Spiralgang patch 2#4
Conversation
Reviewer's GuideThis PR restructures and streamlines GitHub Actions pipelines by modularizing the main Super-Coder-Lab workflow, introducing a standalone Build matrix, adding a browser-based polyglot IDE, and establishing new CI/linting jobs, while updating project scripts and cleaning up deprecated files. Sequence diagram for AI-assisted code generation and refactoring in the IDEsequenceDiagram
actor User
participant Terminal
participant AIOrchestrator
participant FileSystem
User->>Terminal: Enter 'generate <file> <description>'
Terminal->>AIOrchestrator: queryModel('deepseek', description)
AIOrchestrator-->>Terminal: AI-generated code
Terminal->>FileSystem: createOrUpdate(<file>, code)
Terminal-->>User: Notify file generated
User->>Terminal: Enter 'refactor <file> <instructions>'
Terminal->>FileSystem: Read file content
Terminal->>AIOrchestrator: queryModel('deepseek', instructions + code)
AIOrchestrator-->>Terminal: AI-refactored code
Terminal->>FileSystem: Update file with new code
Terminal-->>User: Notify file refactored
Class diagram for core IDE logic and AI orchestrationclassDiagram
class AIOrchestrator {
+models: dict
+queryModel(modelName, prompt)
+consensusQuery(prompt)
}
class FileSystem {
+fs: object
+navigateTo(pathParts)
+createOrUpdate(pathParts, content, isDir)
}
class Terminal {
+writeToTerminal(text, isHTML)
+updatePrompt()
+processCommand(command)
}
AIOrchestrator <.. Terminal : uses
FileSystem <.. Terminal : uses
Terminal o-- FileSystem
Terminal o-- AIOrchestrator
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @spiralgang, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request introduces significant new functionality by adding a comprehensive, browser-based polyglot IDE with advanced features like in-browser Python and Git, alongside AI-powered code assistance. It also enhances the project's CI/CD capabilities by implementing a GitHub Actions workflow for automated Android APK builds and adds an ESLint script for potential code quality checks in CI.
Highlights
- New Browser-Based Polyglot IDE: A single-file, browser-based polyglot IDE (
WebLabs_MobIDE.html) has been introduced. It features in-browser Python (Pyodide), JavaScript execution, a full Git client, AI-assisted code generation and refactoring, and simulated build/system tools. - Improved Pyodide Output Handling: The
WebLabs_MobIDE.htmlfile now correctly saves and restores Pyodide's standard output and error stream handlers when executing Python scripts, ensuring proper output redirection. - Enhanced Git Clone Robustness: The
git clonecommand within the IDE has been improved to include checks for existing directories, preventing accidental overwrites, and now provides robust error handling for cloning failures. - GitHub Actions for Android Builds: A new GitHub Actions workflow (
.github/workflows/Build.yml) has been added to automate the building and uploading of Android APKs for both debug and release variants using a matrix strategy. - ESLint Script for GitHub Actions: A
package.jsonfile has been added, including aneslint:github-actionscript, likely to integrate ESLint into a CI pipeline for code quality checks.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
General comments:
- This PR bundles unrelated changes—consider splitting the monolithic IDE addition and the GitHub Actions overhaul into separate, focused PRs for easier review and rollback.
- You have duplicated vendoring and LFS setup steps across multiple workflow files—extract that into a reusable composite action or shared snippet to eliminate redundancy.
- Workflow files mix different action versions and input references—standardize on a single version for actions (checkout, setup-java, github-script) and a consistent inputs syntax to improve maintainability.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- This PR bundles unrelated changes—consider splitting the monolithic IDE addition and the GitHub Actions overhaul into separate, focused PRs for easier review and rollback.
- You have duplicated vendoring and LFS setup steps across multiple workflow files—extract that into a reusable composite action or shared snippet to eliminate redundancy.
- Workflow files mix different action versions and input references—standardize on a single version for actions (checkout, setup-java, github-script) and a consistent inputs syntax to improve maintainability.
## Individual Comments
### Comment 1
<location> `.github/workflows/Super-Coder-Lab.yml:57` </location>
<code_context>
+ - name: Vendor Hugging Face model
+ run: git clone https://huggingface.co/Salesforce/codet5-small.git
+
+ - name: Normalize .gitattributes for LFS
+ run: |
+ cat >> .gitattributes <<'EOF'
</code_context>
<issue_to_address>
The normalization step only appends LFS rules if '*.bin filter=lfs' is missing, but does not check for other patterns.
Other model file types may be missed. Please check and add LFS rules for each relevant pattern individually.
</issue_to_address>
### Comment 2
<location> `.github/workflows/Super-Coder-Lab.yml:104` </location>
<code_context>
+ body: 'Automated vendoring of models and configuration files.'
+ })
+
+ - name: Direct Commit
+ if: ${{ inputs.commit_mode == 'commit' }}
+ run: git merge HEAD
</code_context>
<issue_to_address>
The direct commit step uses 'git merge HEAD', which may not have the intended effect.
