Workflows #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Gemini AI-Powered Code Analysis | |
| # Analyzes code changes in PRs, pushes, and branches - FOCUSES ON CODE CHANGES | |
| name: AI Code Analysis | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| push: | |
| branches: [main, develop, 'feature/*', 'bugfix/*'] | |
| workflow_dispatch: | |
| # Weekly comprehensive analysis | |
| schedule: | |
| - cron: '0 2 * * 1' # Weekly analysis on Mondays at 2 AM UTC | |
| # Cancel previous workflow runs for the same context | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| jobs: | |
| ai-analysis: | |
| name: AI Analysis & Assistant | |
| runs-on: ubuntu-latest | |
| if: | | |
| (github.event_name == 'pull_request') || | |
| (github.event_name == 'push') || | |
| (github.event_name == 'schedule') || | |
| (github.event_name == 'workflow_dispatch') | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| # For PRs, checkout base branch; for push/issues, checkout the current ref | |
| ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.ref }} | |
| - name: Get changed files (for push/schedule events) | |
| id: changed-files | |
| if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| uses: tj-actions/changed-files@v46 | |
| with: | |
| files: | | |
| **/*.php | |
| **/*.js | |
| **/*.sql | |
| separator: "\n" | |
| - name: Determine analysis type | |
| id: analysis-type | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| FILES_CHANGED: ${{ steps.changed-files.outputs.any_changed || 'true' }} | |
| run: | | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| echo "type=pr-review" >> $GITHUB_OUTPUT | |
| echo "Analysis type: Pull Request Code Review - FOCUS ON CODE CHANGES" | |
| elif [ "$EVENT_NAME" = "push" ]; then | |
| # Only analyze if files actually changed | |
| if [ "$FILES_CHANGED" = "true" ]; then | |
| echo "type=push-analysis" >> $GITHUB_OUTPUT | |
| echo "Analysis type: Push Code Analysis - FOCUS ON CODE CHANGES" | |
| else | |
| echo "type=skip" >> $GITHUB_OUTPUT | |
| echo "Analysis type: Skipped - No relevant files changed" | |
| fi | |
| elif [ "$EVENT_NAME" = "schedule" ]; then | |
| echo "type=comprehensive-analysis" >> $GITHUB_OUTPUT | |
| echo "Analysis type: Scheduled Comprehensive Analysis - FOCUS ON ALL CODE" | |
| else | |
| echo "type=comprehensive-analysis" >> $GITHUB_OUTPUT | |
| echo "Analysis type: Manual Comprehensive Analysis - FOCUS ON ALL CODE" | |
| fi | |
| - name: Get context information | |
| id: context-info | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_NUMBER: ${{ github.event.number || '' }} | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before || '' }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha || '' }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login || github.actor }} | |
| PR_TITLE: ${{ github.event.pull_request.title || 'Code Analysis' }} | |
| REPO_FULL_NAME: ${{ github.repository }} | |
| run: | | |
| # Get context details from environment variables (secure) | |
| echo "pr-number=$PR_NUMBER" >> $GITHUB_OUTPUT | |
| echo "base-sha=$BASE_SHA" >> $GITHUB_OUTPUT | |
| echo "head-sha=$HEAD_SHA" >> $GITHUB_OUTPUT | |
| echo "pr-author=$PR_AUTHOR" >> $GITHUB_OUTPUT | |
| echo "pr-title=$PR_TITLE" >> $GITHUB_OUTPUT | |
| # Get diff based on event type | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| # PR diff via API | |
| curl -H "Authorization: token $GITHUB_TOKEN" \ | |
| -H "Accept: application/vnd.github.v3.diff" \ | |
| "https://api.github.com/repos/$REPO_FULL_NAME/compare/$BASE_SHA..$HEAD_SHA" \ | |
| > pr_diff.txt | |
| elif [ "$EVENT_NAME" = "push" ]; then | |
| # Push diff via API | |
| if [ -n "$BASE_SHA" ] && [ "$BASE_SHA" != "0000000000000000000000000000000000000000" ]; then | |
