AI-Assisted Code Review and PR Analysis

Developer pushes feature branch to GitHub
         │
         ▼
  Developer opens Pull Request
         │
         ├──► CodeRabbit analyzes PR automatically
         │      - Line-by-line code review
         │      - Security and logic issue flagging
         │      - Summary comment posted to PR
         │
         ├──► GitHub Copilot suggestions surfaced in editor (pre-push)
         │
         ▼
  Jenkins pipeline triggered on PR creation/update
         │
         ├── Stage: Checkout
         ├── Stage: Install & Lint
         ├── Stage: Tests
         ├── Stage: AI Review Gate (poll GitHub API for CodeRabbit verdict)
         │      └── BLOCK if AI flagged critical issues
         ├── Stage: Build Docker Image
         ├── Stage: Push to Registry
         └── Stage: Deploy to K3s (only on merge to main)

sudo apt-get update && sudo apt-get upgrade -y
sudo apt-get install -y \
  curl \
  gnupg \
  ca-certificates \
  lsb-release \
  apt-transport-https \
  software-properties-common \
  git \
  jq \
  unzip \
  ufw

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 8080/tcp
sudo ufw allow 50000/tcp
sudo ufw enable

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 6443/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 10250/tcp
sudo ufw enable

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin

# .coderabbit.yaml
version: "2"

reviews:
  # Automatically request changes when critical issues are found
  request_changes_workflow: true

  # Set review profile: chill (lenient) | assertive (strict) | informative (comments only)
  profile: "assertive"

  # Review all changed files, not just the diff
  review_status: true

  # Post a high-level walkthrough comment on every PR
  high_level_summary: true

  # Enable path-specific review instructions
  path_instructions:
    - path: "src/**/*.js"
      instructions: |
        Focus on: security vulnerabilities, async/await error handling,
        input validation, and N+1 query patterns.
    - path: "k8s/**/*.yaml"
      instructions: |
        Check for: missing resource limits, missing readiness probes,
        use of latest image tags, and overly permissive RBAC.
    - path: "Dockerfile"
      instructions: |
        Check for: non-root user enforcement, pinned base image tags,
        secrets in ENV instructions, and unnecessary packages.

  # Files to exclude from AI review
  path_filters:
    - "!package-lock.json"
    - "!**/*.test.js"
    - "!coverage/**"

chat:
  # Allow team members to ask CodeRabbit follow-up questions in PR comments
  auto_reply: true

git add .coderabbit.yaml
git commit -m "chore: add CodeRabbit configuration"
git push origin main

# Install GitHub CLI first
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
  | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] \
  https://cli.github.com/packages stable main" \
  | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null

sudo apt-get update
sudo apt-get install -y gh

# Authenticate (use a service account token for CI)
echo "<GITHUB_TOKEN>" | gh auth login --with-token

# Install Copilot CLI extension
gh extension install github/gh-copilot
gh copilot --version

#!/bin/bash
# Run once after cloning: bash scripts/install-hooks.sh

HOOK_DIR="$(git rev-parse --git-dir)/hooks"

cat > "$HOOK_DIR/pre-push" << 'EOF'
#!/bin/bash
# Remind developers to address Copilot suggestions before pushing
echo ""
echo "Pre-push checklist:"
echo "  [ ] Copilot suggestions reviewed and addressed"
echo "  [ ] No hardcoded secrets or credentials"
echo "  [ ] Unit tests updated for changed functions"
echo ""
read -p "Continue push? (y/n): " confirm
[ "$confirm" = "y" ] || exit 1
EOF

chmod +x "$HOOK_DIR/pre-push"
echo "Git hooks installed."

chmod +x scripts/install-hooks.sh
git add scripts/install-hooks.sh
git commit -m "chore: add git hooks installer"

sudo apt-get install -y openjdk-21-jdk
java -version
echo 'export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64' | sudo tee -a /etc/environment
source /etc/environment

curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key \
  | sudo tee /usr/share/keyrings/jenkins-keyring.asc > /dev/null

echo "deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] \
  https://pkg.jenkins.io/debian-stable binary/" \
  | sudo tee /etc/apt/sources.list.d/jenkins.list > /dev/null

sudo apt-get update
sudo apt-get install -y jenkins

sudo systemctl enable jenkins
sudo systemctl start jenkins
sudo systemctl status jenkins