Merging HEAD does nothing. Use the correct branch names to merge the intended changes.
</issue_to_address>
### Comment 3
<location> `.github/workflows/Build.yml:62` </location>
<code_context>
+ needs: setup
+
+ steps:
+ - name: Vendor Hugging Face model
+ run: git clone https://huggingface.co/Salesforce/codet5-small.git
+
</code_context>
<issue_to_address>
The vendor step clones the model repo but does not use the vendor_path input.
Use 'git clone <repo> <vendor_path>' to clone the model into the specified vendor_path instead of the default directory.
</issue_to_address>
### Comment 4
<location> `.github/workflows/Build.yml:65` </location>
<code_context>
+ - name: Vendor Hugging Face model
+ run: git clone https://huggingface.co/Salesforce/codet5-small.git
+
+ - name: Normalize .gitattributes for LFS
+ run: |
+ cat >> .gitattributes <<'EOF'
</code_context>
<issue_to_address>
The normalization step always appends LFS rules, which may result in duplicate entries.
Check for existing LFS rules in .gitattributes before appending to avoid duplicates.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
- name: Normalize .gitattributes for LFS
run: |
cat >> .gitattributes <<'EOF'
*.bin filter=lfs diff=lfs merge=lfs -text
*.safetensors filter=lfs diff=lfs merge=lfs -text
*.pt filter=lfs diff=lfs merge=lfs -text
*.onnx filter=lfs diff=lfs merge=lfs -text
*.tflite filter=lfs diff=lfs merge=lfs -text
EOF
git add .gitattributes
=======
- name: Normalize .gitattributes for LFS
run: |
declare -a rules=(
"*.bin filter=lfs diff=lfs merge=lfs -text"
"*.safetensors filter=lfs diff=lfs merge=lfs -text"
"*.pt filter=lfs diff=lfs merge=lfs -text"
"*.onnx filter=lfs diff=lfs merge=lfs -text"
"*.tflite filter=lfs diff=lfs merge=lfs -text"
)
touch .gitattributes
for rule in "${rules[@]}"; do
grep -qxF "$rule" .gitattributes || echo "$rule" >> .gitattributes
done
git add .gitattributes
>>>>>>> REPLACE
</suggested_fix>
### Comment 5
<location> `.github/workflows/Build.yml:112` </location>
<code_context>
+ body: 'Automated vendoring of models and configuration files.'
+ })
+
+ - name: Direct Commit
+ if: ${{ inputs.commit_mode == 'commit' }}
+ run: git merge HEAD
</code_context>
<issue_to_address>
The direct commit step uses 'git merge HEAD', which is a no-op.
To merge the fix branch into the target branch, use the appropriate branch names in the merge command.
</issue_to_address>
### Comment 6
<location> `.github/workflows/Build.yml:117` </location>
<code_context>
+ run: git merge HEAD
+
+ build:
+ name: Build APK
+ runs-on: ubuntu-latest
+ needs: commit
</code_context>
<issue_to_address>
The build step runs './gradlew' without specifying a task.
Specify the required Gradle task, such as 'assembleRelease', to ensure the APK is built correctly.
</issue_to_address>
### Comment 7
<location> `.github/workflows/Build.yml:139` </location>
<code_context>
+ uses: actions/upload-artifact@v4
+ with:
+ name: weblabs-mobide-apk
+ path: build/outputs/apk/WebLabs-MobIDE*.apk
</code_context>
<issue_to_address>
The artifact path is hardcoded and may not match the actual APK output location.
Build configurations can change the APK output path. Use a glob pattern or confirm the output location to ensure the correct file is uploaded.
</issue_to_address>
### Comment 8
<location> `.github/workflows/CI.yml:17` </location>
<code_context>
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v2
+ - uses: actions/setup-node@v2
+ with:
</code_context>
<issue_to_address>
The workflow uses older versions of actions (v2) instead of the latest stable releases.
Update to the latest stable action versions to benefit from recent performance and security improvements.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
=======
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
>>>>>>> REPLACE
</suggested_fix>
### Comment 9
<location> `.github/workflows/eslint.yml:13` </location>
<code_context>
+ steps:
+
+ # Check out the repository
+ - uses: actions/checkout@v1
+
+ # Install Node.js
</code_context>
<issue_to_address>
The workflow uses v1 of actions, which are outdated.
Please update to actions/checkout@v3 to ensure improved reliability and security.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
- uses: actions/checkout@v1
=======
- uses: actions/checkout@v3
>>>>>>> REPLACE
</suggested_fix>
### Comment 10
<location> `.github/workflows/setup.yml:22` </location>
<code_context>
+ - name: Install Dependencies
+ run: |
+ sudo apt-get update -y
+ sudo apt-get install -y git-lfs=2.13.3 jq=1.6
+ git lfs install --system
+ shell: bash
</code_context>
<issue_to_address>
Pinning package versions may cause installation failures if those versions are unavailable.
