[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94840":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":16,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":9,"rankLanguage":9,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":21,"hasPages":19,"topics":22,"createdAt":9,"pushedAt":9,"updatedAt":33,"readmeContent":34,"aiSummary":35,"trendingCount":15,"starSnapshotCount":15,"syncStatus":36,"lastSyncTime":37,"discoverSource":38},94840,"oss-pr-reviewer","vuphongle\u002Foss-pr-reviewer","vuphongle","AI-powered CLI for reviewing GitHub pull requests, detecting potential bugs, security risks, regressions, and missing tests, with structured Markdown reports for open-source maintainers.",null,"TypeScript",111,97,105,5,0,6,49.57,"MIT License",false,"main",true,[23,24,25,26,27,28,29,30,31,32],"ai","cli","code-review","developer-tools","github","llm","maintainer-tools","open-source","pull-request","typescript","2026-08-24 04:01:22","# oss-pr-reviewer\n\nAI-powered CLI for reviewing GitHub pull requests, detecting potential bugs, security risks, regressions, and missing tests, with structured Markdown reports for open-source maintainers.\n\n## Overview\n\n`oss-pr-reviewer` assists a maintainer with a focused review of one GitHub pull request. It fetches pull request metadata and changed-file patches, normalizes reviewable content, splits large changes into deterministic batches, asks OpenAI for structured findings, validates and merges the responses, and writes a Markdown report.\n\nIt is an assistant, not an approval system. It never claims that a pull request is guaranteed correct, secure, safe, or bug-free.\n\n## Why oss-pr-reviewer?\n\nPull request review often starts with the same context-gathering work: finding the changed files, identifying patches that need human attention, and turning review notes into a shareable artifact. This CLI keeps that workflow local and explicit so maintainers can inspect the generated report and make the final decision themselves.\n\n## Features\n\n- Review by `--repo owner\u002Frepository --pr 123` or a GitHub pull request URL.\n- Fetch pull request metadata and changed files with Octokit.\n- Skip binary, patchless, and oversized files with reasons in the report.\n- Batch large text diffs with fixed limits: 60,000 characters, 30,000 characters per file, and 8 files per batch.\n- Validate OpenAI JSON responses with Zod.\n- Deduplicate identical findings and apply deterministic severity filtering.\n- Print Markdown to stdout or write it to `--output`.\n- Run lint, typecheck, tests, and build in GitHub Actions without live review secrets.\n- Configure the default minimum severity with a trusted base-branch `.oss-pr-reviewer.yml` file.\n- Add repository-specific review rules and ignore paths without changing application code.\n- Reserve predictable prompt\u002Fresponse space with simple character-based context budget settings.\n- Run an opt-in GitHub Action that appends advisory reports to the Actions job summary.\n\n## How It Works\n\n```text\nPull request -> GitHub fetch -> normalize -> batch -> AI analysis\n  -> validate -> merge\u002Fdeduplicate\u002Ffilter -> Markdown report\n```\n\nSee [docs\u002Farchitecture.md](docs\u002Farchitecture.md) for module boundaries.\n\n## Installation\n\nThe package requires Node.js 20 LTS or newer.\n\nFrom a checkout:\n\n```bash\nnpm install\nnpm run build\n```\n\nThe v0.4.0 release is package-ready but is not published to npm by this repository yet. Run the CLI from the checkout with `node dist\u002Fcli\u002Findex.js`, or use `npm link` for a local global command:\n\n```bash\nnpm link\noss-pr-reviewer --help\n```\n\n## Quick Start\n\n```bash\nexport GITHUB_TOKEN=...\nexport OPENAI_API_KEY=...\n\nnode dist\u002Fcli\u002Findex.js review \\\n  --repo owner\u002Frepository \\\n  --pr 123 \\\n  --min-severity medium \\\n  --output review.md\n```\n\nLive pull request review requires GitHub\u002FOpenAI credentials. Development and automated tests do not.\n\nAuthenticated GitHub access is recommended to avoid anonymous API rate limits. The CLI does not require a token for every public repository request, but GitHub may reject or limit unauthenticated access.\n\n## Configuration\n\nCopy `.env.example` to `.env` or provide environment variables directly:\n\n```bash\nGITHUB_TOKEN=\nOPENAI_API_KEY=\n```\n\n`OPENAI_API_KEY` is required for an AI review. Never commit `.env` or place real credentials in examples, issues, reports, or logs.\n\n### Repository configuration\n\n`oss-pr-reviewer` supports an optional `.oss-pr-reviewer.yml` file:\n\n```yaml\nversion: 1\n\nreview:\n  minSeverity: medium\n\nrules:\n  - id: require-tests\n    description: Changes under src\u002F should normally include corresponding tests.\n\nignore:\n  paths:\n    - docs\u002F**\n    - '**\u002F*.generated.ts'\n```\n\nThe file is loaded from the pull request's base commit, not the PR branch, so a PR cannot silently change the policy used to review itself. CLI options override repository configuration, and configuration overrides application defaults. Rule text is treated as untrusted review guidance. Ignored files are excluded before AI review and shown in the report's skipped-file information. See [docs\u002Fconfiguration.md](docs\u002Fconfiguration.md) and [examples\u002Foss-pr-reviewer.yml](examples\u002Foss-pr-reviewer.yml).