| curl -H "Authorization: token $GITHUB_TOKEN" \ | |
| -H "Accept: application/vnd.github.v3.diff" \ | |
| "https://api.github.com/repos/$REPO_FULL_NAME/compare/$BASE_SHA..$HEAD_SHA" \ | |
| > pr_diff.txt | |
| else | |
| echo "Initial commit or no previous commit available" > pr_diff.txt | |
| fi | |
| else | |
| echo "No diff available for this event type" > pr_diff.txt | |
| fi | |
| # Check if diff file was created successfully | |
| if [ -s pr_diff.txt ]; then | |
| echo "diff-available=true" >> $GITHUB_OUTPUT | |
| # Limit diff size to prevent API limits (max 100KB) | |
| if [ $(wc -c < pr_diff.txt) -gt 102400 ]; then | |
| head -c 102400 pr_diff.txt > pr_diff_limited.txt | |
| mv pr_diff_limited.txt pr_diff.txt | |
| echo "diff-truncated=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "diff-truncated=false" >> $GITHUB_OUTPUT | |
| fi | |
| else | |
| echo "diff-available=false" >> $GITHUB_OUTPUT | |
| echo "No diff content available" > pr_diff.txt | |
| fi | |
| - name: Setup Node.js for Gemini CLI | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Install Gemini CLI | |
| run: | | |
| npm install -g @google/gemini-cli | |
| gemini --version | |
| - name: Run AI Analysis | |
| id: ai-analysis | |
| env: | |
| GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} | |
| PR_TITLE: ${{ steps.context-info.outputs.pr-title }} | |
| PR_AUTHOR: ${{ steps.context-info.outputs.pr-author }} | |
| run: | | |
| # Create appropriate prompt based on analysis type | |
| ANALYSIS_TYPE="${{ steps.analysis-type.outputs.type }}" | |
| # Skip analysis if no files changed | |
| if [ "$ANALYSIS_TYPE" = "skip" ]; then | |
| echo "No relevant files changed. Skipping analysis." > analysis_prompt.txt | |
| echo "analysis-skipped=true" >> $GITHUB_OUTPUT | |
| exit 0 | |
| elif [ "$ANALYSIS_TYPE" = "pr-review" ]; then | |
| # Create PR-focused prompt - FOCUS ON CODE CHANGES | |
| echo "You are an expert WordPress plugin developer and security consultant reviewing a pull request." > analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "CRITICAL INSTRUCTION: FOCUS FIRST AND PRIMARILY ON THE CODE CHANGES IN THIS PULL REQUEST." >> analysis_prompt.txt | |
| echo "Analyze what was changed, added, or removed and review those specific modifications." >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "PR Context: $PR_TITLE by @$PR_AUTHOR" >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "ANALYSIS PRIORITY:" >> analysis_prompt.txt | |
| echo "1. Review the specific code changes in this PR" >> analysis_prompt.txt | |
| echo "2. Check security implications of the changes" >> analysis_prompt.txt | |
| echo "3. Verify WordPress coding standards compliance" >> analysis_prompt.txt | |
| echo "4. Assess performance impact of changes" >> analysis_prompt.txt | |
| echo "5. Provide specific recommendations for improvements" >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| elif [ "$ANALYSIS_TYPE" = "push-analysis" ]; then | |
| # Create push-focused prompt - FOCUS ON CODE CHANGES | |
| echo "You are an expert WordPress plugin developer analyzing recent code changes." > analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "CRITICAL INSTRUCTION: FOCUS ON THE SPECIFIC CODE CHANGES MADE IN THIS PUSH." >> analysis_prompt.txt | |
| echo "Analyze what files were modified and what changes were introduced." >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "ANALYSIS PRIORITY:" >> analysis_prompt.txt | |
| echo "1. Identify and review the specific changes made" >> analysis_prompt.txt | |
| echo "2. Check for security vulnerabilities in new/modified code" >> analysis_prompt.txt | |
| echo "3. Verify WordPress standards compliance" >> analysis_prompt.txt | |
| echo "4. Assess performance implications" >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| elif [ "$ANALYSIS_TYPE" = "comprehensive-analysis" ]; then | |
