forked from freeleaps/freeleaps-pub
369 lines
11 KiB
Markdown
369 lines
11 KiB
Markdown
# OpenAI Code Review Integration
|
|
|
|
## Overview
|
|
|
|
The `devbox review` command provides automated code review capabilities powered by OpenAI's GPT-4 model. This feature allows engineers to perform comprehensive code reviews locally before submitting pull requests, helping to catch issues early and improve code quality.
|
|
|
|
## Why OpenAI Code Review?
|
|
|
|
### Problem Statement
|
|
- **Manual Review Bottleneck**: Human code reviews can be slow and inconsistent
|
|
- **Missed Issues**: Important security, performance, and quality issues may be overlooked
|
|
- **Inconsistent Standards**: Different reviewers may have different standards and focus areas
|
|
- **Time Constraints**: Rushed reviews may miss critical problems
|
|
- **Knowledge Gaps**: Reviewers may not be familiar with all best practices
|
|
|
|
### Solution Benefits
|
|
- **Comprehensive Analysis**: AI reviews cover security, performance, code quality, and best practices
|
|
- **Consistent Standards**: Same review criteria applied across all code changes
|
|
- **24/7 Availability**: Reviews can be performed anytime, without waiting for human reviewers
|
|
- **Educational**: Provides explanations and suggestions for improvements
|
|
- **Local Privacy**: Reviews happen locally, keeping your code private
|
|
|
|
## Features
|
|
|
|
### 🔍 **Comprehensive Review Coverage**
|
|
- **Security Analysis**: Identifies potential vulnerabilities, input validation issues, authentication problems
|
|
- **Performance Optimization**: Detects inefficient algorithms, memory leaks, database query issues
|
|
- **Code Quality**: Checks for code smells, maintainability issues, readability problems
|
|
- **Best Practices**: Verifies adherence to language-specific best practices and design patterns
|
|
- **Error Handling**: Assesses error handling, exception management, logging practices
|
|
- **Testing**: Evaluates test coverage, test quality, and mocking practices
|
|
- **Documentation**: Checks for proper documentation, comments, and API documentation
|
|
|
|
### 📊 **Beautiful HTML Reports**
|
|
- **Interactive Interface**: Modern, responsive web interface for viewing reviews
|
|
- **Severity Classification**: Issues categorized as Critical, Warning, Info, or Suggestion
|
|
- **Code Snippets**: Relevant code sections highlighted with line numbers
|
|
- **Actionable Suggestions**: Specific recommendations for improvements
|
|
- **Export Options**: Print reports or export to different formats
|
|
|
|
### 🚀 **Local Web Server**
|
|
- **Instant Access**: View reports immediately in your browser
|
|
- **Report Management**: Browse and manage all review reports
|
|
- **Real-time Updates**: Refresh to see new reports as they're generated
|
|
- **No External Dependencies**: Everything runs locally on your machine
|
|
|
|
## Quick Start
|
|
|
|
### 1. Set Up OpenAI API Key
|
|
|
|
You can provide your OpenAI API key in two ways:
|
|
|
|
**Option A: Environment Variable (Recommended)**
|
|
```bash
|
|
export OPENAI_API_KEY="your-openai-api-key-here"
|
|
```
|
|
|
|
**Option B: Command Line**
|
|
```bash
|
|
devbox review --component=chat --api-key="your-openai-api-key-here"
|
|
```
|
|
|
|
### 2. Perform Your First Review
|
|
|
|
```bash
|
|
# Review the chat component
|
|
devbox review --component=chat
|
|
|
|
# Review with custom port
|
|
devbox review --component=authentication --port=9090
|
|
|
|
# Review without starting the web server
|
|
devbox review --component=content --start-server=false
|
|
```
|
|
|
|
### 3. View Review Reports
|
|
|
|
After running a review, open your browser and navigate to:
|
|
```
|
|
http://localhost:8080
|
|
```
|
|
|
|
## Usage Examples
|
|
|
|
### Basic Review
|
|
```bash
|
|
# Review a specific component
|
|
devbox review --component=chat
|
|
```
|
|
|
|
### Advanced Review Options
|
|
```bash
|
|
# Review with custom API key
|
|
devbox review --component=authentication --api-key="sk-..."
