Connecting ChatGPT to Code Evaluate Made Simple – DZone – Uplaza

The period of synthetic intelligence is already already in bloom. Everybody working in IT is already accustomed to our “new best friend” for improvement — AI. Working as a DevOps Engineer at Innovecs, I’d prefer to share one among my newest findings.

Idea

• Would you want each pull/merge request to be checked by ChatGPT-4 first after which by you?
• Would you like immediate suggestions on code adjustments earlier than your colleagues see them?
• How about detecting who dedicated confidential knowledge or API keys and the place with the flexibility to tag the “culprit” for correction instantly?

We’re completely conscious that GPT can generate code fairly nicely. . . however it seems it will probably evaluation it simply as easily! I’ll instantly present how this works in apply (elements of the code are blurred to keep away from displaying an excessive amount of).

Step 1

I created a check merge request during which I added a JSON file with barely damaged formatting and plaintext passwords, recreating a safety leak:

As we will see, AI not solely detected the delicate data but additionally masked it in its remark + tagged me to take away it.

Or here is one other evaluation:

Way more highly effective analytics in comparison with instruments like GitLeaks, which carry out easy searches statically utilizing regex and wildcards.

Step 2

Examples from frontend merge requests (colleague’s screenshots), highlighting solely sure factors:

The GPT-4o mannequin exhibits fairly information of React. Everybody is aware of this design with the important thing, however they at all times neglect it.

Or right here, it’s like I’ve learn a e-book:

I can provide many examples, however the level is that its suggestions make sense! In fact, not all feedback are value consideration, however a big half is invaluable.

Implementation

I am going to clarify how one can program an automatic evaluation course of in Python in only one hour. This code must be added instantly to the CI/CD move for max impact and course of automation. It’s good to wrap it into one CI/CD job and execute it on every MR/PR (simply make an exception for adjustments from renovate/dependabot).

I might like to share the ready-made code, however sadly, I am unable to (as a consequence of firm restrictions). So, I am going to share the concept with architectural blocks so that you can piece it collectively like a constructor.

Let’s get to work, take Python, and write the code.

Step 1: Join To the AI Mannequin

We want a connection to the AI mannequin.

It might be GPT-4o from OpenAI. However I like to recommend Azure OpenAI, as Azure guarantees to not switch code and to not practice on it.

from openai import AzureOpenAI

Ask GPT how to do that if it is your first time.

Step 2: Code Adjustments and Feedback

Get the code adjustments and feedback on these adjustments. We use GitLab, so I am going to instantly present the endpoints for example:

• Code adjustments utilizing the MR adjustments API: /api/v4/tasks/{gitlab_project_id}/merge_requests/{gitlab_request_id}/adjustments?access_raw_diffs=true
• Feedback utilizing the MR notes API: /api/v4/tasks/{gitlab_project_id}/merge_requests/{gitlab_request_id}/notes?order_by=created_at&type=asc

The place:

gitlab_request_id = os.getenv("CI_MERGE_REQUEST_IID")

gitlab_project_id = os.getenv("CI_PROJECT_ID")

For aesthetic functions, the JSON response from GitLab must be parsed.

Step 3: Ship Code for AI Evaluate

Don’t forget so as to add a immediate initially with explanations on what to do, and put all of it into one request:

review_request=f"{prompt}nn{notes}nn{changes}"

Within the immediate, it is advisable to politely ask the AI to research your code adjustments primarily based on standards — one thing like this (a really simplified model in comparison with what we use):

“As a Developer, I wish to ask you to carry out a GitLab Merge Request evaluation.
Take into account earlier feedback famous beneath and keep away from repeating comparable suggestions.
When you spot a recurring concern, skip it.

For safety points or delicate data leaks, point out the assignee’s username with @.

Make your suggestions clear, concise, and actionable, with particular enchancment suggestions.

Evaluate the code snippet beneath primarily based on these standards:

• Syntax and Model: Search for syntax errors and deviations from conventions.
• Efficiency Optimization: Recommend adjustments to enhance effectivity.
• Safety Practices: Verify for vulnerabilities and hard-coded secrets and techniques (masks half the information).
• Error Dealing with: Establish unhandled exceptions or errors.
• Code High quality: Search for code smells, pointless complexity, or redundant code.
• Bug Detection: Discover potential bugs or logical errors.”

Step 4: Publish Response as Remark

That’s it! Merely put up the obtained response as a remark. 

Create a GitLab PAT token for this with the identify AI MR evaluation and direct POST to the MR notes API: /api/v4/tasks/{gitlab_project_id}/merge_requests/{gitlab_request_id}/notes

Conclusions

Benefits

Implementing this answer will deliver enhancements for:

• DevSecOps: Considerably provides safety
• Senior+ stage: Now discovering errors and shortcomings in MR/PR may be finished with out studying via the code — AI will do it for you.
• Improvement/QA: You instantly get surprisingly helpful feedback and proposals.
• Enterprise: Will get barely higher code on the output.

Disadvantages

• Price: Tough to foretell; All of it relies on how a lot you intend to submit for evaluation and which mannequin will conduct the evaluation.

Dangers

• Steady enchancment: Concepts for enhancing such a device may be countless; extra context doesn’t at all times imply higher evaluation. Iterative testing of adjustments requires a while.
• “Improvements”: Ee might turn into even lazier =), however laziness is the engine of progress, proper?

Prospects

Think about the alternatives: it is going to be your script, so you may, for instance:

• Add job context from Jira
• Create a abstract for PM
• Write launch notes/launch adjustments
• Seek for vulnerabilities

So let’s make our code higher and life simpler. Welcome to the AI period, expensive colleagues!