Connecting ChatGPT to Code Evaluate Made Simple – DZone – Uplaza

The period of synthetic intelligence is already already in bloom. Everybody working in IT is already conversant in our “new best friend” for growth — AI. Working as a DevOps Engineer at Innovecs, I’d wish to share one in all my newest findings.

Idea

• Would you want each pull/merge request to be checked by ChatGPT-4 first after which by you?
• Would you like immediate suggestions on code adjustments earlier than your colleagues see them?
• How about detecting who dedicated confidential knowledge or API keys and the place with the power to tag the “culprit” for correction instantly?

We’re completely conscious that GPT can generate code fairly properly. . . nevertheless it seems it could actually evaluate it simply as easily! I’ll instantly present how this works in apply (elements of the code are blurred to keep away from exhibiting an excessive amount of).

Step 1

I created a check merge request wherein I added a JSON file with barely damaged formatting and plaintext passwords, recreating a safety leak:

As we are able to see, AI not solely detected the delicate info but in addition masked it in its remark + tagged me to take away it.

Or here is one other evaluate:

Rather more highly effective analytics in comparison with instruments like GitLeaks, which carry out easy searches statically utilizing regex and wildcards.

Step 2

Examples from frontend merge requests (colleague’s screenshots), highlighting solely sure factors:

The GPT-4o mannequin exhibits fairly a superb information of React. Everybody is aware of this design with the important thing, however they all the time overlook it.

Or right here, it’s like I’ve learn a e-book:

I may give many examples, however the level is that its suggestions make sense! After all, not all feedback are value consideration, however a big half is invaluable.

Implementation

I will clarify how one can program an automatic evaluate course of in Python in only one hour. This code must be added instantly to the CI/CD stream for optimum impact and course of automation. It’s good to wrap it into one CI/CD job and execute it on every MR/PR (simply make an exception for adjustments from renovate/dependabot).

I’d like to share the ready-made code, however sadly, I am unable to (as a consequence of firm restrictions). So, I will share the thought with architectural blocks so that you can piece it collectively like a constructor.

Let’s get to work, take Python, and write the code.

Step 1: Join To the AI Mannequin

We want a connection to the AI mannequin.

It could possibly be GPT-4o from OpenAI. However I like to recommend Azure OpenAI, as Azure guarantees to not switch code and to not prepare on it.

from openai import AzureOpenAI

Ask GPT how to do that if it is your first time.

Step 2: Code Modifications and Feedback

Get the code adjustments and feedback on these adjustments. We use GitLab, so I will instantly present the endpoints for instance:

• Code adjustments utilizing the MR adjustments API: /api/v4/initiatives/{gitlab_project_id}/merge_requests/{gitlab_request_id}/adjustments?access_raw_diffs=true
• Feedback utilizing the MR notes API: /api/v4/initiatives/{gitlab_project_id}/merge_requests/{gitlab_request_id}/notes?order_by=created_at&kind=asc

The place:

gitlab_request_id = os.getenv("CI_MERGE_REQUEST_IID")

gitlab_project_id = os.getenv("CI_PROJECT_ID")

For aesthetic functions, the JSON response from GitLab must be parsed.

Step 3: Ship Code for AI Evaluate

Don’t forget so as to add a immediate firstly with explanations on what to do, and put all of it into one request:

review_request=f"{prompt}nn{notes}nn{changes}"

Within the immediate, you might want to politely ask the AI to research your code adjustments based mostly on standards — one thing like this (a really simplified model in comparison with what we use):

“As a Developer, I wish to ask you to carry out a GitLab Merge Request evaluate.
Contemplate earlier feedback famous under and keep away from repeating comparable suggestions.
In the event you spot a recurring situation, skip it.

For safety points or delicate info leaks, point out the assignee’s username with @.

Make your suggestions clear, concise, and actionable, with particular enchancment suggestions.

Evaluate the code snippet under based mostly on these standards:

• Syntax and Type: Search for syntax errors and deviations from conventions.
• Efficiency Optimization: Counsel adjustments to enhance effectivity.
• Safety Practices: Verify for vulnerabilities and hard-coded secrets and techniques (masks half the information).
• Error Dealing with: Determine unhandled exceptions or errors.
• Code High quality: Search for code smells, pointless complexity, or redundant code.
• Bug Detection: Discover potential bugs or logical errors.”

Step 4: Submit Response as Remark

That’s it! Merely submit the acquired response as a remark. 

Create a GitLab PAT token for this with the identify AI MR evaluate and direct POST to the MR notes API: /api/v4/initiatives/{gitlab_project_id}/merge_requests/{gitlab_request_id}/notes

Conclusions

Benefits

Implementing this answer will convey enhancements for:

• DevSecOps: Considerably provides safety
• Senior+ degree: Now discovering errors and shortcomings in MR/PR will be finished with out studying by way of the code — AI will do it for you.
• Improvement/QA: You instantly get surprisingly helpful feedback and suggestions.
• Enterprise: Will get barely higher code on the output.

Disadvantages

• Price: Troublesome to foretell; All of it will depend on how a lot you intend to submit for evaluate and which mannequin will conduct the evaluate.

Dangers

• Steady enchancment: Concepts for enhancing such a device will be countless; extra context doesn’t all the time imply higher evaluate. Iterative testing of adjustments requires a while.
• “Improvements”: Ee could change into even lazier =), however laziness is the engine of progress, proper?

Prospects

Think about the alternatives: it is going to be your script, so you may, for instance:

• Add activity context from Jira
• Create a abstract for PM
• Write launch notes/launch adjustments
• Seek for vulnerabilities

So let’s make our code higher and life simpler. Welcome to the AI period, pricey colleagues!