|
|
|
|
# Review on custom port
|
|
devbox review --component=content --port=9090
|
|
|
|
# Review without web server
|
|
devbox review --component=payment --start-server=false
|
|
|
|
# Stop the review server
|
|
devbox review --stop-server
|
|
```
|
|
|
|
### Review Multiple Components
|
|
```bash
|
|
# Review chat component
|
|
devbox review --component=chat
|
|
|
|
# Review authentication component
|
|
devbox review --component=authentication
|
|
|
|
# Review content component
|
|
devbox review --component=content
|
|
```
|
|
|
|
## Configuration
|
|
|
|
### Configuration File
|
|
The code review feature creates a configuration file at `~/.devbox/.code-review/config.yaml`:
|
|
|
|
```yaml
|
|
# OpenAI Code Review Configuration
|
|
openai:
|
|
api_key: "" # Set your OpenAI API key here or use environment variable
|
|
model: "gpt-4" # Model to use for code review
|
|
max_tokens: 4000 # Maximum tokens for review response
|
|
temperature: 0.1 # Lower temperature for more focused reviews
|
|
|
|
review:
|
|
languages:
|
|
- python
|
|
- javascript
|
|
- typescript
|
|
- java
|
|
- go
|
|
- rust
|
|
file_extensions:
|
|
- .py
|
|
- .js
|
|
- .ts
|
|
- .jsx
|
|
- .tsx
|
|
- .java
|
|
- .go
|
|
- .rs
|
|
- .cpp
|
|
- .c
|
|
- .h
|
|
- .hpp
|
|
exclude_patterns:
|
|
- "node_modules/"
|
|
- "__pycache__/"
|
|
- ".git/"
|
|
- "*.min.js"
|
|
- "*.min.css"
|
|
- "dist/"
|
|
- "build/"
|
|
- "target/"
|
|
- "vendor/"
|
|
max_file_size: 100000 # Maximum file size in bytes to review
|
|
max_files_per_review: 50 # Maximum number of files to review at once
|
|
|
|
output:
|
|
format: "html" # html, markdown, json
|
|
include_suggestions: true
|
|
include_severity: true
|
|
include_line_numbers: true
|
|
include_code_snippets: true
|
|
```
|
|
|
|
### Customizing Review Settings
|
|
|
|
You can modify the configuration file to:
|
|
- Change the OpenAI model (e.g., gpt-3.5-turbo for faster, cheaper reviews)
|
|
- Adjust the number of tokens used
|
|
- Add or remove supported file types
|
|
- Modify exclusion patterns
|
|
- Change output format preferences
|
|
|
|
## Review Process
|
|
|
|
### 1. File Detection
|
|
The system automatically detects changed files in your component:
|
|
- Staged changes (`git diff --cached`)
|
|
- Unstaged changes (`git diff`)
|
|
- Filters by supported file extensions
|
|
- Respects exclusion patterns
|
|
|
|
### 2. Content Preparation
|
|
- Reads file contents
|
|
- Prepares context for OpenAI
|
|
- Limits file size and count for optimal performance
|
|
|
|
### 3. AI Review
|
|
- Sends code to OpenAI GPT-4
|
|
- Uses specialized prompt for code review
|
|
- Receives comprehensive analysis
|
|
|
|
### 4. Report Generation
|
|
- Parses AI response
|
|
- Generates structured review data
|
|
- Creates beautiful HTML report
|
|
- Starts local web server
|
|
|
|
### 5. Review Interface
|
|
- Modern, responsive web interface
|
|
- Severity-based issue categorization
|
|
- Code snippets with line numbers
|
|
- Actionable improvement suggestions
|
|
|
|
## Review Categories
|
|
|
|
### 🔴 Critical Issues
|
|
- Security vulnerabilities
|
|
- Potential crashes or data loss
|
|
- Critical performance problems
|
|
- Major architectural issues
|
|
|
|
### 🟡 Warnings
|
|
- Code quality issues
|
|
- Potential bugs
|
|
- Performance concerns
|
|
- Best practice violations
|
|
|
|
### 🔵 Info
|
|
- Style and formatting issues
|
|
- Documentation improvements
|
|
- Minor optimizations
|
|
- Educational notes
|
|
|
|
### 🟢 Suggestions
|
|
- Enhancement opportunities
|
|
- Alternative approaches
|
|
- Future improvements
|
|
- Learning opportunities
|
|
|
|
## Best Practices
|
|
|
|
### Before Submitting PRs
|
|
1. **Run Local Tests**: Ensure your code passes all tests
|
|
2. **Perform Code Review**: Use `devbox review` to get AI feedback
|
|
3. **Address Issues**: Fix critical and warning issues
|
|
4. **Review Suggestions**: Consider implementing improvement suggestions
|
|
5. **Submit PR**: Only after addressing important issues
|
|
|
|
### Optimizing Review Quality
|
|
1. **Keep Changes Focused**: Smaller, focused changes get better reviews
|
|
2. **Include Context**: Make sure related files are included
|
|