sudo cat /var/lib/jenkins/secrets/initialAdminPassword

curl -O http://localhost:8080/jnlpJars/jenkins-cli.jar

java -jar jenkins-cli.jar \
  -s http://localhost:8080 \
  -auth admin:<admin-password> \
  install-plugin \
    docker-workflow \
    github \
    credentials-binding \
    http_request \
    --restart

sudo usermod -aG docker jenkins
sudo systemctl restart jenkins
sudo -u jenkins docker ps

pipeline {
  agent any

  environment {
    DOCKER_REGISTRY    = 'docker.io'
    DOCKER_IMAGE_NAME  = 'yourdockerhubuser/myapp'
    DOCKER_CREDENTIALS = 'dockerhub-credentials'
    GITHUB_TOKEN_ID    = 'github-token'
    GITHUB_REPO        = 'your-org/your-repo'
    K8S_NAMESPACE      = 'production'
    K8S_DEPLOYMENT     = 'myapp'
    CODERABBIT_BOT     = 'coderabbitai[bot]'
  }

  options {
    disableConcurrentBuilds()
    timeout(time: 30, unit: 'MINUTES')
    buildDiscarder(logRotator(numToKeepStr: '10'))
  }

  stages {

    stage('Checkout') {
      steps {
        checkout scm
        script {
          env.GIT_SHORT_SHA = sh(
            script: 'git rev-parse --short HEAD',
            returnStdout: true
          ).trim()
          env.IMAGE_TAG = "${env.DOCKER_IMAGE_NAME}:${env.GIT_SHORT_SHA}"
          env.IMAGE_TAG_LATEST = "${env.DOCKER_IMAGE_NAME}:latest"

          // Capture PR number from the GitHub webhook environment variable
          // Jenkins GitHub plugin sets CHANGE_ID for PR builds
          env.PR_NUMBER = env.CHANGE_ID ?: ''
          echo "PR number: ${env.PR_NUMBER}"
          echo "Building image: ${env.IMAGE_TAG}"
        }
      }
    }

    stage('Install Dependencies') {
      steps {
        sh '''
          node --version
          npm --version
          npm ci
        '''
      }
    }

    stage('Lint') {
      steps {
        sh 'npm run lint'
      }
    }

    stage('Test') {
      steps {
        sh 'npm test -- --ci --coverage'
      }
      post {
        always {
          junit allowEmptyResults: true, testResults: 'test-results/*.xml'
        }
      }
    }

    stage('AI Review Gate') {
      // Only enforce the gate on pull request builds, not direct pushes to main
      when {
        expression { return env.PR_NUMBER != '' }
      }
      steps {
        script {
          withCredentials([string(credentialsId: env.GITHUB_TOKEN_ID, variable: 'GH_TOKEN')]) {
            // Poll CodeRabbit review state with retries
            // CodeRabbit may take 1-3 minutes to post its review after the PR is opened
            def maxAttempts = 12
            def attempt = 0
            def reviewState = 'PENDING'

            while (attempt < maxAttempts && reviewState == 'PENDING') {
              attempt++
              echo "Polling GitHub Reviews API - attempt ${attempt}/${maxAttempts}"

              def apiResponse = sh(
                script: """
                  curl -s -H "Authorization: token ${GH_TOKEN}" \
                    -H "Accept: application/vnd.github+json" \
                    "https://api.github.com/repos/${env.GITHUB_REPO}/pulls/${env.PR_NUMBER}/reviews"
                """,
                returnStdout: true
              ).trim()

              // Extract the most recent review state from CodeRabbit bot
              def codeRabbitState = sh(
                script: """
                  echo '${apiResponse}' | jq -r '
                    [ .[] | select(.user.login == "${env.CODERABBIT_BOT}") ] |
                    last |
                    .state // "PENDING"
                  '
                """,
                returnStdout: true
              ).trim()

              echo "CodeRabbit review state: ${codeRabbitState}"

              if (codeRabbitState == 'CHANGES_REQUESTED') {
                reviewState = 'BLOCKED'
              } else if (codeRabbitState == 'APPROVED' || codeRabbitState == 'COMMENTED') {
                reviewState = 'PASSED'
              } else {
                // PENDING or no review yet - wait and retry
                if (attempt < maxAttempts) {
                  echo "No CodeRabbit review yet, waiting 30 seconds..."
                  sleep(30)
                }
              }
            }

