Automated Code Review

# Review changes since a base ref
python -m src.cli review --base-ref HEAD~3

# Review staged changes only
python -m src.cli review --staged

# Review specific files
python -m src.cli review --files src/api/main.py src/api/auth.py

# Output as SARIF for CI integration
python -m src.cli review --base-ref HEAD~5 --format sarif --output-file report.sarif

# JSON output with separate SARIF file
python -m src.cli review --base-ref HEAD~3 --format json --sarif-file findings.sarif

# Skip security analysis
python -m src.cli review --base-ref HEAD~3 --no-security

# Custom database
python -m src.cli review --db data/projects/postgres.duckdb --base-ref origin/main

import duckdb
from src.patch_review import ReviewWorkflow

# Connect to CPG database
from src.project_manager import ProjectManager
conn = duckdb.connect(ProjectManager.get_active_db_path())

# Configure DoD settings
dod_config = {
    'auto_generate': True,
    'interactive': False,
    'extraction': {
        'sources': ['pr_body', 'jira', 'commit_message'],
        'formats': ['checklist', 'yaml', 'markdown'],
    },
}

# Create workflow
workflow = ReviewWorkflow(conn, dod_config=dod_config)

# Run review
verdict = workflow.run(
    patch_source='git_diff',
    patch_data={'diff': diff_content},
    pr_body=pr_description,
    task_description=task_desc,
    interactive_mode=False,
)

# Access results
print(f"Score: {verdict.overall_score}/100")
print(f"Recommendation: {verdict.recommendation.value}")

# DoD validation results
if verdict.dod_validation:
    print(f"DoD Compliance: {verdict.dod_validation.compliance_score}%")

┌─────────────────────────────────────────────────────────┐
│ Layer 1: CLI Review Pipeline (src/review/)              │
│   ReviewPipeline → ReviewAggregator → ReviewReport      │
│   Entry: python -m src.cli review                       │
│   Focus: CPG quality + security, SARIF, scope-aware     │
├─────────────────────────────────────────────────────────┤
│ Layer 2: Patch Review Workflow (src/patch_review/)       │
│   ReviewWorkflow (LangGraph) → Analyzers → Verdicts     │
│   Entry: ReviewWorkflow.run() / REST API / demo script  │
│   Focus: DoD, delta CPG, PR/MR integration              │
├─────────────────────────────────────────────────────────┤
│ Layer 3: Workflow Scenario 9 (src/workflow/scenarios/)   │
│   PRAnalyzer → ContextAggregator → ReviewReporter       │
│   Entry: MultiScenarioCopilot (scenario_id=code_review) │
│   Focus: LLM-based review, handler optimization         │
└─────────────────────────────────────────────────────────┘

python -m src.cli review [OPTIONS]

pipeline = ReviewPipeline(
    db_path: Optional[str] = None,
    base_ref: Optional[str] = None,
    files: Optional[List[str]] = None,
    staged: bool = False,
    include_security: bool = True,
)
report = pipeline.run()  # -> ReviewReport

@dataclass
class ReviewReport:
    findings: List[ReviewFinding]          # All filtered findings
    cpg_status: Optional[CPGStatus]        # CPG freshness info
    parse_scope: Optional[ParseScope]      # Analysis scope boundaries
    project_name: str                      # Detected project name
    base_ref: str                          # Git base reference
    duration_ms: float                     # Pipeline execution time
    suppressed_count: int                  # Findings suppressed by scope
    metadata: Dict[str, Any]              # Extra info (db_path, counts)

@dataclass
class ReviewFinding:
    file: str                              # Source file path
    line: Optional[int]                    # Line number
    type: str                              # Finding type (dead_code, high_complexity, etc.)
    severity: str                          # critical|high|medium|low|info
    message: str                           # Human-readable description
    suggestion: Optional[str]              # Fix suggestion
    metric_value: Optional[float]          # Numeric metric (CC, LOC, fan_in)
    scope_limited: bool                    # True if affected by partial scope
    source: str                            # "quality" or "security"

