AI Code Review & Quality Assurance: Automated Excellence

name: AI Code Review
on: [pull_request]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      - name: AI Code Review
        uses: your-org/ai-reviewer@v1
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          review-level: 'comprehensive'
          focus-areas: 'security,performance,maintainability'

const reviewPrompt = `Review this code change for:

1. **Security Issues**
   - SQL injection, XSS, CSRF vulnerabilities
   - Hardcoded secrets or credentials
   - Insecure dependencies

2. **Performance**
   - N+1 queries
   - Memory leaks
   - Unnecessary re-renders (React)

3. **Maintainability**
   - Code duplication
   - Complex conditional logic
   - Missing error handling

4. **Best Practices**
   - TypeScript strict compliance
   - Naming conventions
   - Documentation gaps

Output format:
{
  "severity": "critical|high|medium|low",
  "category": "security|performance|maintainability|style",
  "line": number,
  "issue": "description",
  "suggestion": "how to fix"
}`;

import { Octokit } from '@octokit/rest';
import OpenAI from 'openai';

interface ReviewComment {
  path: string;
  line: number;
  body: string;
  severity: 'critical' | 'high' | 'medium' | 'low';
}

async function reviewPullRequest(
  prNumber: number,
  diff: string
): Promise<ReviewComment[]> {
  const openai = new OpenAI();
  
  const response = await openai.chat.completions.create({
    model: 'gpt-4-turbo',
    messages: [
      { role: 'system', content: reviewPrompt },
      { role: 'user', content: `Review this diff:\n${diff}` }
    ],
    response_format: { type: 'json_object' },
    temperature: 0.3
  });
  
  const findings = JSON.parse(response.choices[0].message.content);
  return findings.issues.map(formatAsComment);
}

async function postReviewComments(
  octokit: Octokit,
  owner: string,
  repo: string,
  prNumber: number,
  comments: ReviewComment[]
) {
  // Filter to only critical and high severity
  const significantComments = comments.filter(
    c => c.severity === 'critical' || c.severity === 'high'
  );
  
  await octokit.pulls.createReview({
    owner,
    repo,
    pull_number: prNumber,
    event: significantComments.some(c => c.severity === 'critical') 
      ? 'REQUEST_CHANGES' 
      : 'COMMENT',
    comments: significantComments.map(c => ({
      path: c.path,
      line: c.line,
      body: `**[${c.severity.toUpperCase()}]** ${c.body}`
    }))
  });
}

interface SecurityFinding {
  cwe: string;
  severity: string;
  description: string;
  remediation: string;
}

async function securityScan(code: string): Promise<SecurityFinding[]> {
  const prompt = `Analyze this code for security vulnerabilities.
  
Reference OWASP Top 10 and CWE database.
For each finding, provide:
- CWE ID
- Severity (Critical/High/Medium/Low)
- Description
- Remediation steps

Code:
${code}`;

  const response = await openai.chat.completions.create({
    model: 'gpt-4-turbo',
    messages: [{ role: 'user', content: prompt }],
    response_format: { type: 'json_object' }
  });
  
  return JSON.parse(response.choices[0].message.content).findings;
}