3. **Use Descriptive Commits**: Clear commit messages help with context
|
|
4. **Review Regularly**: Don't wait until the end to review
|
|
|
|
### Cost Management
|
|
1. **Monitor Usage**: Keep track of API token usage
|
|
2. **Use Appropriate Models**: Consider gpt-3.5-turbo for routine reviews
|
|
3. **Limit File Count**: Focus on the most important files
|
|
4. **Batch Reviews**: Review multiple related changes together
|
|
|
|
## Troubleshooting
|
|
|
|
### Common Issues
|
|
|
|
**API Key Not Found**
|
|
```bash
|
|
Error: OpenAI API key not found
|
|
```
|
|
**Solution**: Set the `OPENAI_API_KEY` environment variable or use `--api-key` parameter
|
|
|
|
**API Connectivity Issues**
|
|
```bash
|
|
Error: OpenAI API connectivity test failed
|
|
```
|
|
**Solution**: Check your internet connection and API key validity
|
|
|
|
**No Changed Files**
|
|
```bash
|
|
Warning: No changed files found for review
|
|
```
|
|
**Solution**: Make sure you have staged or unstaged changes in your component
|
|
|
|
**Server Port Already in Use**
|
|
```bash
|
|
Error: Port 8080 is already in use
|
|
```
|
|
**Solution**: Use a different port with `--port` parameter
|
|
|
|
### Performance Tips
|
|
|
|
1. **Limit File Size**: Large files take longer to review and cost more
|
|
2. **Use Appropriate Model**: gpt-3.5-turbo is faster and cheaper than gpt-4
|
|
3. **Review Incrementally**: Review changes as you make them, not all at once
|
|
4. **Exclude Generated Files**: Add generated files to exclusion patterns
|
|
|
|
## Integration with Workflow
|
|
|
|
### Pre-PR Checklist
|
|
```bash
|
|
# 1. Run tests
|
|
devbox package --component=chat --test-mode=test
|
|
|
|
# 2. Perform code review
|
|
devbox review --component=chat
|
|
|
|
# 3. Address review issues
|
|
# (Fix code based on review feedback)
|
|
|
|
# 4. Re-review if needed
|
|
devbox review --component=chat
|
|
|
|
# 5. Submit PR
|
|
git push origin feature/chat-improvements
|
|
```
|
|
|
|
### CI/CD Integration
|
|
The code review feature can be integrated into your CI/CD pipeline:
|
|
- Run reviews automatically on pull requests
|
|
- Block merges if critical issues are found
|
|
- Generate review reports for team review
|
|
- Track review metrics over time
|
|
|
|
## Security and Privacy
|
|
|
|
### Local Processing
|
|
- All code review processing happens locally
|
|
- No code is stored on external servers
|
|
- API calls only send code content to OpenAI
|
|
- Review reports are stored locally
|
|
|
|
### API Key Security
|
|
- Store API keys in environment variables
|
|
- Never commit API keys to version control
|
|
- Use different API keys for different environments
|
|
- Monitor API usage for unusual activity
|
|
|
|
## Future Enhancements
|
|
|
|
### Planned Features
|
|
- **Custom Review Templates**: Define project-specific review criteria
|
|
- **Team Review Integration**: Share reviews with team members
|
|
- **Historical Tracking**: Track review metrics over time
|
|
- **Automated Fixes**: Suggest and apply automatic fixes
|
|
- **Multi-language Support**: Enhanced support for more programming languages
|
|
- **IDE Integration**: Direct integration with popular IDEs
|
|
|
|
### Advanced Capabilities
|
|
- **Context-Aware Reviews**: Consider project history and architecture
|
|
- **Performance Profiling**: Automated performance analysis
|
|
- **Security Scanning**: Integration with security scanning tools
|
|
- **Compliance Checking**: Verify compliance with coding standards
|
|
|
|
## Support
|
|
|
|
### Getting Help
|
|
- Check the troubleshooting section above
|
|
- Review the configuration options
|
|
- Ensure your OpenAI API key is valid and has sufficient credits
|
|
- Verify your component directory structure
|
|
|
|
### Contributing
|
|
The code review feature is designed to be extensible. You can:
|
|
- Customize review prompts for your specific needs
|
|
- Add support for additional file types
|
|
- Enhance the HTML report templates
|
|
- Integrate with additional tools and services
|
|
|
|
---
|
|
|
|
**Note**: The OpenAI code review feature requires an active OpenAI API key and internet connectivity. API usage is subject to OpenAI's pricing and rate limits. |