
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
copilot-commit-validator
Advanced tools
Production-ready AI commit validator with enhanced error detection including undeclared variables that cause ReferenceError. Focuses on meaningful code optimizations, critical error detection, unused code removal, and performance improvements.
An optional AI-powered commit validator that acts as your intelligent code reviewer before commits. Uses GitHub Copilot and intelligent local analysis to analyze your staged changes and provide actionable feedback. Designed to be non-blocking - if AI validation fails, commits still proceed with appropriate warnings.
[skip-ai] commentsnpm install -g ai-commit-validator
npm install ai-commit-validator
Create a .env file in your project root:
OPENAI_API_KEY=your_openai_api_key_here
Getting your OpenAI API Key:
.env file| Variable | Required | Description | Default |
|---|---|---|---|
GITHUB_TOKEN | 🔧 Optional | GitHub Personal Access Token for Copilot API | - |
AI_OPTIONAL_MODE | 💡 Recommended | Make AI validation optional (nice to have) | true |
AI_AUTO_OPEN_ERRORS | ❌ No | Auto-open files at error locations | false |
AI_DEFAULT_ON_CANCEL | ❌ No | Default action on prompt timeout | auto-apply |
AI_PROMPT_TIMEOUT_MS | ❌ No | Timeout for interactive prompts (ms) | 30000 |
AI_AUTO_SELECT | ❌ No | Auto-respond in non-interactive mode | - |
AI_FORCE_PROMPT | ❌ No | Force prompts in non-TTY environments | false |
Set AI_OPTIONAL_MODE=true in your .env file to make AI validation optional:
# Make AI validation non-blocking (nice to have)
AI_OPTIONAL_MODE=true
GITHUB_TOKEN=ghp_your_github_token_here
Benefits of Optional Mode:
# Validate staged changes
validate-commit
Create .git/hooks/pre-commit:
#!/bin/sh
# Run AI commit validator
npx validate-commit
Make it executable:
chmod +x .git/hooks/pre-commit
# Stage your changes
git add .
# Run validation
validate-commit
# If validation passes, commit
git commit -m "Your commit message"
import { validateCommit } from 'ai-commit-validator';
// Run validation
await validateCommit();
Stage Changes: Add files to git staging area
git add .
AI Analysis: The validator automatically:
Interactive Decision: Based on AI feedback, you can:
Commit: If validation passes or is bypassed, proceed with commit
🔍 Checking your staged changes...
🧠 Sending code diff to AI for review...
🤖 AI Review Feedback:
I found a few areas for improvement:
1. **Security Issue**: The API key is hardcoded in line 15. Consider using environment variables.
2. **Performance**: The loop in `processData()` could be optimized using `map()` instead of `forEach()`.
3. **Error Handling**: Missing try-catch block around the database query on line 23.
What do you want to do?
❯ Apply suggestions and continue
Skip validation with comment
Cancel commit
Modify the model in index.js:
const response = await openai.chat.completions.create({
model: "gpt-4", // Change to your preferred model
messages: [{ role: "user", content: prompt }],
});
Customize the AI prompt for your team's needs:
const prompt = `
You are a senior code reviewer for our team.
Focus on: security, performance, and maintainability.
Use our team's coding standards: [link to standards]
...
`;
Error: No OpenAI API Key
Error: OpenAI API key not found
Solution: Ensure .env file exists with OPENAI_API_KEY=your_key
Error: No staged changes
⚠️ No staged changes found
Solution: Stage files first with git add .
Error: API Rate Limit
Error: Rate limit exceeded
Solution: Wait a moment and try again, or upgrade your OpenAI plan
Add debug logging by modifying index.js:
console.log('Debug: Staged diff:', diff);
console.log('Debug: AI Response:', aiFeedback);
git checkout -b feature/amazing-featuregit add .validate-commitgit commit -m "Add amazing feature"git push origin feature/amazing-featureThe validator now automatically opens files at error locations with intelligent editor detection!
Features:
Quick Start:
export AI_AUTO_OPEN_ERRORS=true
git commit -m "Your commit message"
# Files with errors open automatically in your editor!
Documentation: See FEATURES_2.2.0.md and AUTO_OPEN_ERRORS.md for detailed information.
MIT License - see LICENSE file for details.
Sanjib Roy
Made with ❤️ by Sanjib Roy
Transform your commit process with AI-powered code review! 🚀
FAQs
Production-ready AI commit validator with enhanced error detection including undeclared variables that cause ReferenceError. Focuses on meaningful code optimizations, critical error detection, unused code removal, and performance improvements.
The npm package copilot-commit-validator receives a total of 15 weekly downloads. As such, copilot-commit-validator popularity was classified as not popular.
We found that copilot-commit-validator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.