GHAGGA Code Review

Version updated for https://github.com/JNZader/ghagga to version v2.3.0.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

GHAGGA is an AI-powered code review tool designed to automate and enhance the process of reviewing pull requests. It combines static analysis tools (Semgrep, Trivy, CPD) with large language models (LLMs) and a project memory system to identify issues, suggest improvements, and provide structured feedback. By leveraging multi-agent workflows, intelligent comment generation, and secure API integrations, it streamlines the review process and helps developers maintain code quality and consistency across projects.

Release notes

🚀 v2.3.0 — Production Hardening & Enterprise Readiness

66 commits with 62 improvements across 4 audit rounds, AI SDK v5 migration, Docker digest pinning, and CI optimization.

Highlights

• 4 audit rounds completed (R1–R4): 62 total improvements covering security, performance, resilience, DX, and observability
• AI SDK v4 → v5 migration with Zod v3 → v4
• Docker images SHA256-pinned for supply chain security
• CI path filtering — docs-only changes skip expensive jobs (~10s vs ~15min)
• ~2,778 tests across 8 packages

Audit R4 — Production Readiness (16 improvements)

Critical

• ⏱️ HTTP timeouts on all 13 fetch() calls (10s/15s/5s) — prevents resource exhaustion
• ✅ Env validation at startup — fail-fast with clear error if required vars missing
• 🔗 FK cascade delete on all remaining constraints — no orphaned data on uninstall

High

• 🔍 Correlation IDs (reviewId) from webhook → Inngest → PR comment for end-to-end tracing
• 🆔 Error IDs (errorId) in all 500 responses — support can grep logs instantly
• 🧹 Token cache periodic cleanup every 5 minutes with .unref()
• 📄 GitHub API pagination for PRs with >100 files/commits (up to 1000 files)

Medium

• 📖 CONTRIBUTING.md — complete onboarding guide (prerequisites, setup, workflow, conventions)
• 📋 .env.example — REQUIRED/OPTIONAL labels, format descriptions, generation commands
• 🧬 Idempotent migrations — all SQL migrations guarded with IF NOT EXISTS/IF EXISTS
• 🏥 Dockerfile HEALTHCHECK — Docker can verify container health
• 🧪 Zod negative tests + circuit breaker assertion gap filled

Low

• 📊 Structured review metrics in Pino logs (duration, provider, model, findings, tokens)
• 📦 API response envelope standardized — all endpoints use { data: ... }

Other Changes

• AI SDK v4 → v5: usage.promptTokens → inputTokens, completionTokens → outputTokens
• Zod v3 → v4: Zero code changes needed (fully backward compatible)
• Docker digest pinning: node:22-slim and postgres:16-alpine pinned to SHA256
• CI optimization: dorny/paths-filter skips all jobs on docs-only pushes
• Removed dead dependency: @octokit/webhooks (never imported)
• Dependabot: 8 PRs merged (Vite 7, Recharts 3, Commander 14, etc.)

Test Suite

Full Changelog: https://github.com/JNZader/ghagga/compare/v2.2.0...v2.3.0

• JNZader
• GitHub Actions