Adopting sourcery.ai for reviewing PRs

[ctron]

Coming out of discussion on how to leverage AI for daily work, there was the idea of using sourcery.ai for support in reviewing PRs. The idea came from Lance as it seems people around sigstore are using for their project.

The idea is to have an AI doing an initial PR review, create support material for a further (human) review, summarize changes, etc.

The idea is not to have AI generate code or gate merging PRs.

I've added this to the csaf-walker repository, and I think it really adds value. Here's an example PR: scm-rs/csaf-walker#61

I'm sure there's room for improvement. Settings can be tweaked. And it won't be a 100% solution. However, I also think it really helps with an initial summary and review.

My proposal is to try it out and see how it works. And if we find problems, then tweaking the settings, trying to improve it over time. If at some point we agree that it's not worth it, then come to a decision removing it.

[JimFuller-RedHat]

alternately we can use cursor (which in theory we all have access to) for same kind of thing.

[ctron]

alternately we can use cursor (which in theory we all have access to) for same kind of thing.

To my understanding cursor is more into generating code, vs this one is more into reviewing code. I think both are valuable, but trying to achieve different goals.

Also, cursor is not (yet) available to all of us. 🙄

[mrizzi]

I report here the comment I posted after having reviewed scm-rs/csaf-walker#61

I found the initial Summary by Sourcery useful to set the context, especially in a PR just like this with many different small changes because it helped in not missing anything.
In the Reviewer's Guide comment I appreciate the most the File-Level Changes paragraph and it would be even better if each file in the Files column would be a direct link to the line with the related change.

[helio-frota]

many different small changes because it helped in not missing anything

+1 and I learned extra thing https://stackoverflow.com/questions/56485167/how-to-format-a-byte-into-a-2-digit-hex-string-in-rust

[carlosthe19916]

Is anyone aware of anything that might prevent us from giving those tools a try? I see other teams using it already. E.g. securesign/cosign#402

If there is no concrete blocker, why don't we just give it a try then:

• If it adds value we keep using it
• If not, we remove it.

[ctron]

Summing up this discussion, no one who commented seems to be against the approach. We do have a green light on using it.

So let's try it out for at least 3 months. Tweaking settings as we need it. And then come back for a discussion if we want to keep it or not.

[ctron]

It's active now. If you encounter any issues, please create a new issue, maybe referencing this one, or creating it as a sub-issue.