Remove strict version pins or add error handling for unavailable package versions to enhance reliability.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
sudo apt-get update -y
sudo apt-get install -y git-lfs=2.13.3 jq=1.6
git lfs install --system
=======
sudo apt-get update -y
if ! sudo apt-get install -y git-lfs jq; then
echo "Error: Failed to install dependencies (git-lfs, jq)."
exit 1
fi
git lfs install --system
>>>>>>> REPLACE
</suggested_fix>
### Comment 11
<location> `.github/workflows/setup.yml:31` </location>
<code_context>
+ HUGGINGFACE_TOKEN: ${{ secrets.HUGGINGFACE_TOKEN }}
+ MODEL_REPO: "Salesforce/codet5-small"
+ run: |
+ if [[ -z "$HUGGINGFACE_TOKEN" ]]; then
+ echo "Error: Missing Hugging Face token."
+ exit 1
</code_context>
<issue_to_address>
The workflow requires a Hugging Face token, but does not handle public repositories gracefully.
Allow the workflow to continue without a token when accessing public Hugging Face repositories.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
if [[ -z "$HUGGINGFACE_TOKEN" ]]; then
echo "Error: Missing Hugging Face token."
exit 1
fi
git clone https://user:${HUGGINGFACE_TOKEN}@huggingface.co/${MODEL_REPO} model_repo
echo "Model cloned to $(pwd)/model_repo"
=======
if [[ -z "$HUGGINGFACE_TOKEN" ]]; then
echo "No Hugging Face token provided. Attempting to clone public repository..."
git clone https://huggingface.co/${MODEL_REPO} model_repo
else
git clone https://user:${HUGGINGFACE_TOKEN}@huggingface.co/${MODEL_REPO} model_repo
fi
echo "Model cloned to $(pwd)/model_repo"
>>>>>>> REPLACE
</suggested_fix>
## Security Issues
### Issue 1
<location> `.github/workflows/CI.yml:31` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>
### Issue 2
<location> `.github/workflows/eslint.yml:24` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
There was a problem hiding this comment.
Code Review
This pull request introduces a web-based IDE in a single HTML file and a new GitHub Actions workflow. My review focuses on the correctness and maintainability of the new code. I've found several critical issues in WebLabs_MobIDE.html where code has been duplicated, leading to operations like Python script execution and git cloning being performed twice. There is also an invalid character at the beginning of the HTML file that will break it. Additionally, the new package.json contains a script pointing to a non-existent directory, and the new README.md has a section that could be formatted more clearly. Please see my detailed comments for suggestions on how to fix these issues.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Fix workflow triggers and update run command format.
|
Of what you said thing, anything not yet started or completed please initiate {**} !! <-- You Said: "Interacting with SourceryTrigger a new review: Comment @sourcery-ai review on the pull request.Continue discussions: Reply directly to Sourcery's review comments.Generate a GitHub issue from a review comment: Ask Sourcery to create an To Evaluate && Initiate ; {* Modularize and simplify Super-Coder-Lab workflow implementationRenamed workflow and updated checkout/actions versionsSplit the single job into setup, vendor, commit, and build stagesCondensed Git LFS vendoring, commit, and PR logic into concise steps.github/workflows/Super-Coder-Lab.ymlAdd standalone Build.yml workflow for model vendoring and APK generationDefined sequential jobs: setup, vendor, commit, buildExposed inputs for model repo, vendor path, branch, commit mode, and build flagAutomated LFS attribute normalization, metadata stripping, and APK assemble/upload.github/workflows/Build.ymlIntroduce WebLabs_MobIDE.html monolithic browser-based polyglot IDEIntegrated Pyodide for real Python execution and isomorphic-git for in-browser GitImplemented AIOrchestrator class for generate/refactor/analyze commandsEnhanced shell/file-system commands, build simulations, and error handlingWebLabs_MobIDE.htmlEstablish new CI and lint pipelinesAdded CI.yml for Node build, ESLint/Prettier, build, and Cypress testsAdded Flake8.yml for Python lintingAdded eslint.yml to enforce JavaScript lint on PRsAdded setup.yml to provision dev environment and clone HF models.github/workflows/CI.yml |
spiralgang
left a comment
spiralgang
left a comment
There was a problem hiding this comment.
/gemini
@gemini-code-assist
@sourcery-ai
@CodeT5
/codet5
/github-actions[bot]
YAML work flow errors are numerous!! please /review and /fix where possible
spiralgang
added
documentation
Signed-off-by: SpiralGang <Spiralgang@outlook.com>
Signed-off-by: SpiralGang <Spiralgang@outlook.com>
Signed-off-by: SpiralGang <Spiralgang@outlook.com>
Summary by Sourcery
Refactor and enhance the Super-Coder-Lab GitHub Actions workflows into discrete stages, introduce new build and CI pipelines, upgrade the in-browser polyglot IDE integration, and add supporting documentation.
New Features:
Enhancements:
Build:
CI:
Documentation:
Chores: