rodin/review-bot

docs: add comprehensive code review report (vs go-patterns) #1

Merged

aweiker merged 1 commits from docs/code-review-report into main

2026-05-01 19:25:16 +00:00

rodin commented

2026-05-01 17:34:09 +00:00

Owner

Comprehensive review of the review-bot codebase against rodin/go-patterns.

Key Findings

4 MAJOR: missing context.Context on HTTP clients, exported client fields (credential exposure)
9 MINOR: error formatting, hardcoded temperature, testing improvements
7 NIT: allocations, package docs, testability

This PR adds the report only. Follow-up PRs will address the findings.

Comprehensive review of the review-bot codebase against rodin/go-patterns. ## Key Findings - 4 MAJOR: missing context.Context on HTTP clients, exported client fields (credential exposure) - 9 MINOR: error formatting, hardcoded temperature, testing improvements - 7 NIT: allocations, package docs, testability This PR adds the report only. Follow-up PRs will address the findings.

aweiker added 1 commit 2026-05-01 19:24:42 +00:00

docs: add comprehensive code review report (vs go-patterns)

CI / test (pull_request) Successful in 14s

Details

CI / review (gpt-5, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Failing after 1m4s

Details

CI / review (gpt-5-mini, gpt, GPT_REVIEW_TOKEN) (pull_request) Failing after 3m47s

Details

9aec7ff952

aweiker force-pushed docs/code-review-report from bcc88b1056 to 9aec7ff952

2026-05-01 19:24:42 +00:00

Compare

aweiker merged commit ffca0eb016 into main

2026-05-01 19:25:16 +00:00

aweiker referenced this issue from a commit

2026-05-01 19:25:17 +00:00

Merge pull request 'docs: add comprehensive code review report (vs go-patterns)' (#1) from docs/code-review-report into main

rodin referenced this issue from a commit

2026-05-01 19:45:54 +00:00

fix: log warnings instead of swallowing errors

rodin referenced this issue from a commit

2026-05-02 04:16:17 +00:00

fix: symlink traversal + worst-wins pre-check + user scoping

rodin referenced this issue from a commit

2026-05-02 04:24:03 +00:00

fix: symlink traversal + worst-wins pre-check + user scoping

rodin referenced this issue from a commit

2026-05-02 04:28:50 +00:00

fix: symlink traversal + worst-wins pre-check + user scoping

rodin referenced this issue from a commit

2026-05-02 04:31:20 +00:00

fix: symlink traversal + worst-wins pre-check + user scoping

rodin referenced this issue from a commit

2026-05-02 04:42:52 +00:00

refactor: validate reviewer-name early (fail fast before LLM call)

rodin referenced this issue from a commit

2026-05-02 05:10:52 +00:00

fix: handle single-line hunks and no-newline markers in diff parser

rodin referenced this pull request

2026-05-11 00:53:58 +00:00

feat: add YAML support for persona files #58

rodin referenced this pull request

2026-05-11 15:52:42 +00:00

feat: add GitHub Actions support #75

~~rodin referenced this pull request 2026-05-12 16:59:55 +00:00~~

feat(vcs): Gitea adapter with diff-position translation (Phase 2) #79

~~rodin referenced this pull request 2026-05-12 16:59:56 +00:00~~

feat(github): PRReader + FileReader client (Phase 3) #80

sonnet-review-bot referenced this pull request

2026-05-12 20:31:49 +00:00

feat(vcs): Gitea adapter with diff-position translation (Phase 2) #90

sonnet-review-bot referenced this pull request

2026-05-12 20:31:49 +00:00

feat(vcs): Gitea adapter with diff-position translation (Phase 2) #90

rodin referenced this pull request

2026-05-12 21:33:32 +00:00

fix(deps): replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml #89

rodin referenced this pull request

2026-05-12 21:36:53 +00:00

fix(deps): replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml #89

rodin referenced this issue from a commit

2026-05-12 21:57:01 +00:00

Wrap errors in GetPullRequest and PostReview for consistency

rodin referenced this pull request

2026-05-12 22:02:06 +00:00

feat(vcs): Gitea adapter with diff-position translation (Phase 2) #90

sonnet-review-bot referenced this pull request

2026-05-12 22:19:53 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-12 22:37:34 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-12 22:44:04 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-12 22:52:31 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-12 23:00:32 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-12 23:20:30 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-12 23:38:53 +00:00

feat(github): support HTTP-date format in Retry-After header #94

rodin referenced this issue from a commit

2026-05-12 23:39:06 +00:00

fix: address review findings from rounds 2843-2846

rodin referenced this pull request

2026-05-12 23:39:31 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-12 23:45:09 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this issue from a commit

2026-05-12 23:55:37 +00:00

fix(github): address review findings on client.go

rodin referenced this pull request

2026-05-13 00:04:35 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-13 00:30:03 +00:00

