Skip to content

Commit b2a28c0

Browse files
smochansmochan
committed
feat(ci): codegraph PR review scaffold (template + dry-run script + dependabot)
The PR-review workflow lives at .github/ci-templates/pr-review.workflow.yml (outside .github/workflows/ so a token without the `workflow` OAuth scope can still push the repo). Activation is a one-time copy + push: gh auth refresh -h github.com -s workflow cp .github/ci-templates/pr-review.workflow.yml .github/workflows/pr-review.yml git add .github/workflows/pr-review.yml && git commit && git push Once active, every PR against main: 1. Worktree-checkout origin/main, build, save baseline 2. Build PR head graph 3. codegraph review --fail-on high --format markdown --baseline ... 4. Sticky PR comment via peter-evans/create-or-update-comment (comment-tag: codegraph-review — replaces, doesn't stack) 5. Fail check if findings exceed threshold Concurrency group on PR number with cancel-in-progress; review.md + comment.md + graph.db uploaded as a 7-day artifact for debugging. First-PR graceful path: if no baseline can be saved from main, post a friendly "first-time review" comment and pass. Also adds: - .github/PULL_REQUEST_TEMPLATE.md with a codegraph-signals section - .github/dependabot.yml — weekly pip + github-actions - scripts/test-pr-review-locally.sh — local dry-run that emulates the workflow exactly (worktree-add origin/main, baseline save, review) - README "PR review CI" section with activation + dry-run docs No production code changed; 467 tests still pass; ruff + mypy --strict clean.
1 parent 84d7e92 commit b2a28c0

5 files changed

Lines changed: 277 additions & 0 deletions

File tree

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
## What this PR does
2+
3+
<!-- 1-2 sentences describing the change -->
4+
5+
## Why
6+
7+
<!-- The user-facing or technical reason this change is needed -->
8+
9+
## codegraph signals
10+
11+
<!--
12+
This section is auto-populated by the codegraph CI bot below.
13+
If your PR introduces new dead code, untested public functions, cycles,
14+
or breaks resolver coverage, the bot will flag it as a comment on this PR.
15+
Please address high-severity findings before requesting review.
16+
-->

‎.github/ci-templates/pr-review.workflow.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# codegraph PR review workflow — TEMPLATE
2+
#
3+
# This file lives OUTSIDE .github/workflows/ on purpose: GitHub rejects
4+
# pushes to .github/workflows/* from OAuth tokens that lack the `workflow`
5+
# scope. By keeping the template here, the repo can be cloned + pushed-to
6+
# with the default `repo` scope; activating the workflow is a one-time
7+
# manual step (see README → "PR review CI").
8+
#
9+
# To activate:
10+
# gh auth refresh -h github.com -s workflow
11+
# cp .github/ci-templates/pr-review.workflow.yml .github/workflows/pr-review.yml
12+
# git add .github/workflows/pr-review.yml
13+
# git commit -m "ci: activate codegraph PR review"
14+
# git push
15+
16+
name: codegraph PR review
17+
18+
on:
19+
pull_request:
20+
branches: [main]
21+
types: [opened, synchronize, reopened]
22+
23+
permissions:
24+
contents: read
25+
pull-requests: write
26+
27+
concurrency:
28+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
29+
cancel-in-progress: true
30+
31+
jobs:
32+
review:
33+
runs-on: ubuntu-latest
34+
timeout-minutes: 15
35+
36+
steps:
37+
- name: Checkout PR head
38+
uses: actions/checkout@v4
39+
with:
40+
fetch-depth: 0
41+
42+
- name: Setup Python
43+
uses: actions/setup-python@v5
44+
with:
45+
python-version: "3.10"
46+
cache: pip
47+
48+
- name: Install codegraph (PR head)
49+
run: pip install -e .
50+
51+
- name: Build baseline graph from main
52+
run: |
53+
set -euxo pipefail
54+
mkdir -p .baseline-checkout
55+
git worktree add .baseline-checkout origin/main
56+
(
57+
cd .baseline-checkout
58+
pip install -e . --quiet
59+
codegraph build --no-incremental
60+
codegraph baseline save --output ../.codegraph/baseline.db
61+
)
62+
if [ ! -f .codegraph/baseline.db ]; then
63+
echo "BASELINE_MISSING=1" >> "$GITHUB_ENV"
64+
echo "::warning::No baseline could be saved from main; running first-time review."
65+
fi
66+
67+
- name: Build PR head graph
68+
run: codegraph build --no-incremental
69+
70+
- name: Run codegraph review
71+
run: |
72+
set -uo pipefail
73+
if [ -n "${BASELINE_MISSING:-}" ]; then
74+
cat > review.md <<'EOF'
75+
## codegraph PR review
76+
77+
No baseline graph from `main` was available for this run, so a
78+
full diff review was skipped. The PR head was still parsed
79+
successfully — codegraph review will activate from the next PR.
80+
EOF
81+
exit 0
82+
fi
83+
set +e
84+
codegraph review \
85+
--format markdown \
86+
--output review.md \
87+
--fail-on high \
88+
--baseline .codegraph/baseline.db
89+
rc=$?
90+
set -e
91+
if [ "$rc" -ne 0 ]; then
92+
echo "REVIEW_FAILED=1" >> "$GITHUB_ENV"
93+
fi
94+
95+
- name: Wrap review in comment template
96+
env:
97+
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
98+
run: |
99+
set -e
100+
{
101+
echo "## codegraph PR review"
102+
echo
103+
echo "<details open>"
104+
echo "<summary><b>Diff vs main</b> · severity ≤ <code>high</code></summary>"
105+
echo
106+
cat review.md
107+
echo
108+
echo "</details>"
109+
echo
110+
echo "<sub>Triggered by codegraph CI · <a href=\"${RUN_URL}\">last run</a></sub>"
111+
} > comment.md
112+
113+
- name: Post or update PR comment
114+
uses: peter-evans/create-or-update-comment@v4
115+
with:
116+
issue-number: ${{ github.event.pull_request.number }}
117+
body-file: comment.md
118+
edit-mode: replace
119+
comment-tag: codegraph-review
120+
121+
- name: Upload review artifact
122+
if: always()
123+
uses: actions/upload-artifact@v4
124+
with:
125+
name: codegraph-review
126+
path: |
127+
review.md
128+
comment.md
129+
.codegraph/graph.db
130+
retention-days: 7
131+
132+
- name: Fail if findings exceed threshold
133+
if: env.REVIEW_FAILED == '1'
134+
run: |
135+
echo "::error::codegraph review found high-or-critical findings. See PR comment for details."
136+
exit 1

