
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
code-review-gpt
Advanced tools
Code Review GPT uses Large Language Models to review code in your CI/CD pipeline. It helps streamline the code review process by providing feedback on code that may have issues or areas for improvement.
It should pick up on common issues such as:
It can also be run locally in your command line to review staged files.
Code Review GPT is in alpha and should be used for fun only. It may provide useful feedback but please check any suggestions thoroughly.
https://github.com/mattzcarey/code-review-gpt/assets/77928207/92029baf-f691-465f-8d15-e1363fcb808e
See the setup instructions for more information.
See the action documentation for more information.
Clone the repository:
git clone https://github.com/mattzcarey/code-review-gpt.git
cd code-review-gpt
Install dependencies (we use bun but you can use npm or pnpm if you prefer):
bun i
Set up the API key:
.env.example file to .env..env file and replace YOUR_API_KEY with your actual OPENAI API key.When used globally you should run export OPENAI_API_KEY=YOUR_API_KEY (or similar for your operating system) in your terminal to set the API key.
To use an OpenAI compatible API, you can set the OPENAI_API_KEY and OPENAI_BASE_URL environment variables and specify the model name when running the review command:
export OPENAI_API_KEY=<YOUR_API_KEY>
export OPENAI_BASE_URL=<YOUR_ENDPOINT>
bun review --model <YOUR_MODEL_NAME>
Run the application:
bun start
See the package.json file for all the npm commands you can run.
We use release-please on this project. If you want to create a new release from your PR, please make sure your PR title follows the Conventional Commits format. The release-please bot will automatically create a new release for you when your PR is merged.
Thanks to our wonderful contributors!
The roadmap shifts the focus to a Github app which can be installed on any repo. This will allow for a more seamless UX and better features including a chatbot to discuss the PR and make suggestions.
The code-review-gpt package will continue to be maintained and improved based on the feedback from the Github app.
FAQs
an extensible code review agent
The npm package code-review-gpt receives a total of 210 weekly downloads. As such, code-review-gpt popularity was classified as not popular.
We found that code-review-gpt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.