            if (reviewState == 'BLOCKED') {
              // Post a comment to the PR explaining the block
              sh """
                curl -s -X POST \
                  -H "Authorization: token ${GH_TOKEN}" \
                  -H "Accept: application/vnd.github+json" \
                  "https://api.github.com/repos/${env.GITHUB_REPO}/issues/${env.PR_NUMBER}/comments" \
                  -d '{"body": ":robot: **Jenkins Pipeline Blocked**\\n\\nCodeRabbit has requested changes on this PR. The deployment pipeline will not proceed until all CodeRabbit issues are resolved and the review status changes to Approved or Commented.\\n\\nBuild: ${env.BUILD_URL}"}'
              """
              error("AI Review Gate FAILED: CodeRabbit has requested changes on PR #${env.PR_NUMBER}. Resolve all flagged issues before this pipeline can proceed.")
            } else if (reviewState == 'PENDING') {
              // Timed out waiting for CodeRabbit - treat as non-blocking warning, not a hard fail
              // Change to error() if you want to enforce a hard block on timeout
              echo "WARNING: CodeRabbit review not received within timeout. Proceeding with caution."
            } else {
              echo "AI Review Gate PASSED: CodeRabbit review state is ${reviewState}"
            }
          }
        }
      }
    }

    stage('Build Docker Image') {
      // Only build after the AI gate passes
      steps {
        sh """
          docker build \
            --label git-commit=${env.GIT_SHORT_SHA} \
            --label build-date=\$(date -u +%Y-%m-%dT%H:%M:%SZ) \
            -t ${env.IMAGE_TAG} \
            -t ${env.IMAGE_TAG_LATEST} \
            .
        """
      }
    }

    stage('Push to Registry') {
      steps {
        withCredentials([usernamePassword(
          credentialsId: env.DOCKER_CREDENTIALS,
          usernameVariable: 'DOCKER_USER',
          passwordVariable: 'DOCKER_PASS'
        )]) {
          sh """
            echo "\$DOCKER_PASS" | docker login -u "\$DOCKER_USER" --password-stdin ${env.DOCKER_REGISTRY}
            docker push ${env.IMAGE_TAG}
            docker push ${env.IMAGE_TAG_LATEST}
          """
        }
      }
      post {
        always {
          sh 'docker logout'
        }
      }
    }

    stage('Deploy to Kubernetes') {
      // Only deploy on merges to main, not on PR builds
      when {
        branch 'main'
      }
      steps {
        withCredentials([file(credentialsId: 'kubeconfig-k3s', variable: 'KUBECONFIG')]) {
          sh """
            kubectl set image deployment/${env.K8S_DEPLOYMENT} \
              ${env.K8S_DEPLOYMENT}=${env.IMAGE_TAG} \
              -n ${env.K8S_NAMESPACE}

            kubectl rollout status deployment/${env.K8S_DEPLOYMENT} \
              -n ${env.K8S_NAMESPACE} \
              --timeout=300s
          """
        }
      }
    }

  }

  post {
    success {
      echo "Pipeline completed. Image: ${env.IMAGE_TAG}"
    }
    failure {
      echo "Pipeline failed. Check stage logs above."
    }
    cleanup {
      sh """
        docker rmi ${env.IMAGE_TAG} || true
        docker rmi ${env.IMAGE_TAG_LATEST} || true
        docker image prune -f
      """
    }
  }
}

reviews:
  request_changes_workflow: true
  # This setting causes CodeRabbit to post a formal "Request Changes" review
  # which GitHub reads as a blocking check when branch protection is enabled

FROM node:20-alpine AS builder

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY src/ ./src/

FROM node:20-alpine AS production

RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:appgroup /app/src ./src
COPY --chown=appuser:appgroup package.json ./

USER appuser
EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget -qO- http://localhost:3000/health || exit 1

CMD ["node", "src/index.js"]

docker build -t myapp:local .
docker run --rm -p 3000:3000 myapp:local
curl http://localhost:3000/health