@dataclass
class CPGStatus:
    available: bool         # True if DB exists and readable
    fresh: bool             # True if commits_behind == 0
    commits_behind: int     # Number of commits since last CPG update
    commit_hash: str        # CPG's recorded commit hash
    db_path: str            # Database file path

@dataclass
class ParseScope:
    source_path: str                       # Root source directory
    language: str                          # Primary language
    include_tests: bool                    # Whether tests are in CPG
    include_paths: List[str]               # Selective inclusion paths
    exclude_paths: List[str]               # Explicit exclusions
    default_excludes: List[str]            # Default excluded patterns
    import_mode: str                       # "full" or "selective"

# Direct SARIF output
python -m src.cli review --base-ref HEAD~5 --format sarif --output-file report.sarif

# Markdown output + separate SARIF file
python -m src.cli review --base-ref HEAD~5 --format markdown --sarif-file findings.sarif

{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [{
    "tool": {
      "driver": {
        "name": "CodeGraph Review",
        "version": "1.0.0",
        "rules": [
          {"id": "dead_code", "shortDescription": {"text": "Dead Code"}},
          {"id": "high_complexity", "shortDescription": {"text": "High Complexity"}}
        ]
      }
    },
    "results": [
      {
        "ruleId": "high_complexity",
        "level": "warning",
        "message": {"text": "`MyClass.process` has cyclomatic complexity 25"},
        "locations": [{
          "physicalLocation": {
            "artifactLocation": {"uri": "src/service.py"},
            "region": {"startLine": 42}
          }
        }]
      }
    ]
  }]
}

review_pipeline:
  scope_aware_filtering: true
  suppress_tests_outside_scope: true
  demote_dead_code_partial_scope: true

> **Limited analysis scope**
>
> CPG built with exclusions: `vendor/`, `generated/`
>
> This means:
> - Dead code findings may be false positives (callers may exist in excluded modules)
> - Blast radius is underestimated (call graph does not include excluded modules)

parse_patch → extract_dod → [generate_dod] → [confirm_dod] → generate_delta_cpg
    ↓
run_analyzers → generate_verdicts → aggregate_verdict → validate_dod → format_output

## Definition of Done

- [ ] Feature works as expected
- [ ] No security vulnerabilities introduced
- [ ] Unit tests added
- [ ] Documentation updated

dod:
  - description: Feature works as expected
    type: functional
  - description: Unit tests pass
    type: test

{
  "dod": [
    {"description": "Feature works", "type": "functional"},
    {"description": "Tests pass", "type": "test"}
  ]
}

============================================================
DEFINITION OF DONE - CONFIRMATION
============================================================

Current DoD (from pr_body):
----------------------------------------
  1. [FUNC] Feature works as expected
  2. [SECU] No security vulnerabilities introduced
  3. [TEST] Unit tests added for new functionality
  4. [PERF] No performance regressions
  5. [CODE] Code follows project style guidelines
----------------------------------------
Total: 5 items

Options:
  [c] Confirm and continue
  [e] Edit items
  [a] Add new item
  [r] Remove item
  [s] Skip DoD validation
  [q] Quit review

# Request: PatchReviewRequest
{
    "patch_content": "diff --git a/...",       # required
    "task_description": "Add auth feature",     # optional
    "dod_items": ["Tests pass", "No vulns"],    # optional
    "output_format": "json"                     # json|markdown|yaml
}
# Header: Authorization (JWT)

# Request: GitHubPRReviewRequest
{
    "owner": "myorg",
    "repo": "myrepo",
    "pr_number": 123,
    "task_description": "...",    # optional
    "dod_items": [...]            # optional
}
# Header: X-GitHub-Token (required)

# Request: GitLabMRReviewRequest
{
    "project_id": "group/project",
    "mr_iid": 456,
    "gitlab_url": "https://gitlab.com",   # default
    "task_description": "...",
    "dod_items": [...]
}
# Header: X-GitLab-Token (required)

