Skip to content

Commit 8cc4fdd

Browse files
Patel230Patel230
committed
chore: add production documentation and CI hardening
- Add README.md with API docs, usage examples, presets - Add CHANGELOG.md documenting v0.1.0 through v0.4.0 - Add SECURITY.md with vulnerability disclosure policy - Add CONTRIBUTING.md with development guidelines - Add .golangci.yml (govet, errcheck, staticcheck, gosec, misspell) - Update CI with linting job and coverage reporting
1 parent 201757d commit 8cc4fdd

7 files changed

Lines changed: 802 additions & 461 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515

1616
- uses: actions/setup-go@v5
1717
with:
18-
go-version: "1.26"
18+
go-version: "1.26.1"
1919
cache: true
2020

2121
- name: Build
@@ -26,3 +26,19 @@ jobs:
2626

2727
- name: Test
2828
run: go test ./... -race -count=1 -timeout=60s
29+
30+
- name: Coverage
31+
run: |
32+
go test -coverprofile=coverage.out ./...
33+
go tool cover -func=coverage.out | tail -1
34+
35+
lint:
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: actions/checkout@v4
39+
- uses: actions/setup-go@v5
40+
with:
41+
go-version: '1.26.1'
42+
- uses: golangci/golangci-lint-action@v7
43+
with:
44+
version: v2.1.0

‎.golangci.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
version: "2"
2+
3+
linters:
4+
default: none
5+
enable:
6+
- govet
7+
- ineffassign
8+
- unused
9+
- errcheck
10+
- staticcheck
11+
- misspell
12+
- nilerr
13+
14+
linters-settings:
15+
errcheck:
16+
check-type-assertions: true
17+
misspell:
18+
locale: US
19+
20+
issues:
21+
max-issues-per-linter: 0
22+
max-same-issues: 0
23+
exclude-rules:
24+
- path: _test\.go
25+
linters:
26+
- errcheck

‎CHANGELOG.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Changelog
2+
3+
All notable changes to sight are documented here.
4+
Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
5+
6+
---
7+
8+
## [0.4.0] — 2026-05-08
9+
10+
### Added
11+
- Multi-concern parallel review with configurable concern specs
12+
- Self-reflection pass for false-positive elimination
13+
- Incremental review with last-reviewed commit tracking
14+
- Eval framework for review quality regression testing
15+
- Custom checks via .sight/checks/ markdown files
16+
- Project rules ingestion from CLAUDE.md, CONTRIBUTING.md, .cursor/rules/
17+
- SARIF output format
18+
- MCP server integration (sight_review, sight_describe, sight_improve)
19+
20+
### Changed
21+
- Improved token budget estimation with 4:1 input:output ratio
22+
- Finding deduplication across concerns
23+
24+
---
25+
26+
## [0.2.0] — 2026-04-30
27+
28+
### Added
29+
- Describe operation (PR description generation)
30+
- Improve operation (code improvement suggestions)
31+
- Filter findings with LLM validation
32+
- InlineComment mapping for GitHub/GitLab posting
33+
- TOML/JSON configuration file support
34+
- File exclusion patterns
35+
36+
---
37+
38+
## [0.1.0] — 2026-04-28
39+
40+
### Added
41+
- Initial release: Review() function with Provider interface
42+
- Finding type with severity, CWE, file/line location
43+
- Functional options pattern for configuration
44+
- Quick, Standard, Thorough presets
45+
- Concurrent concern processing

‎CONTRIBUTING.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Contributing to sight
2+
3+
## Setup
4+
5+
```bash
6+
git clone https://github.com/GrayCodeAI/sight.git
7+
cd sight
8+
make test
9+
```
10+
11+
## Requirements
12+
13+
- Go 1.26+
14+
- No external dependencies beyond mcp-go
15+
16+
## Development
17+
18+
```bash
19+
make test # Run tests
20+
make test-race # With race detector
21+
make cover # Coverage report
22+
make lint # Static analysis
23+
make bench # Benchmarks
24+
```
25+
26+
## Guidelines
27+
28+
- All tests must pass with `-race` flag
29+
- Use `t.Parallel()` in tests that don't share state
30+
- Provider interface changes require discussion first
31+
- Add tests for new functionality
32+
- Follow existing patterns (functional options, internal packages)
33+
34+
## Pull Requests
35+
36+
1. Open an issue first for significant changes
37+
2. Run `make all` before submitting (vet + test + build)
38+
3. Include test coverage for new code
39+
4. Update CHANGELOG.md

