 (Good)Code Quality Analysis — Hinglish Roast Edition 📝Bhai @AnkanSaha, quality analyze karne ke liye source code chahiye —
Toh main documentation quality, workflow quality, aur architecture claims ka review karta hoon jo README mein hain. Asli code quality 📚 Documentation Quality — 9/10 ⭐README.md Changes Analysis: ✅ Strengths:
|
| Module | Claim | Quality Indicators to Verify |
|---|---|---|
gitContext.js |
Full-file + import graph (1-hop) | AST parser (babel/ts-morph)? Error handling? Symlink handling? |
contextBudget.js |
Token budget + merge guard | Accurate token estimation? Model-specific configs? Unit tests? |
concurrency.js |
Bounded map helper | p-limit used? Configurable limit? Backpressure handling? |
fileReviewPrompt.js |
Per-file prompt | Prompt size optimization? Context relevance? |
mergeReviewPrompt.js |
Synthesis prompt | Deduplication logic? Priority weighting? |
toneInstructions.js |
Shared tone guidance | DRY? All tones covered? Extensible? |
tests/*.test.js |
Jest unit tests | Coverage >80%? Edge cases? Integration tests? |
Risk: README over-promises, implementation under-delivers. Trust but verify.
🗑️ Deleted File — .gemini/settings.json
{
"version": "1.0",
"project": { "name": "ReviewBuddy", "type": "GitHub Action", ... },
"context": { "fileName": [...], "hierarchical": true },
"tools": { "enabled": [...] }
}Analysis: Gemini-specific config tha. Ab multi-provider (OpenRouter, GitHub Models) support aaya toh obsolete ho gaya. Good cleanup — dead code removal.
But: Check karo koi src/ code is file ko require/import toh nahi karta. Grep karo: grep -r "\.gemini/settings" src/
📦 VERSION Bump — Correct
v6.27 → v6.28 — Patch version for docs/config changes. Semantic versioning follow kiya ✅
🔍 Code Smells in Diff (What's Visible)
1. Workflow YAML — No Newline at EOF
- gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
\ No newline at end of file
+ gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
+ adaptive_api_token: ${{ secrets.ADAPTIVE_API_TOKEN }}
\ No newline at end of fileIssue: Git shows \ No newline at end of file. POSIX standard violation — some tools break. Fix: Add newline.
2. README — Duplicate Section
Lines 33-35 and 37-39 both start with > **💰 Cost-Efficient**. Merge them.
3. Project Structure — action.yml Comment Mismatch
-├── action.yml # GitHub Action definition & metadata
+├── action.yml # GitHub Action definition & metadata (includes its own checkout step)Question: action.yml mein runs.steps mein actions/checkout hai? Agar haan, toh workflow mein duplicate checkout hoga! Check karo.
📊 Quality Metrics Scorecard
| Category | Score (1-10) | Weight | Weighted |
|---|---|---|---|
| Documentation | 9 | 30% | 2.7 |
| Workflow Config | 6 | 20% | 1.2 |
| Architecture Claims | 7 | 25% | 1.75 |
| Versioning | 10 | 10% | 1.0 |
| Cleanup (dead code) | 8 | 10% | 0.8 |
| Code Smells (visible) | 7 | 5% | 0.35 |
| Total | 100% | 7.8/10 |
🎯 Action Items for @AnkanSaha
- PIN WORKFLOW ACTIONS —
@main→@v6.28,@v4→ SHA (CRITICAL) - Fix EOF newline in workflow YAML
- Merge duplicate Cost-Efficient sections in README
- Add version badge in README (shields.io)
- Verify
action.ymldoesn't duplicate checkout - PROVIDE
src/DIFF next time — asli quality wahan hai!
**Bhai, documentation toh PAAD DIYA (excellent) — lekin workflow pin karo warna SECURITY AUDIT FAIL kar dunga! 😤
Overall Quality Score: 8/10 — Docs ke liye 9, workflow ke liye 6, average 7.5 → round up to 8 kyunki intent achha hai.
Shabash bhai, documentation likhne mein maza aaya padhne mein! 📖💪
Generated by Review Buddy | Tone: roast | Language: hinglish
💡 Review Buddy - Best Practices & Alternative Suggestions
Best Practices & Alternative Suggestions — Hinglish Roast Edition 💡Bhai @AnkanSaha, diff sirf config, workflow, docs ka hai — koi application code nahi. Toh main YAML, Markdown, aur Versioning best practices cover karta hoon: 1. GitHub Actions — Pin to SHA, Not TagsCurrent (Bad): # .github/workflows/review_buddy.yml
- uses: actions/checkout@v4
- uses: nexoral/ReviewBuddy@mainBetter (Secure & Reproducible): - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: nexoral/ReviewBuddy@v6.28 # Exact version tagWhy:
2. YAML — Always End File with NewlineCurrent (Bad): gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
adaptive_api_token: ${{ secrets.ADAPTIVE_API_TOKEN }}(Git shows gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
adaptive_api_token: ${{ secrets.ADAPTIVE_API_TOKEN }}(Add empty line at end — POSIX compliant)
3. README — Avoid Duplicate ContentCurrent (Lines 33-39): > **💰 Cost-Efficient**: Review Buddy makes only **ONE** AI API call per PR...
