\r \r

GitLab MR Code Review\r

\r

Workflow\r

\r

1. Read credentials and check token scope\r

\r Credentials: ~/.openclaw/credentials/gitlab.json\r \r

{\r
  "token": "glpat-xxx",\r
  "host": "https://gitlab.com",\r
  "ignore_patterns": ["*.min.js", "*.lock", "forms/*.json"]\r
}\r
```\r
\r
Required API scopes:\r
- `api` — required for posting inline comments\r
- `read_api` — sufficient for analysis only (no comment posting)\r
\r
**Always run token check first** to know upfront whether comments can be posted:\r
\r
```bash\r
python scripts/gitlab_client.py check-token \x3Cmr_url>\r
```\r
\r
Output includes `"can_write": true/false`. If `false`, skip step 6 and inform the user that the token needs the `api` scope to post comments. Do NOT proceed to analysis and then fail at step 6.\r
\r
### 2. Fetch MR metadata and diff\r
\r
```bash\r
python scripts/gitlab_client.py fetch-mr   \x3Cmr_url>\r
python scripts/gitlab_client.py fetch-diff \x3Cmr_url>\r
```\r
\r
`fetch-diff` returns a JSON array. Each entry contains `new_path`, `old_path`, `diff` (unified diff text), and boolean flags `new_file`, `deleted_file`, `renamed_file`.\r
\r
> **Fallback**: if the `/diffs` endpoint returns HTTP 500 (some self-hosted GitLab instances), the script automatically retries via `/changes`. No manual intervention needed.\r
\r
### 3. Filter files\r
\r
Use `ignore_matcher.py` to exclude files before analysis:\r
\r
```python\r
from ignore_matcher import filter_diffs\r
reviewable = filter_diffs(all_diffs)   # merges defaults + credentials ignore_patterns\r
```\r
\r
**Default ignore patterns** (always applied, even without credentials file):\r
`*.min.js`, `*.min.css`, `*.lock`, `package-lock.json`, `pnpm-lock.yaml`, `forms/*.json`\r
\r
Binary extensions (`.png`, `.jar`, `.class`, `.map`, etc.) are always skipped.\r
\r
### 4. Analyze the diff\r
\r
- Analyze only modified lines (added/removed in the diff). Do not comment on unchanged context lines.\r
- If the total diff is large, process file-by-file and aggregate results.\r
- Read `references/review-guidelines.md` for all review rules, severity definitions, and comment format.\r
\r
**Focus areas:**\r
- Java / Spring Boot — Clean Code, SOLID, transaction boundaries, lazy loading\r
- MongoDB — query correctness, index coverage, atomicity\r
- PostgreSQL — SQL correctness, isolation levels, index/schema migrations\r
- React / TypeScript — hooks correctness, type safety, XSS, stale closures\r
\r
### 5. Structure the chat summary\r
\r
Group findings by severity:\r
\r
```\r
## Code Review — \x3CMR title> (\x3Csource_branch> → \x3Ctarget_branch>)\r
\r
### Critical\r
- `UserService.java:42` — Transaction wraps HTTP call; holds DB lock during network I/O.\r
\r
### Major\r
- `OrderRepository.java:87` — N+1: `findRolesByUserId` called inside loop. Use batch query.\r
\r
### Minor\r
- `PaymentDto.java:15` — Field name `val` is not descriptive.\r
\r
### Decision: Needs changes\r
```\r
\r
Decision options: **Pass** / **Needs changes** / **Reject**\r
- Pass: no Critical or Major findings\r
- Needs changes: one or more Major findings, no Critical\r
- Reject: one or more Critical findings\r
\r
### 6. Post inline comments to GitLab\r
\r
Only execute this step if `check-token` (step 1) returned `"can_write": true`.\r
\r
**Write comments to a temp JSON file, then post via `post_comments.py`.**\r
Never use `python -c` with inline comment bodies — backticks and special characters break shell escaping.\r
\r
```bash\r
# 1. Write all findings to a JSON file\r
cat > /tmp/mr_comments.json \x3C\x3C 'EOF'\r
[\r
  {\r
    "file_path": "src/main/UserService.java",\r
    "line": 42,\r
    "body": "[CRITICAL] Transaction wraps HTTP call...\
\
Suggestion:\
```java\
// fix\
```"\r
  }\r
]\r
EOF\r
\r
# 2. Post via script\r
python scripts/post_comments.py \x3Cmr_url> /tmp/mr_comments.json\r
```\r
\r
**How to determine the correct line number** from a diff hunk:\r
\r
```\r
@@ -375,6 +375,8 @@       ← new file starts at line 375\r
     unchanged line          → 375\r
     unchanged line          → 376\r
     unchanged line          → 377\r
+    added line              → 378  ← use this number\r
+    added line              → 379\r
```\r
\r
Count from the `+A` value in `@@ -X,Y +A,B @@` for new-file lines.\r
\r
Each comment body format (from `references/review-guidelines.md` §8):\r
\r
```\r
[SEVERITY] \x3Cone-line issue>\r
\r
\x3C2-4 sentence explanation referencing the diff.>\r
\r
Suggestion:\r
```\x3Clanguage>\r
\x3Ccorrected snippet>\r
```\r
```\r
\r
**Constraints:**\r
- Do not auto-approve the MR.\r
- Do not add labels or trigger pipelines.\r
- Only post comment-type discussions (no approval API calls).\r
- If a line is not in the diff, the API returns an error — log it and continue with the next comment.\r
- On HTTP 403 `insufficient_scope`, the script stops immediately and prints a fix instruction. Do not retry.\r
\r
## Behavior Rules\r
\r
- Strict engineering tone. No emotional language. No generic praise.\r
- Analyze only the modified code in the diff. Do not speculate about code outside the diff.\r
- Do not log or persist source code content.\r
- Respect ignore patterns strictly.\r
- For large diffs: process per file, deduplicate similar findings across files before final output.\r
\r
## References\r
\r
- **Review rules, severity table, comment format**: `references/review-guidelines.md`\r
  - §2 Java & Spring Boot (Clean Code, transactions, N+1, concurrency)\r
  - §3 MongoDB (queries, indexes, atomicity)\r
  - §4 PostgreSQL (SQL correctness, isolation, migrations)\r
  - §5 React & TypeScript (hooks, type safety, security)\r
  - §6 SOLID & DDD alignment\r
  - §7 Severity classification table\r
  - §8 Inline comment format template\r