‎README.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# sight
2+
3+
AI-powered code review on diffs. Parses unified diffs, enriches with surrounding code context and git history, then runs parallel multi-concern reviews through an LLM provider.
4+
5+
## Design
6+
7+
- **Library only** — no CLI, no binary
8+
- **No LLM SDK dependency** — defines a Provider interface; consumers implement it
9+
- **No opinions** — consumers inject their own LLM client (e.g., via eyrie)
10+
11+
## Install
12+
13+
```bash
14+
go get github.com/GrayCodeAI/sight@latest
15+
```
16+
17+
## Usage
18+
19+
### One-shot review
20+
21+
```go
22+
result, err := sight.Review(ctx, diffText,
23+
sight.WithProvider(myProvider),
24+
sight.Thorough,
25+
)
26+
for _, f := range result.Findings {
27+
fmt.Printf("[%s] %s:%d - %s\n", f.Severity, f.File, f.Line, f.Message)
28+
}
29+
```
30+
31+
### Reusable reviewer
32+
33+
```go
34+
r := sight.NewReviewer(sight.WithProvider(p), sight.Thorough)
35+
result1, _ := r.Review(ctx, diff1)
36+
result2, _ := r.Review(ctx, diff2)
37+
```
38+
39+
### Provider interface
40+
41+
Implement this with any LLM client:
42+
43+
```go
44+
type Provider interface {
45+
Complete(ctx context.Context, messages []Message) (string, error)
46+
}
47+
```
48+
49+
## Presets
50+
51+
| Preset | Concerns | Use case |
52+
|--------|----------|----------|
53+
| Quick | security, correctness | Fast PR checks |
54+
| Standard | all (default) | Balanced review |
55+
| Thorough | all + deeper analysis | Critical code |
56+
| SecurityFocus | security only | Security audit |
57+
| CI | all + fail-on threshold | CI/CD gates |
58+
59+
## Findings
60+
61+
Each finding includes:
62+
- **Concern**: security, performance, correctness, maintainability, testing
63+
- **Severity**: critical, high, medium, low, info
64+
- **File** and **Line**: exact location in diff
65+
- **Message**: human-readable description
66+
- **Fix**: suggested code fix
67+
- **CWE**: reference (e.g., CWE-79)
68+
69+
## Output Formats
70+
71+
- Inline comments (GitHub/GitLab PR comments)
72+
- SARIF (static analysis interchange)
73+
- Human-readable terminal output
74+
75+
## Configuration
76+
77+
File-based config via `.sight.toml`:
78+
79+
```toml
80+
fail-on = "high"
81+
exclude = ["vendor/", "generated/"]
82+
concerns = ["security", "performance", "correctness"]
83+
```
84+
85+
## Testing
86+
87+
```bash
88+
make test # Unit tests
89+
make test-race # With race detector
90+
make bench # Benchmarks
91+
make cover # Coverage report
92+
```
93+
94+
## License
95+
96+
MIT

‎SECURITY.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
| Version | Supported |
6+
|---------|-----------|
7+
| 0.4.x | Yes |
8+
| 0.2.x | Yes |
9+
| < 0.2 | No |
10+
11+
## Reporting a Vulnerability
12+
13+
**Do NOT open a public GitHub issue for security vulnerabilities.**
14+
15+
Email: security@graycode.ai
16+
17+
### Response Timeline
18+
- Acknowledgment: 48 hours
19+
- Initial assessment: 5 business days
20+
- Fix: 7-30 days depending on severity
21+
22+
## Security Considerations
23+
24+
- sight is a library — it does not make network calls itself
25+
- LLM provider calls are made by the consumer (via Provider interface)
26+
- Diff content is passed to the LLM; consumers are responsible for redacting secrets
27+
- No credentials are stored or transmitted by sight itself

0 commit comments

Comments
 (0)