Reject cross-host redirects and HTTPS→HTTP downgrades entirely #95

rodin referenced this issue from a commit

2026-05-13 00:30:29 +00:00

fix(github): address review findings from rounds 2867/2870

rodin referenced this issue from a commit

2026-05-13 00:39:43 +00:00

docs: address review findings on YAML depth validation

rodin referenced this pull request

2026-05-13 00:40:03 +00:00

fix(deps): replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml #89

rodin referenced this issue from a commit

2026-05-13 01:16:47 +00:00

refactor(github): address review findings from round 2872

rodin referenced this pull request

2026-05-13 01:26:10 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this issue from a commit

2026-05-13 01:41:48 +00:00

fix(github): address review findings from round 2880/2883

rodin referenced this pull request

2026-05-13 01:42:01 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-13 01:49:34 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this issue from a commit

2026-05-13 02:29:12 +00:00

fix(github): address review findings from rounds 2884/2885/2887

rodin referenced this pull request

2026-05-13 02:29:25 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this pull request

2026-05-13 02:35:51 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this issue from a commit

2026-05-13 03:28:58 +00:00

fix: address sonnet review MINOR findings (#2916)

rodin referenced this pull request

2026-05-13 03:37:42 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this issue from a commit

2026-05-13 03:48:04 +00:00

refactor(github): extract handleResponse for safe defer body close

rodin referenced this pull request

2026-05-13 03:56:22 +00:00

feat(github): implement PRReader + FileReader client (#80) #93

rodin referenced this issue from a commit

2026-05-13 04:31:49 +00:00

fix(github): address review findings - remove panic, validate at config time

rodin referenced this pull request

2026-05-13 04:32:00 +00:00

feat(github): implement GitHub API client foundation #101

rodin referenced this issue from a commit

2026-05-13 04:36:50 +00:00

fix: address review feedback on PR #102

rodin referenced this pull request

2026-05-13 04:42:52 +00:00

feat(github): implement PRReader interface #102

rodin referenced this pull request

2026-05-13 04:46:45 +00:00

feat(github): implement FileReader interface #103

aweiker referenced this issue from a commit

2026-05-13 04:47:16 +00:00

fix: address review feedback on PR #102

rodin referenced this pull request

2026-05-13 04:55:58 +00:00

feat(github): implement PRReader interface #102

rodin referenced this pull request

2026-05-13 05:42:34 +00:00

feat(github): implement FileReader interface #103

rodin referenced this pull request

2026-05-13 07:42:59 +00:00

feat(github): implement Reviewer and Identity interfaces (#81) #105

rodin referenced this pull request

2026-05-13 08:33:14 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 09:00:17 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 09:31:16 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 09:36:30 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this issue from a commit

2026-05-13 10:29:50 +00:00

fix(review): address bot review feedback on PR #106

rodin referenced this pull request

2026-05-13 10:30:17 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 10:47:37 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 10:54:56 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 11:01:34 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 11:29:29 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 11:40:39 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this pull request

2026-05-13 12:08:45 +00:00

feat(gitea): harden GetPullRequestDiff against unbounded diff size #109

rodin referenced this pull request

2026-05-13 12:48:04 +00:00

feat(gitea): harden GetPullRequestDiff against unbounded diff size #109

rodin referenced this pull request

2026-05-13 13:03:23 +00:00

feat(github): support HTTP-date format in Retry-After header #110

sonnet-review-bot referenced this pull request

2026-05-13 13:09:51 +00:00

feat(github): support HTTP-date format in Retry-After header #110

rodin referenced this pull request

2026-05-13 13:15:34 +00:00

feat(github): support HTTP-date format in Retry-After header #110

aweiker referenced this issue from a commit

2026-05-13 13:19:46 +00:00

fix(review): address bot review feedback on PR #106

rodin referenced this issue from a commit

2026-05-13 13:43:50 +00:00

Wrap errors in GetPullRequest and PostReview for consistency

rodin referenced this issue from a commit

2026-05-13 13:43:50 +00:00

fix(github): address review findings - remove panic, validate at config time

rodin referenced this issue from a commit

2026-05-13 13:43:50 +00:00

fix: address review feedback on PR #102

rodin referenced this issue from a commit

2026-05-13 13:43:51 +00:00

fix(review): address bot review feedback on PR #106

rodin referenced this issue from a commit

2026-05-13 13:47:45 +00:00

docs: address review findings on YAML depth validation

rodin referenced this issue from a commit

2026-05-13 13:47:46 +00:00

fix(review): address bot review feedback on PR #106

rodin referenced this pull request

2026-05-13 14:23:02 +00:00

feat(cmd): wire --provider and --base-url flags into CLI (Phase 5) #106

rodin referenced this issue from a commit

2026-05-13 15:48:40 +00:00

fix(review): address bot review feedback on PR #106

rodin referenced this pull request

2026-05-13 16:27:11 +00:00

feat: reject cross-host redirects and HTTPS→HTTP downgrades (#95) #111

rodin referenced this pull request

2026-05-13 17:46:42 +00:00

feat(github): add safeguards against accidental AllowInsecureHTTP use (#96) #113

rodin referenced this issue from a commit

2026-05-13 17:48:20 +00:00

address review feedback: export_test.go for AllowInsecureHTTPForTest, avoid url.Parse in doRequest

