Sync workflows-sync-template-backup.yml from .github repo #124
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Advanced Code Analysis Action" | ||
|
Check failure on line 1 in .github/workflows/auto-gpt5-implementation.yml
|
||
| # OPTIONAL TOKENS: | ||
| # - COPILOT_TOKEN: Enables Copilot CLI-based LLM review steps (if present) | ||
| # - SEMGREP_APP_TOKEN: Enables Semgrep findings upload to Semgrep App (if present) | ||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| - master | ||
| pull_request: | ||
| types: [opened, synchronize, reopened] | ||
| workflow_dispatch: | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| issues: write | ||
| jobs: | ||
| advanced-code-analysis: | ||
| runs-on: [self-hosted, linux, x64, big] | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: [ 'javascript', 'python' ] | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@main | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@main | ||
| with: | ||
| node-version: '20' | ||
| continue-on-error: true | ||
| - name: Setup Python | ||
| uses: actions/setup-python@main | ||
| with: | ||
| python-version: '3.11' | ||
| continue-on-error: true | ||
| - name: Prepare Repository Analysis | ||
| id: prepare-analysis | ||
| run: | | ||
| echo "## Advanced Code Analysis" > /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "### Repository Statistics:" >> /tmp/gpt5-analysis.md | ||
| # Count different file types | ||
| python_files=$(find . -name "*.py" ! -path "*/.venv/*" ! -path "*/node_modules/*" | wc -l) | ||
| js_files=$(find . -name "*.js" ! -path "*/node_modules/*" ! -path "*/dist/*" | wc -l) | ||
| ts_files=$(find . -name "*.ts" ! -path "*/node_modules/*" ! -path "*/dist/*" | wc -l) | ||
| go_files=$(find . -name "*.go" ! -path "*/vendor/*" | wc -l) | ||
| java_files=$(find . -name "*.java" ! -path "*/target/*" | wc -l) | ||
| echo "- Python files: $python_files" >> /tmp/gpt5-analysis.md | ||
| echo "- JavaScript files: $js_files" >> /tmp/gpt5-analysis.md | ||
| echo "- TypeScript files: $ts_files" >> /tmp/gpt5-analysis.md | ||
| echo "- Go files: $go_files" >> /tmp/gpt5-analysis.md | ||
| echo "- Java files: $java_files" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| cat /tmp/gpt5-analysis.md | ||
| continue-on-error: true | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| continue-on-error: true | ||
| - name: Autobuild | ||
| uses: github/codeql-action/autobuild@v3 | ||
| continue-on-error: true | ||
| - name: Copilot LLM Code Review (optional) | ||
| if: ${{ secrets.COPILOT_TOKEN != '' }} | ||
| uses: austenstone/copilot-cli-action@v2 | ||
| with: | ||
| copilot-token: ${{ secrets.COPILOT_TOKEN }} | ||
| prompt: | | ||
| Perform a comprehensive code analysis of this repository: | ||
| 1. Code quality and architecture | ||
| 2. Security risks and unsafe patterns | ||
| 3. Performance bottlenecks and optimizations | ||
| 4. Best practices and error handling | ||
| 5. Documentation and maintainability | ||
| Provide actionable recommendations with file names and line numbers where applicable. | ||
| continue-on-error: true | ||
| - name: Copilot LLM Test Coverage Review (optional) | ||
| if: ${{ secrets.COPILOT_TOKEN != '' }} | ||
| uses: austenstone/copilot-cli-action@v2 | ||
| with: | ||
| copilot-token: ${{ secrets.COPILOT_TOKEN }} | ||
| prompt: | | ||
| Analyze the repository's testing strategy: | ||
| 1. Identify critical paths without tests | ||
| 2. Suggest missing unit/integration/E2E cases | ||
| 3. Recommend improvements to existing tests | ||
| Focus on business logic and risk areas. | ||
| continue-on-error: true | ||
| - name: Advanced Code Analysis with CodeQL | ||
| uses: github/codeql-action/analyze@v3 | ||
| with: | ||
| category: "/language:${{matrix.language}}" | ||
| continue-on-error: true | ||
| - name: Security Analysis with Semgrep | ||
| uses: semgrep/semgrep-action@v1 | ||
| with: | ||
| config: >- | ||
| p/security-audit | ||
| p/secrets | ||
| p/owasp-top-ten | ||
| env: | ||
| SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} | ||
| continue-on-error: true | ||
| - name: Code Quality Analysis | ||
| run: | | ||
| echo "## Advanced Code Analysis Results" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| # Code Quality & Architecture Analysis | ||
| echo "### 1. Code Quality & Architecture" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| # Find large files that might need refactoring | ||
| echo "#### Large Files (>500 lines):" >> /tmp/gpt5-analysis.md | ||
| find . -name "*.py" -o -name "*.js" -o -name "*.ts" -o -name "*.java" -o -name "*.go" | \ | ||
| xargs wc -l | sort -nr | head -10 | while read lines file; do | ||