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server \
  --disable traefik \
  --tls-san <k3s-node-public-ip>" sh -

sudo systemctl status k3s
sudo kubectl get nodes

sudo cat /etc/rancher/k3s/k3s.yaml

sudo mkdir -p /var/lib/jenkins/.kube
# Paste the k3s.yaml content, then fix the server address:
sudo sed -i 's/127.0.0.1/<k3s-node-ip>/g' /var/lib/jenkins/.kube/config
sudo chown -R jenkins:jenkins /var/lib/jenkins/.kube
sudo chmod 600 /var/lib/jenkins/.kube/config

# Verify
sudo -u jenkins kubectl get nodes

apiVersion: v1
kind: Namespace
metadata:
  name: production

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: production
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: myapp
    spec:
      terminationGracePeriodSeconds: 30
      containers:
      - name: myapp
        image: yourdockerhubuser/myapp:latest
        ports:
        - containerPort: 3000
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "500m"
            memory: "256Mi"
        readinessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 15
          periodSeconds: 20

apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: production
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 3000
  type: ClusterIP

kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml

export GH_TOKEN="your-github-token"
export REPO="your-org/your-repo"
export PR_NUMBER="42"

curl -s \
  -H "Authorization: token $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/${REPO}/pulls/${PR_NUMBER}/reviews" \
  | jq '.'

{
  "id": 12345678,
  "user": {
    "login": "coderabbitai[bot]"
  },
  "body": "**Actionable comments posted: 2**...",
  "state": "CHANGES_REQUESTED",
  "submitted_at": "2024-11-01T10:23:45Z"
}

curl -s \
  -H "Authorization: token $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/${REPO}/pulls/${PR_NUMBER}/reviews" \
  | jq -r '
      [ .[] | select(.user.login == "coderabbitai[bot]") ] |
      last |
      .state // "PENDING"
    '

curl -s -X POST \
  -H "Authorization: token $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments" \
  -d '{
    "body": ":robot: Pipeline blocked: CodeRabbit has requested changes. Resolve all flagged issues before retrying."
  }'

curl -s \
  -H "Authorization: token $GH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/${REPO}/pulls/${PR_NUMBER}/comments" \
  | jq '[.[] | select(.user.login == "coderabbitai[bot]")] | length'

kubectl create secret generic myapp-secrets \
  --namespace production \
  --from-literal=db-password='your-db-password-here'

kubectl get secret myapp-secrets -n production

env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: myapp-secrets
      key: db-password

git checkout -b feature/new-endpoint
# Make changes
git add .
git commit -m "feat: add /users endpoint"
git push origin feature/new-endpoint

# Watch pods update in real time
kubectl rollout status deployment/myapp -n production -w

# Confirm the new image SHA is running
kubectl get pods -n production \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[0].image}{"\n"}{end}'

kubectl rollout undo deployment/myapp -n production
kubectl rollout status deployment/myapp -n production

# Verify the GitHub App is installed on the repository
# Go to: github.com/settings/installations > coderabbitai

# Check if .coderabbit.yaml has YAML syntax errors
cat .coderabbit.yaml | python3 -c "import sys, yaml; yaml.safe_load(sys.stdin)" && echo "YAML valid"

# Confirm the PR is not a draft (CodeRabbit skips draft PRs by default)
# Convert draft to Ready for Review on GitHub

} else if (reviewState == 'PENDING') {
  error("AI Review Gate TIMED OUT: No CodeRabbit review received within 6 minutes.")
}

# Test the token manually
curl -s -H "Authorization: token <your-token>" https://api.github.com/user | jq '.login'
# Should return your GitHub username

# Verify the token is stored correctly in Jenkins
# Manage Jenkins > Credentials > verify ID matches GITHUB_TOKEN_ID in Jenkinsfile

sh """
  curl -s -H "Authorization: token ${GH_TOKEN}" \
    "https://api.github.com/repos/${env.GITHUB_REPO}/pulls/${env.PR_NUMBER}/reviews" \
    > /tmp/reviews.json

  jq -r '
    [ .[] | select(.user.login == "${env.CODERABBIT_BOT}") ] |
    last | .state // "PENDING"
  ' /tmp/reviews.json
"""

stage('Debug Branch') {
  steps {
    echo "BRANCH_NAME: ${env.BRANCH_NAME}"
    echo "CHANGE_ID: ${env.CHANGE_ID}"
  }
}