# Request: SourceCraftMRReviewRequest
{
    "project_id": "project-id",
    "mr_iid": 789,
    "sourcecraft_url": "https://api.sourcecraft.yandex.cloud",   # default
    "task_description": "...",
    "dod_items": [...]
}
# Header: X-SourceCraft-Token (required)

# Request: GitVersePRReviewRequest
{
    "project_id": "owner/repo",
    "pr_number": 101,
    "gitverse_url": "https://gitverse.ru/api/v1",   # default
    "task_description": "...",
    "dod_items": [...]
}
# Header: X-GitVerse-Token (required)

# Request: SummaryRequest
{"diff_content": "...", "title": "...", "description": "..."}

# Response: SummaryResponse
{
    "summary": "This MR adds authentication...",
    "changed_files": ["src/auth.py"],
    "additions": 45,
    "deletions": 12,
    "changed_methods": ["authenticate", "reset_password"],
    "risk_areas": ["SQL injection in auth.py"]
}

# Request: CommitMessageRequest
{"diff_content": "..."}

# Response: CommitMessageResponse
{"message": "feat(auth): add password reset flow", "type": "feat", "scope": "auth", "files_changed": 3}

class ReviewResponse:
    recommendation: str      # APPROVE | REQUEST_CHANGES | COMMENT | BLOCK
    score: float             # 0-100
    findings: List[Finding]
    dod_validation: Optional[List[DODItem]]
    summary: str
    processing_time_ms: float
    request_id: str
    metadata: Dict[str, Any]

# Definition of Done Configuration
dod:
  sources:
    - pr_body
    - jira
    - commit_message
    - manual
  source_priority:
    - pr_body
    - jira
    - commit_message
  formats:
    - checklist
    - yaml
    - markdown
    - json
  auto_generate: true
  interactive_confirm: false

  # Jira integration
  jira:
    url: ${JIRA_URL}
    api_key: ${JIRA_API_KEY}
    dod_field: "customfield_10001"

  # DoD generation settings (when auto_generate=true)
  generation:
    use_llm: true
    fallback_to_rules: true
    include_security: true
    include_performance: true
    require_tests: true

  # Validation settings
  validation:
    strict_mode: false
    blocking_severities:
      - critical
      - high

# Review Policy
policy:
  block_on_critical_security: true
  block_on_high_security: false
  block_on_critical_errors: true
  block_on_breaking_changes: false
  min_score_to_approve: 70.0
  min_score_to_comment: 60.0
  max_critical_findings: 0
  max_high_findings: 5
  max_complexity_increase: 20
  require_dod_compliance: false
  min_dod_compliance_score: 60.0
  custom_rules: []

# Analyzer Configuration
analyzers:
  call_graph:
    enabled: true
    max_depth: 5
    include_indirect: true
  dataflow:
    enabled: true
    max_path_length: 10
    sanitization_threshold: 0.7
  control_flow:
    enabled: true
    complexity_threshold: 10
    max_nesting_depth: 5
  dependency:
    enabled: true
    check_circular: true
    max_coupling_increase: 0.2

# Verdict Weights
verdicts:
  weights:
    security: 0.35
    performance: 0.20
    error: 0.25
    architecture: 0.20
  dod_compliance_weight: 0.10
  thresholds:
    block: 40
    request_changes: 60
    comment: 80
    approve: 80

# Output Configuration
output:
  formats:
    - json
    - markdown
    - pr_comment
  include_dod: true
  include_findings: true
  include_snippets: true
  max_findings_per_category: 10
  pr_comment:
    max_length: 10000
    use_emoji: true
    collapsible_sections: true

workflow = ReviewWorkflow(
    conn: duckdb.DuckDBPyConnection,
    config: Optional[AggregationConfig] = None,
    policy: Optional[ReviewPolicy] = None,
    dod_config: Optional[Dict[str, Any]] = None,
)

verdict = workflow.run(
    patch_source: str,          # 'git_diff', 'github_pr', 'gitlab_mr'
    patch_data: Dict[str, Any],
    session_id: Optional[str] = None,
    policy: Optional[ReviewPolicy] = None,
    task_description: Optional[str] = None,
    pr_body: Optional[str] = None,
    jira_ticket: Optional[str] = None,
    interactive_mode: bool = False,
)