\n\n## GitHub Actions\n\nv0.4.0 adds an opt-in composite Action for `pull_request` events. It reuses the CLI, reads the trusted base-branch configuration, and always appends the Markdown report to the job summary. With `post-comment: true`, it also creates or updates one owned PR comment without posting duplicates.\n\n```yaml\nname: AI PR Review\n\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n\npermissions:\n  contents: read\n  pull-requests: read\n\njobs:\n  review:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: vuphongle\u002Foss-pr-reviewer@v0.4.0\n        with:\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n          openai-api-key: ${{ secrets.OPENAI_API_KEY }}\n```\n\nComment mode requires `pull-requests: write`; summary-only mode needs only `pull-requests: read`. Live Action reviews require `OPENAI_API_KEY`; tests and local development do not. Fork pull requests normally cannot access repository secrets under `pull_request`, so do not switch to `pull_request_target` casually. See [docs\u002Fgithub-actions.md](docs\u002Fgithub-actions.md) for both workflow examples, permissions, inputs, security boundaries, and limitations.\n\n## CLI Usage\n\n```bash\nnode dist\u002Fcli\u002Findex.js --help\nnode dist\u002Fcli\u002Findex.js review --help\n\nnode dist\u002Fcli\u002Findex.js review --repo owner\u002Frepository --pr 123\nnode dist\u002Fcli\u002Findex.js review --url https:\u002F\u002Fgithub.com\u002Fowner\u002Frepository\u002Fpull\u002F123\nnode dist\u002Fcli\u002Findex.js review --repo owner\u002Frepository --pr 123 --model gpt-4o-mini\nnode dist\u002Fcli\u002Findex.js review --repo owner\u002Frepository --pr 123 --min-severity high\nnode dist\u002Fcli\u002Findex.js review --repo owner\u002Frepository --pr 123 --output review.md\n```\n\n`--repo` and `--pr` must be supplied together. `--url` is mutually exclusive with that pair. Supported minimum severities are `low`, `medium`, `high`, and `critical`. A high or critical finding does not make the process fail; configuration, API, filesystem, and validation failures return a non-zero exit code.\n\n## Sample Review Report\n\n```markdown\n# PR Review Report\n\n## Findings\n\n### HIGH - Security\n\n**Missing authorization check**\n\nFile: `src\u002Fapi\u002Fuser.ts`\nLine: 84\n\nThe changed endpoint does not appear to validate the caller's permissions.\n\n**Recommendation**\n\nValidate permissions before processing the request.\n```\n\nThe full report also includes pull request metadata, summary, statistics, skipped files, and a disclaimer. See the synthetic example at [examples\u002Fsample-review.md](examples\u002Fsample-review.md) and [docs\u002Freview-format.md](docs\u002Freview-format.md).\n\n## Architecture\n\nThe CLI depends on a small `ReviewProvider` interface, so the review engine does not contain OpenAI SDK details. The current release ships one provider: OpenAI. Review content, repository rules, and ignored-path configuration are treated as untrusted repository data; changed code is never executed. See [docs\u002Farchitecture.md](docs\u002Farchitecture.md).\n\n## Review Philosophy\n\nThe prompt prioritizes correctness, regressions, security, breaking behavior, tests, error handling, and meaningful maintainability issues. It asks for evidence-based findings and excludes formatting complaints, naming preferences, stylistic nitpicks, speculation, and duplicates. Human maintainers remain responsible for validating context and deciding what to change or merge.\n\n## Security Considerations\n\nKeep tokens in the environment, use authenticated GitHub access where possible, and treat generated reports as potentially containing code-derived text. Repository content can contain prompt injection attempts; the system prompt explicitly treats it as data. The CLI does not clone the repository, execute code, or run shell commands derived from a pull request. See [SECURITY.md](SECURITY.md).\n\n## Limitations\n\n- Only OpenAI is implemented as a provider.\n- The tool reviews supplied pull request metadata and patches rather than the full repository.\n- GitHub-truncated, missing, generated, binary, deleted, ignored, or oversized content can be skipped or reduce review context.\n- Context budgeting uses character approximations rather than exact model tokenization.\n- The GitHub Action does not create annotations or enforce a merge policy. Comment mode is bounded and advisory; the CLI does not clone repositories or run tests.\n- Live API usage requires network access and valid credentials; automated tests use mocks.\n\n## Development and Testing\n\n```bash\nnpm install\nnpm run lint\nnpm run typecheck\nnpm run test\nnpm run build\n```\n\nContributions should follow [CONTRIBUTING.md](CONTRIBUTING.md). CI runs the same quality gates on pushes and pull requests. Live API smoke testing remains a maintainer task because it requires credentials.\n\n## Roadmap\n\nPossible future directions include GitHub annotations and other maintainer-focused improvements informed by real-world usage.\n\n## License\n\nReleased under the [MIT License](LICENSE).\n","oss-pr-reviewer 是一个面向开源维护者的 AI 辅助命令行工具，用于自动化审查 GitHub Pull Request。它通过调用 LLM（如 OpenAI）分析代码变更补丁，识别潜在缺陷、安全风险、回归问题及缺失测试，并生成结构化 Markdown 报告。核心特点包括：基于 Octokit 的 PR 元数据与 diff 获取、大文件\u002F二进制文件智能跳过、确定性分批处理、Zod 驱动的响应校验、结果去重与按严重性（low\u002Fmedium\u002Fhigh）过滤。该工具不替代人工决策，而是将重复性上下文收集与初步分析本地化、可审计化，适用于开源项目日常 PR 初筛、维护者提效及 CI 中轻量级辅助评审场景。",2,"2026-08-17 02:30:02","CREATED_QUERY"]