diff --git a/docs/codacy-ai/codacy-ai.md b/docs/codacy-ai/codacy-ai.md index c040592d36..dbeadc921b 100644 --- a/docs/codacy-ai/codacy-ai.md +++ b/docs/codacy-ai/codacy-ai.md @@ -44,7 +44,7 @@ AI-enhanced comments are optional, machine-generated suggestions that appear dir end="" %} -_This feature leverages OpenAI models, and is strictly opt-in: you need to get in touch with us in order to enable it._ +_This feature leverages OpenAI models through Amazon Bedrock, and is strictly opt-in: you need to get in touch with us in order to enable it._ Codacy False Positive triage analyzes results on a commit basis to give you visibility into issues that may be false positives (based on their context). During triage, each issue is given a confidence score along with an explanation. When the confidence level falls below a defined threshold, the issue is then flagged as an AI false positive and surfaced for manual review. You can evaluate potential false positives during a pull request in app or on any Codacy page where issues appear. These issues can be ignored or marked as Not a false positive. @@ -84,7 +84,7 @@ Also note that: _This feature leverages OpenAI models through Amazon Bedrock, and is strictly opt-in; it will only run on repositories or organizations where an admin has enabled it._ -The AI Reviewer combines the reliability of deterministic, rule-based static code analysis with the enhanced context and prioritization capabilities of AI. It draws in the necessary context from PR metadata, Jira ticket if [integration exists](../organizations/integrations/jira-integration.md), source code, and Codacy data to ensure the business intent matches the technical outcome, and can catch logic gaps that conventional scanners (and human reviewers) often miss. +The AI Reviewer combines the reliability of deterministic, rule-based static code analysis with the enhanced context and prioritization capabilities of AI. It draws in the necessary context from PR metadata, a [Jira or Linear ticket](#ticket-context), your repository's [review instructions and agent guidelines](#custom-instructions), source code, and Codacy data to ensure the business intent matches the technical outcome, and can catch logic gaps that conventional scanners (and human reviewers) often miss. More details about [AI Reviewer here](../repositories-configure/integrations/github-integration.md#ai-reviewer). @@ -96,11 +96,16 @@ More details about [AI Reviewer here](../repositories-configure/integrations/git 4. Save your changes. Once enabled, Codacy will start adding a Summary to your pull requests based on the AI-enriched reviews. 5. To request a PR review, click **Run Reviewer** in the Summary or call our [public API](https://api.codacy.com/api/api-docs#triggerpullrequestaireview). Your review will be published as soon as it's ready. -#### Jira context for the AI Reviewer +
-If the Jira integration is enabled, we will automatically attempt to detect the Jira ticket key (ABC-123, case-insensitive) in the Pull request metadata. If found, the ticket title and description will be used to enrich the context of our reviewer. If the ticket's parent is an epic or a task, the parent's title and description are used too. +#### Ticket context for the AI Reviewer {: id="ticket-context"} -More about the [Jira integration here](../organizations/integrations/jira-integration.md). +The AI Reviewer looks for a ticket key, such as ABC-123, in the pull request title, branch name, description, or latest commit message. It then reads the ticket from Jira or Linear: + +- **Jira:** If the [Jira integration](../organizations/integrations/jira-integration.md) is enabled, the AI Reviewer reads the ticket's title and description, and those of its parent epic or task. +- **Linear:** If you use the [Linear integration for GitHub](https://linear.app/docs/github), the AI Reviewer reads the Linear issues linked to the pull request when there's no Jira ticket. You don't need to set up anything in Codacy for this. + +The AI Reviewer is designed to paraphrase what it needs from the ticket rather than quote it in the review. #### Custom Instructions @@ -132,12 +137,34 @@ Rules for the output: - If something is not applicable or not inferable, omit the section entirely. ``` +The AI Reviewer also reads the guideline files that AI coding agents use, so it knows your conventions even without a `review.md` file: + +- `AGENTS.md`, `AGENT.md`, `CLAUDE.md`, and `GEMINI.md` +- `.cursorrules`, `.windsurfrules`, and the rule files in `.cursor/rules`, `.clinerules`, and `.rules` +- `.github/copilot-instructions.md` and the `.instructions.md` files in `.github/instructions` + +Use `review.md` for instructions that only apply to code reviews. + +#### Learning from your reviews {: id="learning-from-reviews"} + +The AI Reviewer adapts to your team using your recently closed pull requests. It reads: + +- The review comments that people left on those pull requests +- The replies and reactions to the AI Reviewer's own comments +From these, it picks up what your team cares about and what to stop flagging. To steer it, react 👍 to the AI Reviewer's comments that are right, and reply to the ones that are wrong saying why. **Notes** - Codacy does not use your code, repository contents, or comments to train external AI models. No customer code or review text is incorporated into model training. -- To enrich the review, the git diff of the Pull Request as well as some related files' contents can be sent as context. No data is stored on our side, or used to train any models. +- To enrich the review, Codacy can send this context: + - The git diff of the pull request and the contents of related files + - Your review instructions and agent guideline files + - The linked Jira or Linear tickets + - The AI Reviewer's earlier comments on the pull request + - Review comments from closed pull requests +- Codacy stores the AI Reviewer's