Skip to content

Commit 02ac122

Browse files
ashishkurmiashishkurmi
authored
Merge pull request #4 from step-security/int
main <- int
2 parents 787ff21 + b5b858a commit 02ac122

File tree

15 files changed

+998
-1
lines changed

15 files changed

+998
-1
lines changed

‎.github/workflows/publish-container-image.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Publish Container Image
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
- int
9+
10+
permissions: # added using https://github.com/step-security/secure-repo
11+
contents: read
12+
13+
jobs:
14+
publish:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
packages: write
19+
steps:
20+
- name: Harden Runner
21+
uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969 # v2.4.0
22+
with:
23+
egress-policy: block
24+
allowed-endpoints: >
25+
auth.docker.io:443
26+
deb.debian.org:80
27+
ghcr.io:443
28+
github.com:443
29+
production.cloudflare.docker.com:443
30+
proxy.golang.org:443
31+
registry-1.docker.io:443
32+
33+
- name: Checkout Code
34+
uses: actions/checkout@master
35+
with:
36+
ref: ${{ github.ref }}
37+
38+
- name: Publish to Registry (int)
39+
uses: elgohr/Publish-Docker-Github-Action@v5
40+
env:
41+
API_ENDPOINT: "https://int.api.stepsecurity.io"
42+
if: startsWith(github.ref, 'refs/heads/int')
43+
with:
44+
name: step-security/ai-codewise/int:latest
45+
username: ${{ github.actor }}
46+
password: ${{ secrets.GITHUB_TOKEN }}
47+
registry: ghcr.io
48+
buildargs: API_ENDPOINT
49+
50+
- name: Publish to Registry (main)
51+
uses: elgohr/Publish-Docker-Github-Action@v5
52+
env:
53+
API_ENDPOINT: "https://agent.api.stepsecurity.io"
54+
if: startsWith(github.ref, 'refs/heads/main')
55+
with:
56+
name: step-security/ai-codewise/main:latest
57+
username: ${{ github.actor }}
58+
password: ${{ secrets.GITHUB_TOKEN }}
59+
registry: ghcr.io
60+
buildargs: API_ENDPOINT

‎.github/workflows/release-action.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Release New Action Version
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
TAG_NAME:
6+
description: "Tag name that the major tag will point to"
7+
required: true
8+
9+
env:
10+
TAG_NAME: ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }}
11+
defaults:
12+
run:
13+
shell: pwsh
14+
15+
permissions: # added using https://github.com/step-security/secure-workflows
16+
contents: read
17+
18+
jobs:
19+
update_tag:
20+
permissions:
21+
id-token: write
22+
name: Update the major tag to include the ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }} changes
23+
# Remember to configure the releaseNewActionVersion environment with required approvers in the repository settings
24+
environment:
25+
name: releaseNewActionVersion
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969
29+
with:
30+
allowed-endpoints: api.github.com:443
31+
github.com:443
32+
prod.api.stepsecurity.io:443
33+
- name: Update the ${{ env.TAG_NAME }} tag
34+
uses: step-security/publish-action@b438f840875fdcb7d1de4fc3d1d30e86cf6acb5d
35+
with:
36+
source-tag: ${{ env.TAG_NAME }}
37+
token: ${{ steps.wait-for-secrets.outputs.PAT }}

‎.github/workflows/release-container-image.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Release Container Image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: "Tag"
8+
required: true
9+
10+
permissions: # added using https://github.com/step-security/secure-repo
11+
contents: read
12+
13+
jobs:
14+
release:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
packages: write
19+
steps:
20+
- name: Harden Runner
21+
uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969 # v2.4.0
22+
with:
23+
disable-sudo: true
24+
egress-policy: block
25+
allowed-endpoints: >
26+
deb.debian.org:80
27+
ghcr.io:443
28+
github.com:443
29+
production.cloudflare.docker.com:443
30+
proxy.golang.org:443
31+
registry-1.docker.io:443
32+
auth.docker.io:443
33+
34+
- name: Code Checkout
35+
uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222 # main
36+
37+
- name: Publish to registry
38+
uses: elgohr/Publish-Docker-Github-Action@43dc228e327224b2eda11c8883232afd5b34943b # v5
39+
env:
40+
API_ENDPOINT: "https://agent.api.stepsecurity.io"
41+
if: startsWith(github.ref, 'refs/heads/main')
42+
with:
43+
name: step-security/ai-codewise:${{ github.event.inputs.tag }}
44+
username: ${{ github.actor }}
45+
password: ${{ secrets.GITHUB_TOKEN }}
46+
registry: ghcr.io
47+
buildargs: API_ENDPOINT

‎.github/workflows/test.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Test
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
- int
8+
9+
permissions: # added using https://github.com/step-security/secure-repo
10+
contents: read
11+
12+
jobs:
13+
test:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Harden Runner
17+
uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969 # v2.4.0
18+
with:
19+
egress-policy: audit
20+
21+
- name: Code Checkout
22+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
23+
24+
- name: Set up Go
25+
uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
26+
with:
27+
go-version: 1.19
28+
29+
- name: Build
30+
run: go build -v ./...
31+
32+
- name: Test
33+
run: go test -v ./...
34+
35+
- name: Build Container Image (int)
36+
uses: elgohr/Publish-Docker-Github-Action@43dc228e327224b2eda11c8883232afd5b34943b # v5
37+
env:
38+
API_ENDPOINT: "https://int.api.stepsecurity.io"
39+
if: startsWith(github.ref, 'refs/heads/int')
40+
with:
41+
no_push: true
42+
buildargs: API_ENDPOINT
43+
44+
- name: Build Container Image (main)
45+
uses: elgohr/Publish-Docker-Github-Action@43dc228e327224b2eda11c8883232afd5b34943b # v5
46+
env:
47+
API_ENDPOINT: "https://agent.api.stepsecurity.io"
48+
if: startsWith(github.ref, 'refs/heads/main')
49+
with:
50+
no_push: true
51+
buildargs: API_ENDPOINT