>
> **💰 Cost-Efficient**: Small PRs get reviewed in a **single** AI call...Better (Merged): > **💰 Cost-Efficient**: Small PRs get reviewed in a **single** AI call. Large PRs automatically split into a bounded per-file review (hard-capped file count, budget-aware) instead of one giant prompt — cost scales predictably, never unbounded.Why:
4. Version File — Add Newline (Consistency)Current: (No newline — Git shows (With trailing newline) 5. Documentation — Add Version BadgeMissing in README: 
Why:
6. Workflow — Use Environment Variables for Repeated ValuesCurrent: adapter: ${{ secrets.ADAPTER }}
model: ${{ secrets.MODEL }}
gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
adaptive_api_token: ${{ secrets.ADAPTIVE_API_TOKEN }}Better (if multiple jobs/steps): env:
ADAPTER: ${{ secrets.ADAPTER }}
MODEL: ${{ secrets.MODEL }}
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
ADAPTIVE_API_TOKEN: ${{ secrets.ADAPTIVE_API_TOKEN }}
steps:
- uses: nexoral/ReviewBuddy@v6.28
with:
adapter: ${{ env.ADAPTER }}
model: ${{ env.MODEL }}
gemini_api_key: ${{ env.GEMINI_API_KEY }}
adaptive_api_token: ${{ env.ADAPTIVE_API_TOKEN }}Why:
7. Markdown — Use Relative Links for Internal DocsCurrent (README lines 200+): [Google AI Studio](https://makersuite.google.com/)
[OpenRouter](https://openrouter.ai/)Better: Keep absolute for external, but for repo files: [Contributing Guide](CONTRIBUTING.md)
[Security Policy](SECURITY.md)Already doing this ✅ — Good job! 8. Changelog / Release Notes — Missing!Add ## v6.28 (2024-XX-XX)
### Documentation
- Updated README with full-repo context, map-reduce scaling, incremental /buddy
- Added multi-provider setup guides (OpenRouter, GitHub Models)
- Improved FAQ with huge PR and incremental review questions
### Configuration
- Added `adaptive_api_token` input for generic API token support
- Removed deprecated `.gemini/settings.json`
### Internal
- New modules: gitContext, contextBudget, concurrency
- Map-reduce prompts: fileReviewPrompt, mergeReviewPrompt
- Tone instructions shared module
- Jest test suite addedWhy:
9. Package.json — Missing from Diff but ReferencedREADME claims: Ensure it has: {
"name": "review-buddy",
"version": "6.28.0",
"scripts": {
"test": "jest --coverage",
"lint": "eslint src/",
"prepare": "husky install"
},
"devDependencies": {
"jest": "^29.0.0",
"eslint": "^8.0.0",
"husky": "^8.0.0"
},
"engines": {
"node": ">=18.0.0"
}
}Why: Version sync with 10. Action.yml — Verify Composite Action StructureSince workflow uses # action.yml
name: 'Review Buddy'
description: 'AI-powered code review'
runs:
using: 'node20' # or 'composite'
main: 'dist/index.js' # if node20
# OR for composite:
# steps:
# - run: npm ci
# - run: node dist/index.jsCheck: Summary: Code Follows Best Practices? MOSTLY YES ✅
Bhai, 5 minute lagega sab fix karne mein — kar do, PROFESSIONAL lagega! 😎 Generated by Review Buddy | Tone: roast | Language: hinglish |
github-actions
Bot
added
documentation
|
|
/buddy @main wala chahiye bhai, issue automatically latest wala le lega, baki mai fix karta hu abhi |
1 participant
Summary
This PR updates Review Buddy to v6.28 with major documentation overhaul, new multi-provider support via
adaptive_api_token, and architecture improvements for scaling to large PRs.Changes
📚 Documentation (README.md)
/buddyFollow-ups — incremental diff detection for new commitsgitContext.js,contextBudget.js,concurrency.js, map-reduce prompts, test suite)⚙️ Configuration & Workflow
adaptive_api_tokeninput — generic API token for OpenRouter/GitHub Models.gemini/settings.json— Gemini-specific config no longer needed🏗️ Architecture (Claimed in Docs — Implementation in
src/)gitContext.js— Full-file + 1-hop import graph context (falls back to API diff)contextBudget.js— Per-model token budgeting + merge-step size guardconcurrency.js— Bounded-concurrency map helper for large PRsfileReviewPrompt.js/mergeReviewPrompt.js— Map-reduce prompt templatestoneInstructions.js— Shared tone/language guidancetests/— Jest unit tests for utils, github, gitContext, contextBudget, concurrency📦 Version
VERSIONfromv6.27tov6.28(patch — docs/config only)Verification
Manual Testing Checklist
adaptive_api_tokensecretAutomated Checks
npm testpasses (Jest suite)npm run lintpasses (ESLint)Breaking Changes
None — This is a documentation and configuration update only. No changes to:
adaptive_api_token)Migration Guide
For existing users:
ADAPTIVE_API_TOKENsecret if using OpenRouter or GitHub Modelsuses: nexoral/ReviewBuddy@v6.28Related Issues