feat: daily multi-tool code quality sweep across all repos#2631
feat: daily multi-tool code quality sweep across all repos#2631marcusquinn merged 1 commit intomainfrom
Conversation
Extends the daily code review from single-repo CodeRabbit-only to a multi-repo, multi-tool quality sweep. pulse-wrapper.sh now runs run_daily_quality_sweep() once per 24h (timestamp-guarded) which: - Creates/finds a persistent 'Daily Code Quality Review' issue per repo (labels: quality-review + persistent, pinned) - Runs ShellCheck on .sh files (always available) - Runs Qlty maintainability smells (if CLI installed) - Queries SonarCloud public API for quality gate + open issues - Queries Codacy API for open issues (if token in gopass) - Triggers CodeRabbit via @coderabbitai mention - Posts a single summary comment for the supervisor to act on Updated coderabbit.md to document the broader multi-tool scope.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review infoConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
WalkthroughIntroduces a daily code quality sweep orchestration feature that aggregates findings from multiple quality tools (ShellCheck, Qlty, SonarCloud, Codacy, CodeRabbit) and posts consolidated summaries to persistent per-repo GitHub issues, with 24-hour interval gating and per-repo issue caching. Changes
Sequence Diagram(s)sequenceDiagram
participant Main as main()
participant Sweep as run_daily_quality_sweep()
participant Issue as _ensure_quality_issue()
participant Quality as _quality_sweep_for_repo()
participant Tools as Quality Tools<br/>(ShellCheck, Qlty,<br/>SonarCloud, Codacy,<br/>CodeRabbit)
participant GitHub as GitHub API
Main->>Sweep: Invoke daily quality sweep
activate Sweep
Note over Sweep: Check 24h interval<br/>from timestamp file
loop For each pulse-enabled repo
Sweep->>Issue: Ensure quality issue exists
activate Issue
Issue->>GitHub: Create or fetch "Daily Code Quality Review" issue
GitHub-->>Issue: Return issue number
Issue->>Sweep: Return cached issue ID
deactivate Issue
Sweep->>Quality: Run quality sweep for repo
activate Quality
Quality->>Tools: Gather findings from all tools
Tools-->>Quality: Return aggregated results<br/>(ShellCheck, Qlty, SonarCloud,<br/>Codacy, CodeRabbit)
Quality->>GitHub: Post consolidated comment to issue
GitHub-->>Quality: Comment posted
deactivate Quality
end
Sweep->>Sweep: Update last-run timestamp
deactivate Sweep
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the automated code quality review process by expanding it from a single-repository, CodeRabbit-exclusive check to a comprehensive, multi-tool sweep across all configured repositories. The new system ensures consistent daily monitoring of code health, consolidating findings from various static analysis tools into persistent GitHub issues, which are then reviewed by a supervisor LLM to generate actionable tasks. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Sun Mar 1 04:23:19 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a daily multi-tool code quality sweep, enhancing the project by adding new functions to pulse-wrapper.sh for managing sweeps, creating persistent issues, and integrating various quality tools. However, a high-severity security vulnerability was identified: the system is susceptible to Indirect Prompt Injection. Untrusted data from analyzed repositories is included in GitHub issue comments processed by an LLM-based supervisor, potentially allowing an attacker to manipulate its behavior. Additionally, the extensive use of 2>/dev/null and >/dev/null 2>&1 in the new shell script functions suppresses critical error messages, which can lead to silent failures and hinder debugging.
| local comment_body="## Daily Code Quality Sweep | ||
|
|
||
| **Date**: ${now_iso} | ||
| **Repo**: \`${repo_slug}\` | ||
| **Tools run**: ${tool_count} | ||
|
|
||
| --- | ||
|
|
||
| ${shellcheck_section} | ||
| ${qlty_section} | ||
| ${sonar_section} | ||
| ${codacy_section} | ||
| ${coderabbit_section} | ||
|
|
||
| --- | ||
| _Auto-generated by pulse-wrapper.sh daily quality sweep. The supervisor will review findings and create actionable issues._" | ||
|
|
||
| # Post comment | ||
| gh issue comment "$issue_number" --repo "$repo_slug" --body "$comment_body" >/dev/null 2>&1 || { |
There was a problem hiding this comment.
