Skip to content

feat: Static code review #7

Merged
jschloman merged 7 commits intomainfrom
feat/code-review-agent
Mar 27, 2026
Merged

feat: Static code review #7
jschloman merged 7 commits intomainfrom
feat/code-review-agent

Conversation

@jschloman
Copy link
Copy Markdown
Owner

Summary

  • Replaces GEMINI.md with CLAUDE.md (same engineering standards, Claude-native format)
  • Adds tools/code_review_agent.py: fetches the PR diff from GitHub API, sends it to claude-sonnet-4-6 with CLAUDE.md as system context, posts a structured review back to the PR
  • Adds .github/workflows/code-review.yml: runs on every PR to main

Review output format

Each review contains:

  • Summary — 1-2 sentence overall assessment
  • Issues — blocking violations (missing type hints, missing docstrings, hardcoded credentials, unsafe patterns)
  • Suggestions — non-blocking improvements

Setup required

Add ANTHROPIC_API_KEY as a repository secret in Settings → Secrets and variables → Actions before merging.

Test plan

  • Add ANTHROPIC_API_KEY secret to the repo
  • Open a test PR with a function missing type hints → confirm agent posts a review flagging it
  • Open a clean PR → confirm agent posts an LGTM summary

Closes #3

🤖 Generated with Claude Code

- Add CLAUDE.md (engineering standards, replaces GEMINI.md)
- Add tools/code_review_agent.py: fetches PR diff, reviews against
  CLAUDE.md via Claude API, posts review to GitHub PR
- Add .github/workflows/code-review.yml: triggers on PRs to main,
  requires ANTHROPIC_API_KEY repo secret

Closes #3
- Replace code_review_agent.py with ruff, mypy, and bandit in CI
- Add tool configs to pyproject.toml (ruff, mypy, bandit)
- Update CLAUDE.md: fix Python version note (3.9+), add Section 7
  with mandatory local quality gate commands to run before every
  commit or push

Closes #3
Ruff:
- Replace deprecated typing.Dict/List with dict/list builtins (UP035/UP006)
- Fix mutable default argument in get_milestones (B006)
- Remove bare try/except/pass in analysis_utils and find_checkin (S110)
- Add usedforsecurity=False to hashlib.md5 (S324)
- Add timeout=30 to requests.get (S113)
- Add per-file E501 ignore for record_flythrough.py (embedded JS f-strings)
- Trim long comment and string literals in analysis_utils, autobiographer, visualize

Mypy:
- Add return type annotations to all untyped functions across all source files
- Add from __future__ import annotations to find_checkin, record_flythrough
- Scope mypy to source files only via [tool.mypy] files config
- Add overrides to skip third-party packages (streamlit, pydeck, plotly, etc.)
- Fix None-guard before Autobiographer() constructor call
- Fix create_recording_assets unpack of possibly-None return value
- Fix sanitize_native return type (Any instead of object)

pyproject.toml:
- Fix mypy exclude to use files= instead of exclude= (Windows path compat)
- Add [[tool.mypy.overrides]] for third-party packages
- Merge python-tests.yml and code-review.yml into ci.yml
- Drop bandit (covered by ruff S rules)
- Single quality job: one checkout, one pip install, ruff + mypy + pytest
- Reduces from 5 jobs / 2 files to 2 jobs / 1 file
@jschloman jschloman changed the title feat: Claude-powered code review agent feat: Static code review Mar 27, 2026
@jschloman jschloman merged commit 36a49f8 into main Mar 27, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: Claude-powered code review agent

1 participant