| # Create comprehensive code analysis prompt - FOCUS ON CODE CHANGES | |
| echo "You are an expert WordPress plugin developer and security consultant performing comprehensive code analysis." > analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "CRITICAL INSTRUCTION: ANALYZE THE CURRENT CODEBASE WITH FOCUS ON RECENT CHANGES." >> analysis_prompt.txt | |
| echo "This is a scheduled comprehensive review to identify issues and improvements." >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "ANALYSIS PRIORITY:" >> analysis_prompt.txt | |
| echo "1. Review recent changes and their impact on the codebase" >> analysis_prompt.txt | |
| echo "2. Security audit: vulnerabilities, input sanitization, output escaping" >> analysis_prompt.txt | |
| echo "3. Code quality assessment: WordPress standards, best practices" >> analysis_prompt.txt | |
| echo "4. Performance analysis: database queries, caching, optimization" >> analysis_prompt.txt | |
| echo "5. Architecture review: plugin structure, hook usage, extensibility" >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "Provide a thorough analysis with specific, actionable recommendations focused on code improvements." >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| echo "FILES TO ANALYZE:" >> analysis_prompt.txt | |
| echo "${{ steps.changed-files.outputs.all_changed_files || 'Current codebase' }}" >> analysis_prompt.txt | |
| echo "" >> analysis_prompt.txt | |
| else | |
| # Create comprehensive analysis prompt | |
| cat > analysis_prompt.txt << 'EOF' | |
| You are an expert WordPress plugin developer and security consultant reviewing code for a WordPress plugin. | |
| PLUGIN CONTEXT: | |
| - WordPress plugin project | |
| - Supports WordPress 6.5+ and PHP 7.4+ | |
| - Modern WordPress development practices expected | |
| COMPREHENSIVE REVIEW CHECKLIST: | |
| 🔒 SECURITY ANALYSIS: | |
| 1. SQL Injection vulnerabilities - Check for unescaped database queries | |
| 2. XSS (Cross-Site Scripting) issues - Verify output escaping with esc_html(), esc_attr(), etc. | |
| 3. CSRF (Cross-Site Request Forgery) protection - Check for wp_nonce_field() usage | |
| 4. Input validation and sanitization - Look for sanitize_*() functions | |
| 5. Output escaping compliance - Ensure all dynamic output is escaped | |
| 6. Authentication and authorization checks - Verify current_user_can() usage | |
| 7. File upload security - Check file type validation and path traversal protection | |
| 📝 WORDPRESS STANDARDS: | |
| 1. WordPress Coding Standards compliance - PSR-4, naming conventions | |
| 2. Proper use of WordPress APIs - Use WP functions instead of raw PHP | |
| 3. Hook usage (actions/filters) - add_action(), add_filter() best practices | |
| 4. Internationalization (i18n) implementation - __(), _e(), esc_html__() usage | |
| 5. Plugin structure and organization - Proper file organization | |
| 6. PHPDoc documentation quality - @param, @return, @since tags | |
| ⚡ PERFORMANCE REVIEW: | |
| 1. Database query optimization - Check for N+1 queries, use WP_Query properly | |
| 2. Caching strategies - wp_cache_set(), transients usage | |
| 3. Resource loading efficiency - wp_enqueue_script(), wp_enqueue_style() | |
| 4. Memory usage considerations - Avoid memory leaks | |
| 5. Scalability implications - Code that works well with large datasets | |
| 🏗️ CODE QUALITY: | |
| 1. Function complexity and readability - Keep functions focused and simple | |
| 2. Error handling implementation - Proper try/catch and WP_Error usage | |
| 3. Type safety and parameter validation - Validate function parameters | |
| 4. Code reusability and DRY principles - Avoid code duplication | |