rodin referenced this pull request

2026-05-13 18:07:56 +00:00

feat(github): add safeguards against accidental AllowInsecureHTTP use (#96) #113

rodin referenced this pull request

2026-05-13 19:57:58 +00:00

feat(github): add safeguards against accidental AllowInsecureHTTP use (#96) #113

rodin referenced this pull request

2026-05-13 20:03:17 +00:00

feat(github): add safeguards against accidental AllowInsecureHTTP use (#96) #113

rodin referenced this issue from a commit

2026-05-13 20:04:29 +00:00

Address review feedback on PR #113

rodin referenced this pull request

2026-05-13 20:44:16 +00:00

feat(vcs): add CommitID to ReviewRequest (#115) #118

rodin referenced this pull request

2026-05-13 21:10:17 +00:00

feat(vcs): add CommitID to ReviewRequest (#115) #118

rodin referenced this pull request

2026-05-14 04:11:04 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 04:13:07 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 04:27:26 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 04:30:20 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 04:36:56 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this issue from a commit

2026-05-14 04:38:54 +00:00

fix(action): use REST API for GitHub asset downloads, enforce trusted GITEA_URL

rodin referenced this pull request

2026-05-14 04:39:05 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 04:47:04 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 05:02:46 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 05:05:06 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 05:21:21 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this pull request

2026-05-14 05:48:07 +00:00

feat(action): derive binary name from uname for multi-arch support (#124) #127

rodin referenced this pull request

2026-05-14 06:20:19 +00:00

fix(action): detect VCS host type for version resolution and binary download #121

rodin referenced this issue from a commit

2026-05-15 03:32:32 +00:00

fix(#137): address review findings in budget.go

rodin referenced this pull request

2026-05-15 05:36:54 +00:00

feat: redesign dev-loop dispatch as pure shell script — no model reasoning in dispatch #148

rodin referenced this pull request

2026-05-15 06:47:43 +00:00

feat(#141): validate-docmap subcommand — CI hard-fail on missing docmap coverage #142

rodin referenced this issue from a commit

2026-05-15 06:50:17 +00:00

fix(#141): address security-review-bot REQUEST_CHANGES findings

rodin referenced this pull request

2026-05-15 07:23:25 +00:00

feat(#141): validate-docmap subcommand — CI hard-fail on missing docmap coverage #142

rodin referenced this issue from a commit

2026-05-15 07:33:53 +00:00

fix(#141): harden docmap file path — confine to repo-root, reject symlinks, cap size

rodin referenced this pull request

2026-05-15 08:21:10 +00:00

feat(#141): validate-docmap subcommand — CI hard-fail on missing docmap coverage #142

rodin referenced this pull request

2026-05-15 08:33:29 +00:00

test(#146): add TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile #151

rodin referenced this pull request

2026-05-15 08:34:59 +00:00

test(#146): add TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile #151

rodin referenced this pull request

2026-05-15 09:34:06 +00:00

feat(#141): validate-docmap subcommand #156

rodin referenced this pull request

2026-05-15 11:04:53 +00:00

test(#146): add TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile #151

rodin referenced this pull request

2026-05-15 11:59:40 +00:00

test(#146): add TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile #151

rodin referenced this pull request

2026-05-15 15:02:48 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-15 15:04:04 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-15 15:04:19 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-15 15:05:43 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-15 22:43:41 +00:00

fix(#157): add never-close constraint to spec, S9 invariant, and regression test #158

rodin referenced this pull request

2026-05-15 22:43:42 +00:00

fix(#157): add never-close constraint to spec, S9 invariant, and regression test #158

rodin referenced this pull request

2026-05-15 22:50:08 +00:00

fix(#157): add never-close constraint to spec, S9 invariant, and regression test #158

rodin referenced this pull request

2026-05-16 00:14:06 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:18:27 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:22:07 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:26:52 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:30:03 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:34:56 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:37:55 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:42:08 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:42:23 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:46:24 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:54:05 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 00:58:01 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 01:02:38 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 01:06:45 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 01:10:34 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 02:50:45 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 03:06:40 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 03:10:33 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 03:11:01 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 03:14:37 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 03:14:59 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

rodin referenced this pull request

2026-05-16 03:22:50 +00:00

fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass #152

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rodin/review-bot#1