| if [ "$lines" -gt 500 ] && [ "$file" != "total" ]; then | ||
| echo "- $file: $lines lines (consider refactoring)" >> /tmp/gpt5-analysis.md | ||
| fi | ||
| done | ||
| # Check for TODO/FIXME comments | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "#### Technical Debt Indicators:" >> /tmp/gpt5-analysis.md | ||
| todo_count=$(grep -r "TODO\|FIXME\|HACK\|XXX" . --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" 2>/dev/null | wc -l || echo "0") | ||
| echo "- TODO/FIXME/HACK comments found: $todo_count" >> /tmp/gpt5-analysis.md | ||
| # Security Analysis | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "### 2. Security Analysis" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| # Check for potential security issues | ||
| echo "#### Potential Security Concerns:" >> /tmp/gpt5-analysis.md | ||
| # Check for hardcoded secrets patterns | ||
| secret_patterns=$(grep -r "password\|secret\|key\|token" . --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" 2>/dev/null | grep -v ".git" | wc -l || echo "0") | ||
| echo "- Files with potential secret references: $secret_patterns" >> /tmp/gpt5-analysis.md | ||
| # Check for SQL injection patterns | ||
| sql_patterns=$(grep -r "SELECT\|INSERT\|UPDATE\|DELETE" . --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" 2>/dev/null | wc -l || echo "0") | ||
| echo "- Files with SQL statements (review for injection risks): $sql_patterns" >> /tmp/gpt5-analysis.md | ||
| # Performance Analysis | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "### 3. Performance Optimization" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| # Check for nested loops | ||
| nested_loops=$(grep -r "for.*for\|while.*while" . --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" 2>/dev/null | wc -l || echo "0") | ||
| echo "- Potential nested loop patterns: $nested_loops" >> /tmp/gpt5-analysis.md | ||
| # Check for large data structures | ||
| echo "- Large files that may impact performance listed above" >> /tmp/gpt5-analysis.md | ||
| # Best Practices | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "### 4. Best Practices" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| # Check for error handling | ||
| try_catch=$(grep -r "try\|catch\|except\|finally" . --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" 2>/dev/null | wc -l || echo "0") | ||
| echo "- Error handling blocks found: $try_catch" >> /tmp/gpt5-analysis.md | ||
| # Documentation Analysis | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "### 5. Documentation & Maintainability" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| # Check for documentation files | ||
| docs=$(find . -name "README*" -o -name "*.md" -o -name "docs" -type f 2>/dev/null | wc -l || echo "0") | ||
| echo "- Documentation files found: $docs" >> /tmp/gpt5-analysis.md | ||
| # Check for comments in code | ||
| comments=$(grep -r "#\|//\|/\*" . --include="*.py" --include="*.js" --include="*.ts" --include="*.java" --include="*.go" 2>/dev/null | wc -l || echo "0") | ||
| echo "- Code comment lines: $comments" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| cat /tmp/gpt5-analysis.md | ||
| continue-on-error: true | ||
| - name: Test Coverage Analysis | ||
| run: | | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "### 6. Test Coverage Analysis" >> /tmp/gpt5-analysis.md | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| # Find test files | ||
| test_files=$(find . -name "*test*" -o -name "*spec*" | grep -E "\.(py|js|ts|java|go)$" | wc -l || echo "0") | ||
| echo "- Test files found: $test_files" >> /tmp/gpt5-analysis.md | ||
| # Find source files without corresponding tests | ||
| echo "#### Files that may need test coverage:" >> /tmp/gpt5-analysis.md | ||
| # Python files | ||
| find . -name "*.py" ! -path "*/test*" ! -name "*test*" | head -10 | while read file; do | ||
| basename_file=$(basename "$file" .py) | ||
| test_exists=$(find . -name "*test*${basename_file}*" -o -name "*${basename_file}*test*" | head -1) | ||
| if [ -z "$test_exists" ]; then | ||
| echo "- $file (no corresponding test file found)" >> /tmp/gpt5-analysis.md | ||
| fi | ||
| done | ||
| # JavaScript/TypeScript files | ||
| find . -name "*.js" -o -name "*.ts" | grep -v test | grep -v spec | head -5 | while read file; do | ||
| basename_file=$(basename "$file" | sed 's/\.[^.]*$//') | ||
| test_exists=$(find . -name "*test*${basename_file}*" -o -name "*${basename_file}*test*" -o -name "*spec*${basename_file}*" | head -1) | ||
| if [ -z "$test_exists" ]; then | ||
| echo "- $file (no corresponding test file found)" >> /tmp/gpt5-analysis.md | ||
| fi | ||
| done | ||