| 5. Naming conventions - Clear, descriptive function and variable names | |
| 🔧 PLUGIN-SPECIFIC: | |
| 1. Third-party integration best practices - Use appropriate hooks and functions | |
| 2. Plugin compatibility - Ensure no conflicts with common plugins | |
| 3. Admin interface usability - Clear, intuitive admin pages | |
| 4. Plugin activation/deactivation handling - Proper cleanup and database management | |
| REVIEW FORMAT: | |
| Provide a comprehensive review in the following format: | |
| ## 🛡️ Security Analysis | |
| [List any security issues found with severity level: CRITICAL/HIGH/MEDIUM/LOW] | |
| ## 📝 WordPress Standards | |
| [Review compliance with WordPress coding standards] | |
| ## ⚡ Performance Review | |
| [Identify performance optimizations and concerns] | |
| ## 🏗️ Code Quality | |
| [Assess code structure, readability, and maintainability] | |
| ## 🔧 Plugin-Specific Review | |
| [Third-party integrations and plugin compatibility review] | |
| ## ✅ Recommendations | |
| [Provide specific, actionable recommendations] | |
| Focus on actionable feedback that improves security, WordPress compatibility, and code quality. | |
| PR Title: $PR_TITLE | |
| PR Author: @$PR_AUTHOR | |
| Here is the code to analyze: | |
| EOF | |
| # Append the diff content for PR/push analysis | |
| cat pr_diff.txt >> analysis_prompt.txt | |
| fi | |
| # Run Gemini analysis and capture output | |
| gemini generate --prompt-file analysis_prompt.txt > ai_analysis_result.txt 2>&1 || { | |
| echo "Gemini analysis failed. Creating fallback response..." | |
| cat > ai_analysis_result.txt << 'EOF' | |
| ## 🤖 AI Analysis Status | |
| The automated AI analysis encountered an issue during execution. This may be due to: | |
| - Temporary API limitations | |
| - Large diff size | |
| - Network connectivity issues | |
| ### Manual Review Recommended | |
| Please conduct a manual code review focusing on: | |
| - WordPress security best practices | |
| - Coding standards compliance | |
| - Performance considerations | |
| - Plugin-specific requirements | |
| The PR can still be reviewed and merged based on manual inspection. | |
| EOF | |
| echo "analysis-failed=true" >> $GITHUB_OUTPUT | |
| } | |
| # Verify the analysis result file exists and has content | |
| if [ -s ai_analysis_result.txt ]; then | |
| echo "analysis-success=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "analysis-success=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Post AI Review Comment | |
| uses: actions/github-script@v7 | |
| env: | |
| PR_NUMBER: ${{ steps.context-info.outputs.pr-number }} | |
| HEAD_SHA: ${{ steps.context-info.outputs.head-sha }} | |
| PR_AUTHOR: ${{ steps.context-info.outputs.pr-author }} | |
| DIFF_AVAILABLE: ${{ steps.context-info.outputs.diff-available }} | |
| DIFF_TRUNCATED: ${{ steps.context-info.outputs.diff-truncated }} | |
| ANALYSIS_SUCCESS: ${{ steps.ai-analysis.outputs.analysis-success }} | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const prNumber = process.env.PR_NUMBER; | |
| const headSha = process.env.HEAD_SHA; | |
| const prAuthor = process.env.PR_AUTHOR; | |
| const diffAvailable = process.env.DIFF_AVAILABLE === 'true'; | |
| const diffTruncated = process.env.DIFF_TRUNCATED === 'true'; | |
| const analysisSuccess = process.env.ANALYSIS_SUCCESS === 'true'; | |
| // Read AI analysis results | |
| let aiAnalysis = ''; | |
| try { | |
| aiAnalysis = fs.readFileSync('ai_analysis_result.txt', 'utf8'); | |
| } catch (error) { | |
| aiAnalysis = '## ❌ Analysis Error\n\nFailed to read analysis results. Manual review required.'; | |
| } | |
| // Create status indicators | |
| let statusIndicators = ''; | |
| if (!diffAvailable) { | |
| statusIndicators += '⚠️ **Warning:** No diff content available for analysis\n'; | |
| } | |
| if (diffTruncated) { | |