‎.github/dependabot.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "pip"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
open-pull-requests-limit: 5
8+
labels:
9+
- "dependencies"
10+
- "python"
11+
12+
- package-ecosystem: "github-actions"
13+
directory: "/"
14+
schedule:
15+
interval: "weekly"
16+
open-pull-requests-limit: 3
17+
labels:
18+
- "dependencies"
19+
- "ci"

‎README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,47 @@ node --test tests/*.js # 55 JS tests
417417

418418
---
419419

420+
## PR review CI (dogfood)
421+
422+
`codegraph` ships its own PR-review workflow as a template. Once activated,
423+
every PR opened against `main` runs codegraph against itself, posts the diff
424+
as a sticky PR comment, and fails the check on high-severity findings.
425+
426+
The workflow lives at
427+
[`.github/ci-templates/pr-review.workflow.yml`](.github/ci-templates/pr-review.workflow.yml)
428+
(outside `.github/workflows/` so the repo can be cloned and pushed-to with a
429+
token that lacks the `workflow` OAuth scope). Activate with:
430+
431+
```bash
432+
gh auth refresh -h github.com -s workflow
433+
cp .github/ci-templates/pr-review.workflow.yml .github/workflows/pr-review.yml
434+
git add .github/workflows/pr-review.yml
435+
git commit -m "ci: activate codegraph PR review"
436+
git push
437+
```
438+
439+
Once active, the workflow:
440+
441+
1. Builds a graph from `origin/main` and saves it as a baseline.
442+
2. Builds a graph from the PR head.
443+
3. Runs `codegraph review --format markdown --fail-on high` against the diff.
444+
4. Posts the result as a sticky PR comment (replaced on each push, no spam).
445+
5. Fails the check if any high-or-critical findings appear.
446+
447+
**Local dry-run** before opening a PR:
448+
449+
```bash
450+
git fetch origin main
451+
./scripts/test-pr-review-locally.sh
452+
# writes review.md + comment.md, exits non-zero if findings exceed --fail-on high
453+
```
454+
455+
First-PR graceful path: if no baseline can be saved from `main` (brand-new
456+
repo, empty default branch), the workflow posts a friendly "first-time
457+
review" comment and passes — codegraph review activates from the next PR.
458+
459+
---
460+
420461
## Acknowledgements
421462

422463
`codegraph` stands on:

‎scripts/test-pr-review-locally.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/usr/bin/env bash
2+
# Dry-run the PR review workflow locally so you can validate it before pushing.
3+
#
4+
# Requires:
5+
# - clean repo (no uncommitted changes)
6+
# - origin/main fetched (`git fetch origin main`)
7+
# - codegraph installed in editable mode (`pip install -e .`)
8+
#
9+
# Produces ./review.md and ./comment.md exactly like the CI does, but skips
10+
# the GitHub-API steps (comment posting, artifact upload, exit code).
11+
set -euo pipefail
12+
13+
REPO_ROOT=$(git rev-parse --show-toplevel)
14+
cd "$REPO_ROOT"
15+
16+
if ! git diff-index --quiet HEAD --; then
17+
echo "[WARN] working tree has uncommitted changes; review will reflect them" >&2
18+
fi
19+
20+
if ! command -v codegraph >/dev/null 2>&1; then
21+
echo "[ERROR] codegraph not on PATH — run \`pip install -e .\` first" >&2
22+
exit 1
23+
fi
24+
25+
echo "==> Building baseline from origin/main"
26+
rm -rf /tmp/cg-baseline-checkout
27+
git worktree add /tmp/cg-baseline-checkout origin/main
28+
trap 'git worktree remove --force /tmp/cg-baseline-checkout 2>/dev/null || true' EXIT
29+
30+
(
31+
cd /tmp/cg-baseline-checkout
32+
codegraph build --no-incremental
33+
codegraph baseline save --output "$REPO_ROOT/.codegraph/baseline.db"
34+
)
35+
36+
echo "==> Building PR-head graph"
37+
codegraph build --no-incremental
38+
39+
echo "==> Running codegraph review"
40+
set +e
41+
codegraph review \
42+
--format markdown \
43+
--output review.md \
44+
--fail-on high \
45+
--baseline .codegraph/baseline.db
46+
rc=$?
47+
set -e
48+
49+
echo "==> Wrapping into comment.md"
50+
{
51+
echo "## codegraph PR review"
52+
echo
53+
echo "<details open>"
54+
echo "<summary><b>Diff vs main</b> · severity ≤ <code>high</code></summary>"
55+
echo
56+
cat review.md
57+
echo
58+
echo "</details>"
59+
} > comment.md
60+
61+
echo
62+
echo "----"
63+
echo "review.md and comment.md written. Review exit code: $rc"
64+
echo "(Non-zero = high/critical findings; CI would fail on this.)"
65+
exit "$rc"

0 commit comments

Comments
 (0)