release/1.18.0#302
Merged
Merged
Conversation
Support native and OAuth login modes, with OIDC issuer discovery for Microsoft Entra ID and Keycloak. Add OAuth callback/error handling, safe opt-in diagnostics, Docker Compose configuration, documentation, and tests while preserving native login and auto-login behavior.
Support native and OAuth login modes, with OIDC issuer discovery for Microsoft Entra ID and Keycloak. Add OAuth callback/error handling, safe opt-in diagnostics, Docker Compose configuration, documentation, and tests while preserving native login and auto-login behavior.
Feature/backmerge to develop
• feat(security): add configurable OAuth2/OIDC web login Support native and OAuth login modes, with OIDC issuer discovery for Microsoft Entra ID and Keycloak. Add OAuth callback/error handling, safe opt-in diagnostics, Docker Compose configuration, documentation, and tests while preserving native login and auto-login behavior.
Wire PrAuditEventService through the agent loop and PR workflow
orchestrator to emit structured audit events (WORKFLOW_RUN_STARTED,
STEP_APPENDED, RUN_COMPLETED, TOOL_CALL_EXECUTED) on every agent
interaction. Tool-call records are captured inside AgentLoop and
forwarded via a Consumer<AgentRunContext.ToolCallRecord> threaded
through AgentRunContext → PrWorkflowContext → workflow run sites.
Also introduce a configurable retention policy with a nightly garbage
collector (AuditLogGarbageCollector) that deletes audit events older
than audit.retention (default P90D). Both retention and gc-cron are
settable via AUDIT_RETENTION / AUDIT_GC_CRON env vars in Docker.
Collateral cleanup:
- Tighten Javadoc and compact accessor/short-method bodies across the
prworkflow and agentreview packages.
- Move McpOrchestrationService out of AgentReviewContext record into
AgentReviewService constructor injection, keeping the context record
focused on bot-level configuration.
New files:
- src/main/java/org/remus/giteabot/audit/ (AuditEventType, PrAuditEvent,
PrAuditEventRepository, PrAuditEventService, ActorType,
AuditLogGarbageCollector)
- src/main/resources/db/migration/{h2,postgresql}/V34__pr_audit_events.sql
- src/test/java/org/remus/giteabot/audit/ (PrAuditEventServiceTest,
PrAuditEventToolCallTest, AuditLogGarbageCollectorTest)
- doc/development-archive/audit-trail-plan.md
- doc/development-archive/runner-refactoring.md
feature/audit-logs
- Add micrometer-registry-prometheus dependency and update Maven enforcer whitelist - Expose prometheus Actuator endpoint with PROMETHEUS_ENABLED docker toggle - Register DB-derived gauges for reviews, findings, AI usage, errors, and audit tool calls - Add agent.tool_calls_total live counter and wire it into AgentLoop - Add FINDING_POSTED audit event type emitted alongside REVIEW_COMPLETED - Add integration and unit tests for the endpoint and metric registration - Document endpoint, toggle, and metric inventory in DEPLOYMENT.md and DOCKERHUB_README.md - Add Prometheus feature bullet and workflow table row to README.md and translations
feat(metrics): expose Prometheus endpoint at /actuator/prometheus
…iew): deterministic severity-threshold decisions
Gitea PR review API expects event="APPROVED", not GitHub's "APPROVE".
Update GiteaApiClient.reviewEvent and the corresponding test.
Replace the subjective LLM formal review decision (APPROVE / REQUEST_CHANGES /
NONE) with an operator-configurable, auditable severity-threshold model:
- LLM now returns only a severity classification JSON:
{"blocker": n, "medium": n, "low": n}
- Final action is computed deterministically from optional per-severity
thresholds (blockerThreshold, mediumThreshold, lowThreshold)
- All thresholds empty -> NONE
- Malformed classification JSON -> NONE (fail-open)
- Backward compatible: when formal decisioning is disabled, behavior is
unchanged
Add Flyway migration V35 to rewrite existing agentic-review
formalReviewDecisionPrompt values to the new severity-classification prompt.
…tion fix(gitea): send APPROVED event for Gitea approvals; feat(agentic-review): deterministic severity-threshold decisions
…th default-settings and internal h2 database
Add E2E tests for PR #298
feature/outgoing-webhooks
…ployment sections
deploy(docker): removed the hardcoded spring profile to let it run with default-settings and internal h2 database
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.