This section of the script (lines 1474-1492) constructs a Markdown comment by concatenating output from several external tools and posts it to a GitHub issue for an LLM-based 'supervisor' agent. This creates a high-severity Indirect Prompt Injection vulnerability, as untrusted tool outputs can manipulate the supervisor's behavior. To mitigate this, sanitize all tool outputs and use structured data formats with clear delimiters. Additionally, on line 1492, the gh issue comment command uses >/dev/null 2>&1, which completely silences both stdout and stderr. While the || block handles the exit code, valuable error messages for debugging (e.g., authentication issues, network problems) are lost. It is recommended to redirect only stdout (>/dev/null) to preserve stderr for debugging.
| local comment_body="## Daily Code Quality Sweep | |
| **Date**: ${now_iso} | |
| **Repo**: \`${repo_slug}\` | |
| **Tools run**: ${tool_count} | |
| --- | |
| ${shellcheck_section} | |
| ${qlty_section} | |
| ${sonar_section} | |
| ${codacy_section} | |
| ${coderabbit_section} | |
| --- | |
| _Auto-generated by pulse-wrapper.sh daily quality sweep. The supervisor will review findings and create actionable issues._" | |
| # Post comment | |
| gh issue comment "$issue_number" --repo "$repo_slug" --body "$comment_body" >/dev/null 2>&1 || { | |
| gh issue comment "$issue_number" --repo "$repo_slug" --body "$comment_body" >/dev/null || { |
References
- Avoid using '2>/dev/null' for blanket suppression of command errors in shell scripts to ensure that authentication, syntax, or system issues remain visible for debugging.
| fi | ||
|
|
||
| local repo_entries | ||
| repo_entries=$(jq -r '.initialized_repos[] | select(.pulse == true and (.local_only // false) == false and .slug != "") | "\(.slug)|\(.path)"' "$repos_json" 2>/dev/null || echo "") |
There was a problem hiding this comment.
Suppressing jq's stderr with 2>/dev/null can hide critical errors, such as a malformed repos.json file, which would cause the quality sweep to fail silently. To improve debuggability, it's better to allow jq to report syntax errors. The || echo "" construct will still prevent the script from exiting on failure.
| repo_entries=$(jq -r '.initialized_repos[] | select(.pulse == true and (.local_only // false) == false and .slug != "") | "\(.slug)|\(.path)"' "$repos_json" 2>/dev/null || echo "") | |
| repo_entries=$(jq -r '.initialized_repos[] | select(.pulse == true and (.local_only // false) == false and .slug != "") | "\(.slug)|\(.path)"' "$repos_json" || echo "") |
References
- In shell scripts with 'set -e' enabled, use '|| true' to prevent the script from exiting when a command like 'jq' fails on an optional lookup. Do not suppress stderr with '2>/dev/null' so that actual syntax or system errors remain visible for debugging.
- Avoid using '2>/dev/null' for blanket suppression of command errors in shell scripts to ensure that authentication, syntax, or system issues remain visible for debugging.
| if [[ -n "$project_key" && -n "$org_key" ]]; then | ||
| # SonarCloud public API — quality gate status | ||
| local sonar_status | ||
| sonar_status=$(curl -s "https://sonarcloud.io/api/qualitygates/project_status?projectKey=${project_key}" 2>/dev/null || echo "") |
There was a problem hiding this comment.
Suppressing curl's stderr output with 2>/dev/null will hide network errors, API errors, or other issues when fetching data from SonarCloud. This makes it difficult to diagnose why the SonarCloud section might be missing from a report. It's better to let curl errors be visible in logs.
| sonar_status=$(curl -s "https://sonarcloud.io/api/qualitygates/project_status?projectKey=${project_key}" 2>/dev/null || echo "") | |
| sonar_status=$(curl -s "https://sonarcloud.io/api/qualitygates/project_status?projectKey=${project_key}" || echo "") |
References
- Avoid using '2>/dev/null' for blanket suppression of command errors in shell scripts to ensure that authentication, syntax, or system issues remain visible for debugging.
1 participant
Summary
repos.jsonpulse-enabled reposrun_daily_quality_sweep()topulse-wrapper.sh— runs once per 24h, creates persistent pinned issues per repo, posts findings from ShellCheck, Qlty, SonarCloud, Codacy, and CodeRabbitcoderabbit.mdto document the broader multi-tool scope and mark issue Daily CodeRabbit Pulse Review #2386 as legacyTools integrated
~/.qlty/bin/qlty)@coderabbitaimentionHow it works
run_daily_quality_sweep()checks timestamp guard (24h interval)_ensure_quality_issue()creates/finds a persistent "Daily Code Quality Review" issue (labels:quality-review+persistent, pinned)_quality_sweep_for_repo()runs all available tools and posts a single summary commentVerification
shellcheckpasses with zero violationsbash -nsyntax check passesupdate_health_issues()/_update_health_issue_for_repo()conventionsSummary by CodeRabbit