Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This Rails Engine offers a way to request Pull Request descriptions from OpenAI chatGPT and optionally allows direct creation or updating of Pull Requests on GitHub or Bitbucket.
Add this line to your application's Gemfile:
gem "pull_request_ai"
And then execute:
$ bundle
OR, install it yourself as:
$ gem install pull_request_ai
Contribution directions go here.
This Rails Engine is available as open source under the terms of the MIT License.
To configure this Rails Engine you can just set some specific Environment Variables or you can use the Rails Engine initializer class.
The minimum requirement that allows this Rails Engine to ask chatGPT Pull Request descriptions based on Git respository changes is the OpenAI Key.
Using only Environment Variable you need to set:
OR, if you choose to use the initializer:
PullRequestAi.configure do |config|
config.openai_api_key = 'YOUR_OPENAI_API_KEY'
end
To enable direct creation or updating of Pull Requests this Rails Engine can integrate with GitHub or Bitbucket.
For GitHub you need to provide a GitHub Access Token. And for Bitbucket you need to provide a Bitbucket App Password and your Bitbucket Username.
Using only Environment Variable you need to set:
OR, if you choose to use the initializer:
PullRequestAi.configure do |config|
config.github_access_token = 'YOUR_GITHUB_ACCESS_TOKEN'
end
Using only Environment Variable you need to set:
OR, if you choose to use the initializer:
PullRequestAi.configure do |config|
config.bitbucket_app_password = 'YOUR_BITBUCKET_APP_PASSWORD'
config.bitbucket_username = 'YOUR_BITBUCKET_USERNAME'
end
To use the Rails Engine interface on the browser you need to mount the engine route into your project routes. To do that include on your routes.rb
file the following:
mount PullRequestAi::Engine => ''
Then you navigate to:
http://127.0.0.1:3000/rrtools/pull_request_ai
Another way to use this Rails Engine is through code, to do that create an instance of the main client object.
client = PullRequestAi::Client.new
This object offers the following actions:
Notes about the return of these methods, all methods take advantage of dry-monads.
If you need you have access to some aditional configurations which are:
model
parameter allows the user to select which OpenAI model to use for Pull Request suggestions. The default model used by this Gem is gpt-3.5-turbo
, which is the most accessible. However, if you have access to version 4, we recommend using the gpt-4
model.temperature
parameter is an OpenAI API configuration that affects the randomness of the output. Higher values produce more random results, while lower values like 0.2 produce more focused and deterministic output.The only way to configure these parameters is using the initializer, above it is listing as well their default values:
PullRequestAi.configure do |config|
...
config.openai_api_endpoint = 'https://api.openai.com'
config.github_api_endpoint = 'https://api.github.com'
config.bitbucket_api_endpoint = 'https://api.bitbucket.org'
config.model = 'gpt-3.5-turbo'
config.temperature = 0.6
end
FAQs
Unknown package
We found that pull_request_ai demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.