
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
ai-commit-validator
Advanced tools
A GitHub Copilot-powered commit validator with intelligent local code analysis, enhanced security pattern detection, automatic error file opening, side-by-side code comparison, and production-ready skip validation directives.
An AI-powered commit validator that acts as your intelligent code reviewer before commits. Uses OpenAI's GPT models to analyze your staged changes and provide actionable feedback, similar to GitHub Copilot suggestions.
npm install -g ai-commit-validator
npm install ai-commit-validator
Create a .env file in your project root:
OPENAI_API_KEY=your_openai_api_key_here
Getting your OpenAI API Key:
.env file| Variable | Required | Description | Default |
|---|---|---|---|
OPENAI_API_KEY | ✅ Yes | Your OpenAI API key | - |
AI_AUTO_OPEN_ERRORS | ❌ No | Auto-open files at error locations | false |
AI_DEFAULT_ON_CANCEL | ❌ No | Default action on prompt timeout | cancel |
AI_PROMPT_TIMEOUT_MS | ❌ No | Timeout for interactive prompts (ms) | 30000 |
AI_AUTO_SELECT | ❌ No | Auto-respond in non-interactive mode | - |
AI_FORCE_PROMPT | ❌ No | Force prompts in non-TTY environments | false |
# Validate staged changes
validate-commit
Create .git/hooks/pre-commit:
#!/bin/sh
# Run AI commit validator
npx validate-commit
Make it executable:
chmod +x .git/hooks/pre-commit
# Stage your changes
git add .
# Run validation
validate-commit
# If validation passes, commit
git commit -m "Your commit message"
import { validateCommit } from 'ai-commit-validator';
// Run validation
await validateCommit();
Stage Changes: Add files to git staging area
git add .
AI Analysis: The validator automatically:
Interactive Decision: Based on AI feedback, you can:
Commit: If validation passes or is bypassed, proceed with commit
🔍 Checking your staged changes...
🧠 Sending code diff to AI for review...
🤖 AI Review Feedback:
I found a few areas for improvement:
1. **Security Issue**: The API key is hardcoded in line 15. Consider using environment variables.
2. **Performance**: The loop in `processData()` could be optimized using `map()` instead of `forEach()`.
3. **Error Handling**: Missing try-catch block around the database query on line 23.
What do you want to do?
❯ Apply suggestions and continue
Skip validation with comment
Cancel commit
Modify the model in index.js:
const response = await openai.chat.completions.create({
model: "gpt-4", // Change to your preferred model
messages: [{ role: "user", content: prompt }],
});
Customize the AI prompt for your team's needs:
const prompt = `
You are a senior code reviewer for our team.
Focus on: security, performance, and maintainability.
Use our team's coding standards: [link to standards]
...
`;
Error: No OpenAI API Key
Error: OpenAI API key not found
Solution: Ensure .env file exists with OPENAI_API_KEY=your_key
Error: No staged changes
⚠️ No staged changes found
Solution: Stage files first with git add .
Error: API Rate Limit
Error: Rate limit exceeded
Solution: Wait a moment and try again, or upgrade your OpenAI plan
Add debug logging by modifying index.js:
console.log('Debug: Staged diff:', diff);
console.log('Debug: AI Response:', aiFeedback);
git checkout -b feature/amazing-featuregit add .validate-commitgit commit -m "Add amazing feature"git push origin feature/amazing-featureThe validator now automatically opens files at error locations with intelligent editor detection!
Features:
Quick Start:
export AI_AUTO_OPEN_ERRORS=true
git commit -m "Your commit message"
# Files with errors open automatically in your editor!
Documentation: See FEATURES_2.2.0.md and AUTO_OPEN_ERRORS.md for detailed information.
MIT License - see LICENSE file for details.
Sanjib Roy
Made with ❤️ by Sanjib Roy
Transform your commit process with AI-powered code review! 🚀
FAQs
A GitHub Copilot-powered commit validator with intelligent local code analysis, enhanced security pattern detection, automatic error file opening, side-by-side code comparison, and production-ready skip validation directives.
The npm package ai-commit-validator receives a total of 164 weekly downloads. As such, ai-commit-validator popularity was classified as not popular.
We found that ai-commit-validator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.