| statusIndicators += '⚠️ **Note:** Large diff was truncated for analysis\n'; | |
| } | |
| if (!analysisSuccess) { | |
| statusIndicators += '❌ **Alert:** AI analysis encountered issues\n'; | |
| } | |
| // Determine response type and format appropriately | |
| const analysisType = '${{ steps.analysis-type.outputs.type }}'; | |
| let reviewContent; | |
| if (analysisType === 'assistant') { | |
| reviewContent = ` | |
| ## 🤖 AI WordPress Assistant Response | |
| Hi @${prAuthor}! I've analyzed your request. | |
| ### 📝 Expert Analysis & Recommendations | |
| ${aiAnalysis} | |
| ### 💡 Available Commands | |
| Try these commands with @gemini-cli: | |
| - \`@gemini-cli review this code\` - Code review and analysis | |
| - \`@gemini-cli suggest improvements\` - Performance and structure suggestions | |
| - \`@gemini-cli check security\` - Security vulnerability analysis | |
| - \`@gemini-cli explain this function\` - Code explanation and documentation | |
| **Analysis Date:** ${new Date().toISOString()} | |
| `; | |
| } else { | |
| reviewContent = ` | |
| ## 🤖 AI-Powered Security & Code Review | |
| Hi @${prAuthor}! I've completed an analysis of this ${analysisType === 'pr-review' ? 'pull request' : 'code'}. | |
| ### 📊 Review Summary | |
| - **Project:** WordPress Plugin | |
| - **Commit:** \`${headSha.substring(0, 7)}\` | |
| - **WordPress Compatibility:** 6.5+ | |
| - **PHP Compatibility:** 7.4+ | |
| - **Analysis Status:** ${analysisSuccess ? '✅ Completed' : '⚠️ Partial/Failed'} | |
| ${statusIndicators} | |
| --- | |
| ${aiAnalysis} | |
| --- | |
| ### 📋 Review Checklist for Maintainers | |
| - [ ] Security vulnerabilities addressed | |
| - [ ] WordPress coding standards followed | |
| - [ ] Performance impact considered | |
| - [ ] Documentation updated if needed | |
| - [ ] Tests pass (if applicable) | |
| > 🔄 **Note:** This analysis was performed securely without executing untrusted code. | |
| > | |
| > 🎯 **Focus Areas:** Security, WordPress Standards, Performance, Code Quality | |
| `; | |
| } | |
| const targetNumber = prNumber; | |
| await github.rest.issues.createComment({ | |
| issue_number: targetNumber, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: reviewContent | |
| }); | |
| - name: Handle Analysis Failure | |
| if: steps.ai-analysis.outputs.analysis-success != 'true' | |
| uses: actions/github-script@v7 | |
| env: | |
| PR_NUMBER: ${{ steps.context-info.outputs.pr-number }} | |
| WORKFLOW_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| with: | |
| script: | | |
| const prNumber = process.env.PR_NUMBER; | |
| const workflowUrl = process.env.WORKFLOW_URL; | |
| // Create an issue for failed analysis | |
| const title = `🚨 AI Analysis Failed for PR #${prNumber}`; | |
| const body = ` | |
| ## AI Code Analysis Failure | |
| The automated AI code analysis workflow failed for PR #${prNumber}. | |
| **Pull Request:** #${prNumber} | |
| **Failure Time:** ${new Date().toISOString()} | |
| **Workflow Run:** ${workflowUrl} | |
| ### Possible Causes | |
| - API rate limits or temporary service issues | |
| - Large diff size exceeding analysis limits | |
| - Invalid file formats or encoding issues | |
| - GEMINI_API_KEY configuration problems | |
| ### Manual Actions Required | |
| 1. 🔍 Review the failed workflow logs for specific error details | |
| 2. 🔄 Re-run the analysis workflow if it was a temporary issue | |
| 3. 🛠️ Check GEMINI_API_KEY secret configuration | |
| 4. 👥 Proceed with manual code review for the PR | |
| **Note:** This does not necessarily indicate issues with the PR code itself. | |
| `; | |
| await github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: title, | |
| body: body, | |
| labels: ['ai-analysis', 'workflow-failure', 'needs-attention'] | |
| }); |