Code Review

import subprocess

def get_staged_diff() -> str:
    return subprocess.run(
        ["git", "diff", "--staged", "--unified=5"],
        capture_output=True, text=True
    ).stdout

def get_pr_diff(base: str = "main") -> str:
    return subprocess.run(
        ["git", "diff", f"{base}...HEAD", "--unified=5"],
        capture_output=True, text=True
    ).stdout

import subprocess, json

def run_pylint(file_path: str) -> list[dict]:
    result = subprocess.run(
        ["python", "-m", "pylint", "--output-format=json", file_path],
        capture_output=True, text=True
    )
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:
        return []

import ast

def check_complexity(source: str) -> list[str]:
    """Flag functions with too many branches or too long."""
    issues = []
    tree = ast.parse(source)
    for node in ast.walk(tree):
        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
            lines = node.end_lineno - node.lineno
            branches = sum(1 for n in ast.walk(node)
                          if isinstance(n, (ast.If, ast.For, ast.While, ast.Try)))
            if lines > 50:
                issues.append(f"{node.name}: {lines} lines (consider splitting)")
            if branches > 10:
                issues.append(f"{node.name}: cyclomatic complexity ~{branches}")
    return issues

□ SQL injection: string formatting in queries? Use parameterized queries.
□ Command injection: user input in subprocess/shell calls?
□ Path traversal: user-controlled file paths? Validate with Path.resolve()
□ Hardcoded secrets: API keys, passwords in source?
□ Insecure deserialization: loading untrusted binary data?
□ Open redirects: user-controlled redirect URLs?
□ Missing auth: endpoints without authentication checks?
□ Race conditions: shared mutable state without locks?
□ Dependency versions: known CVEs in requirements?

from github import Github

def review_pr(token: str, repo: str, pr_number: int, review_body: str,
              event: str = "COMMENT") -> None:
    """Submit a review to a GitHub PR. event: COMMENT|APPROVE|REQUEST_CHANGES"""
    g = Github(token)
    pr = g.get_repo(repo).get_pull(pr_number)
    pr.create_review(body=review_body, event=event)

## Code Review — {filename}

**Verdict:** APPROVE | REQUEST_CHANGES | BLOCK

### Summary
{2-3 sentence description of what the code does and overall quality}

### Critical Issues
- [ ] {issue} (`{file}:{line}`)

### Major Issues
- [ ] {issue description}

### Minor / Style
- {suggestion}

### What's Good
- {positive observations}