| echo "" >> /tmp/gpt5-analysis.md | ||
| echo "#### Recommended test scenarios:" >> /tmp/gpt5-analysis.md | ||
| echo "- Unit tests for core business logic" >> /tmp/gpt5-analysis.md | ||
| echo "- Integration tests for API endpoints" >> /tmp/gpt5-analysis.md | ||
| echo "- Edge case testing for error conditions" >> /tmp/gpt5-analysis.md | ||
| echo "- Performance tests for critical paths" >> /tmp/gpt5-analysis.md | ||
| echo "- Security tests for authentication/authorization" >> /tmp/gpt5-analysis.md | ||
| cat /tmp/gpt5-analysis.md | ||
| continue-on-error: true | ||
| - name: Create Advanced Code Analysis Report | ||
| uses: actions/github-script@main | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| const fs = require('fs'); | ||
| const analysis = fs.readFileSync('/tmp/gpt5-analysis.md', 'utf8'); | ||
| const date = new Date().toISOString().split('T')[0]; | ||
| const title = `Advanced Code Analysis Report - ${date}`; | ||
| const body = `# Advanced Code Analysis Report | ||
| ${analysis} | ||
| ## Analysis Overview | ||
| This report was generated using **advanced code analysis tools** including CodeQL, Semgrep, and custom analysis scripts, which provide: | ||
| ### Analysis Capabilities Used | ||
| 1. **Deep Code Understanding** | ||
| - Static analysis of code structure and patterns | ||
| - Multi-language proficiency (Python, JavaScript, TypeScript, Java, Go) | ||
| - Context-aware recommendations | ||
| 2. **Comprehensive Security Analysis** | ||
| - Vulnerability detection with industry-standard tools | ||
| - Security best practices validation using OWASP guidelines | ||
| - Secret detection and SQL injection pattern analysis | ||
| 3. **Performance Optimization** | ||
| - Algorithm efficiency analysis | ||
| - Resource usage optimization recommendations | ||
| - Scalability insights based on code patterns | ||
| 4. **Architecture Review** | ||
| - Code organization and structure analysis | ||
| - Technical debt identification | ||
| - Maintainability assessments | ||
| 5. **Test Strategy Enhancement** | ||
| - Coverage gap identification | ||
| - Test case recommendations | ||
| - Quality assurance improvements | ||
| ## Analysis Tools Used | ||
| The following tools were used in this analysis: | ||
| - **CodeQL**: GitHub's semantic code analysis engine | ||
| - **Semgrep**: Static analysis for security vulnerabilities | ||
| - **Custom Scripts**: Repository statistics and pattern analysis | ||
| - **File Analysis**: Structure, size, and complexity metrics | ||
| - **Test Coverage**: Test file identification and gap analysis | ||
| ## Action Items | ||
| Based on the analysis above, review the specific recommendations and: | ||
| - [ ] Address high-priority security findings from Semgrep | ||
| - [ ] Implement suggested performance optimizations | ||
| - [ ] Refactor large files identified for maintainability | ||
| - [ ] Add missing test coverage for identified files | ||
| - [ ] Resolve TODO/FIXME comments and technical debt | ||
| - [ ] Review and apply best practice improvements | ||
| --- | ||
| *This report was automatically generated using advanced code analysis tools.* | ||
| For more information about code analysis best practices, see [GitHub Code Scanning](https://docs.github.com/en/code-security/code-scanning). | ||
| `; | ||
| // Only create issue if in PR or on main branch | ||
| if (context.eventName === 'pull_request' || context.ref === 'refs/heads/main' || context.ref === 'refs/heads/master') { | ||
| // Check for existing issues | ||
| const issues = await github.rest.issues.listForRepo({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| state: 'open', | ||
| labels: ['gpt5', 'automated'], | ||
| per_page: 10 | ||
| }); | ||
| const recentIssue = issues.data.find(issue => { | ||
| const createdAt = new Date(issue.created_at); | ||
| const daysSinceCreation = (Date.now() - createdAt) / (1000 * 60 * 60 * 24); | ||
| return daysSinceCreation < 7; | ||
| }); | ||
| if (recentIssue) { | ||
| console.log(`Recent code analysis issue found: #${recentIssue.number}, updating`); | ||
| await github.rest.issues.createComment({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| issue_number: recentIssue.number, | ||
| body: `## Updated Code Analysis (${date})\n\n${analysis}\n\n---\n\n*Analysis performed using advanced code analysis tools.*` | ||
| }); | ||
| } else { | ||
| await github.rest.issues.create({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| title: title, | ||
| body: body, | ||
| labels: ['code-analysis', 'automated', 'security', 'performance'] | ||
| }); | ||
| } | ||
| } | ||
| continue-on-error: true | ||