@dataclass
class ReviewVerdict:
    # Core
    patch_id: str
    overall_score: float                      # 0-100
    recommendation: Recommendation            # APPROVE, REQUEST_CHANGES, BLOCK, COMMENT
    security: SecurityVerdict
    performance: PerformanceVerdict
    error: ErrorVerdict
    architecture: ArchitectureVerdict

    # Aggregated findings
    all_findings: List[Finding]
    critical_count: int
    high_count: int
    medium_count: int
    low_count: int

    # Impact metrics
    blast_radius_score: float                 # 0-100, higher = smaller radius
    review_time_seconds: float
    summary: str
    reviewed_at: Optional[datetime]

    # DoD
    dod_validation: Optional[DoDValidationResult]
    dod_compliance_score: float               # 0-100, default 100.0

    # Identification
    review_id: str                            # auto-generated REVIEW_xxxx
    session_id: str

@dataclass
class DoDValidationResult:
    dod: DefinitionOfDone
    total_items: int
    satisfied_count: int
    failed_count: int
    pending_count: int
    compliance_score: float                   # 0-100
    blocking_failures: List[DoDItem]

    @property
    def is_compliant(self) -> bool:
        """Computed property: True if failed_count == 0 and pending_count == 0."""
        ...

@dataclass
class ReviewPolicy:
    block_on_critical_security: bool = True
    block_on_high_security: bool = False
    block_on_critical_errors: bool = True
    block_on_breaking_changes: bool = False
    min_score_to_approve: float = 70.0
    min_score_to_comment: float = 60.0
    max_critical_findings: int = 0
    max_high_findings: int = 5
    max_complexity_increase: int = 20
    custom_rules: List[PolicyRule] = field(default_factory=list)

{
  "patch_id": "PATCH_abc123",
  "overall_score": 45.5,
  "recommendation": "REQUEST_CHANGES",
  "dod_compliance_score": 60.0,
  "findings": [...],
  "dod_validation": {
    "compliance_score": 60.0,
    "items": [
      {"description": "...", "satisfied": true, "evidence": "..."},
      {"description": "...", "satisfied": false, "evidence": "..."}
    ]
  }
}

## Patch Review Summary

**Overall Score:** 45/100
**Recommendation:** REQUEST_CHANGES

### Definition of Done

**Compliance Score:** 60%

- [+] Feature works as expected
- [-] No security vulnerabilities introduced
  - Evidence: Security issues found: SQL Injection
- [?] Unit tests added (pending manual review)

### Security Findings

1. [HIGH] SQL Injection vulnerability
   - Location: src/auth/login.py:14
   - CWE-89

gocpg parse --input=/path/to/source --output=project.duckdb

python examples/demo_patch_review.py --db data/projects/postgres.duckdb
python examples/demo_patch_review.py --no-dod
python examples/demo_patch_review.py --auto-dod
python examples/demo_patch_review.py --interactive

pr_data = {
    'number': 123,
    'title': 'Add authentication',
    'body': pr_body_with_dod,
    'diff_url': 'https://api.github.com/repos/...',
}

verdict = workflow.run(
    patch_source='github_pr',
    patch_data=pr_data,
    pr_body=pr_data['body'],
)

mr_data = {
    'iid': 456,
    'title': 'Add authentication',
    'description': mr_description_with_dod,
}

verdict = workflow.run(
    patch_source='gitlab_mr',
    patch_data=mr_data,
    pr_body=mr_data['description'],
)

from src.patch_review.dod import DoDExtractor

extractor = DoDExtractor()
dod = extractor.create_manual_dod(
    items=[
        "Feature works as expected",
        "No security vulnerabilities",
        "Unit tests added",
    ],
    types=["functional", "security", "test"],
)