‎Dockerfile‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
FROM golang:1.19 AS builder
2+
3+
ENV GO111MODULE=on \
4+
CGO_ENABLED=0 \
5+
GOOS=linux \
6+
GOARCH=amd64
7+
8+
RUN apt-get -qq update && \
9+
apt-get -yqq install upx
10+
11+
WORKDIR /
12+
COPY . .
13+
ARG API_ENDPOINT
14+
RUN echo "API Endpoint: $API_ENDPOINT"
15+
RUN go build -ldflags "-X main.APIEndpoint=$API_ENDPOINT" \
16+
-a \
17+
-o /bin/app \
18+
. \
19+
&& strip /bin/app \
20+
&& upx -q -9 /bin/app
21+
22+
RUN echo "nobody:x:65534:65534:Nobody:/:" > /etc_passwd
23+
24+
25+
FROM scratch
26+
27+
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
28+
COPY --from=builder /etc_passwd /etc/passwd
29+
COPY --from=builder --chown=65534:0 /bin/app /app
30+
31+
USER nobody
32+
ENTRYPOINT ["/app"]

‎README.md‎

Lines changed: 90 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,90 @@
1-
# ai-codewise
1+
# AI-CodeWise
2+
3+
<p align="center">
4+
<img src="images/banner.png" width="400">
5+
</p>
6+
7+
<div align="center">
8+
9+
[![Maintained by stepsecurity.io](https://img.shields.io/badge/maintained%20by-stepsecurity.io-blueviolet)](https://stepsecurity.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=harden-runner)
10+
[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://raw.githubusercontent.com/step-security/harden-runner/main/LICENSE)
11+
12+
</div>
13+
14+
---
15+
16+
<p align="center">
17+
AI-Powered Code Reviews for Best Practices & Security Issues Across Languages
18+
</p>
19+
20+
AI-CodeWise GitHub Action is an AI Code Reviewer.
21+
22+
- It is triggered on a pull request and sends the diff of the code files to the StepSecurity API, which then employs prompt engineering to call the Azure OpenAI API to review the code.
23+
24+
- AI-CodeWise automatically adds a pull request comment using the StepSecurity bot account.
25+
26+
- The comment contains detailed information about the identified issues to improve code quality and address potential security vulnerabilities.
27+
28+
<p align="center">
29+
<img src="images/sequence-diagram.png" alt="Sequence diagram">
30+
</p>
31+
32+
## Usage
33+
34+
To use AI-CodeWise, add this GitHub Actions workflow to your repositories
35+
36+
```yaml
37+
name: Code Review
38+
on:
39+
pull_request:
40+
permissions:
41+
contents: read
42+
jobs:
43+
code-review:
44+
runs-on: ubuntu-latest
45+
permissions:
46+
contents: read
47+
pull-requests: write
48+
id-token: write
49+
steps:
50+
- name: Harden Runner
51+
uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969 # v2.4.0
52+
with:
53+
disable-sudo: true
54+
egress-policy: block
55+
allowed-endpoints: >
56+
api.github.com:443
57+
int.api.stepsecurity.io:443
58+
59+
- name: Code Review
60+
uses: step-security/ai-codewise@v1
61+
```
62+
63+
When you create a pull request in the repository, the workflow will get triggered and add a pull request comment. Here is an screenshot of what the comment will look like:
64+
<p align="center">
65+
<img src="images/sample-code-comment.png" width="600">
66+
</p>
67+
68+
## Comparison with existing SAST and IaC scanners
69+
70+
AI-CodeWise differentiates itself from existing rule-based scanners by offering the following advantages:
71+
72+
1. Comprehensive Code Review: AI-CodeWise is a single code reviewer tool that can detect code smells, best practice violations, and security issues. Furthermore, it does this across different programming languages, making it a versatile solution for your code review needs.
73+
74+
2. Unanticipated Issues Detection: By harnessing the power of AI, AI-CodeWise can identify potential problems that traditional rule-based systems may not have considered or anticipated. This ensures a more thorough code analysis and helps prevent potential vulnerabilities from slipping through the cracks.
75+
76+
3. Suggested Fixes: In addition to identifying issues, AI-CodeWise goes a step further by suggesting code changes to implement fixes directly in the PR comment. These actionable insights empower developers to resolve issues more efficiently, ultimately improving overall code quality and security.
77+
78+
## Examples
79+
80+
Here are a few example pull requests with PR comments from AI-CodeWise
81+
82+
1.
83+
2.
84+
3.
85+
86+
## Limitations
87+
88+
- AI-CodeWise will only review changes if the total number of file changes in a pull request is less than 10.
89+
- AI-CodeWise will only review changes if the total characters in the changes are less than 20K.
90+
- AI-CodeWise only works for public repositories as of now. To use on a private repository, please join the beta.

‎action.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: "StepSecurity AI-CodeWise action"
2+
description: "AI-Powered Code Reviews for Best Practices & Security Issues Across Languages"
3+
inputs:
4+
PAT:
5+
description: "INPUT: GitHub token with read access to read pull request changes"
6+
required: false
7+
default: ${{ github.token }}
8+
9+
DebugMode:
10+
description: "INPUT: Flag to turn on the debug mode to print details to troubleshoot issues related to the action"
11+
required: false
12+
default: "false"
13+
runs:
14+
using: "docker"
15+
image: "docker://ghcr.io/step-security/ai-codewise/int:latest"

0 commit comments

Comments
 (0)