own comments, a summary of your agent guideline files, and the rules it learns from your reviews. +- Codacy doesn't store the comments people leave on your pull requests, including replies to the AI Reviewer. For replies and reactions to its comments, it keeps only the number of reactions and whether the replies agree with the comment. - Prompts are neither stored nor visible to anyone. - As an extra precaution, before any code snippet is sent to the AI model, Codacy automatically redacts secrets (API keys, tokens, credentials, and other high-entropy strings) from the code context. diff --git a/docs/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis.md b/docs/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis.md index 18a7a265c6..1a0ba074ee 100644 --- a/docs/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis.md +++ b/docs/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis.md @@ -74,9 +74,9 @@ See AI Reviewer diff --git a/docs/organizations/integrations/jira-integration.md b/docs/organizations/integrations/jira-integration.md index e21dd249e7..0ec9e9910d 100644 --- a/docs/organizations/integrations/jira-integration.md +++ b/docs/organizations/integrations/jira-integration.md @@ -40,6 +40,8 @@ To uninstall the Jira integration, open your organization **Integrations**, page If the repository or organization has the AI Reviewer enabled, it will automatically check the Pull Request metadata for a Jira ticket key (ABC-123, case-insensitive). The title and description will be fetched to enrich the review context, along with those of the ticket's parent if it's an epic or a task, and the process will cross-check the required deliverable and acceptance criteria with the existing code changes. +The AI Reviewer is designed not to quote the ticket in its review. See [ticket context for the AI Reviewer](../../codacy-ai/codacy-ai.md#ticket-context). + More details about [AI Reviewer here](../../repositories-configure/integrations/github-integration.md#ai-reviewer). ## Creating Jira tickets from issues, dependencies and files diff --git a/docs/repositories-configure/integrations/github-integration.md b/docs/repositories-configure/integrations/github-integration.md index 82b86e838c..0874fb8f77 100644 --- a/docs/repositories-configure/integrations/github-integration.md +++ b/docs/repositories-configure/integrations/github-integration.md @@ -52,9 +52,9 @@ When enabled, Codacy posts a comment on your pull requests each time a new analy When enabled, the AI Reviewer posts a standalone code review on the pull request and adds a trigger section to the pull request summary comment, allowing you to run the reviewer on demand. When disabled, the trigger section does not appear in the pull request summary comment. -The AI Reviewer combines the reliability of deterministic, rule-based static code analysis with the enhanced context and prioritization capabilities of AI. It draws in the necessary context from PR metadata, Jira ticket if [integration exists](../../organizations/integrations/jira-integration.md), source code, and Codacy data to ensure the business intent matches the technical outcome, and can catch logic gaps that conventional scanners (and human reviewers) often miss. +The AI Reviewer combines the reliability of deterministic, rule-based static code analysis with the enhanced context and prioritization capabilities of AI. It draws in the necessary context from PR metadata, a [Jira or Linear ticket](../../codacy-ai/codacy-ai.md#ticket-context), source code, and Codacy data to ensure the business intent matches the technical outcome, and can catch logic gaps that conventional scanners (and human reviewers) often miss. -It provides feedback on missing or weak tests, complex or duplicated code, and keeps security concerns up to date. Beyond that, it adds contextual insights about whether the changes follow the requirements, business rules, and logic used in the project. +It comments only on the Codacy issues it judges worth a reviewer's attention, and sums up the rest in the review. Beyond that, it adds contextual insights about whether the changes follow the requirements, business rules, and logic used in the project. Configure when the AI Reviewer runs using the **Run reviewer** setting: @@ -63,9 +63,18 @@ Configure when the AI Reviewer runs using the **Run reviewer** setting: | Automatically (first review only) | Codacy runs the reviewer once automatically when the pull request is opened, then requires manual triggering for subsequent updates. | | Manually | Click **Run Reviewer** in the pull request summary comment or call our [public API](https://api.codacy.com/api/api-docs#triggerpullrequestaireview) to trigger a review on demand. | +A review can contain: + +- **A verdict** at the top: "No blocking issues noticed", "Worth a closer look", or "Resolve issues before merging". +- **A summary** of the changes, which can end with a short "Codacy also found" list of other Codacy findings. +- **Test suggestions** for the scenarios the changes should test. +- **Inline comments** on the lines that need attention, most with a suggested fix. React 👍 if a comment is right, or reply with what's wrong. The AI Reviewer [learns from these reactions and replies](../../codacy-ai/codacy-ai.md#learning-from-reviews). +- **General comments** for requirements it finds the changes don't implement. +- **Tips** under "Make this review better" with what you can add to get a better review. + When you run the reviewer again on the same pull request, it reads the comments from its earlier reviews so it doesn't raise the same point twice, unless new commits changed that code substantially. -The AI Reviewer skips pull requests that are too large, such as merges of whole branches. Instead, it posts a short review saying the pull request is too large and suggesting you split it. See the [limits Codacy applies](../../faq/code-analysis/does-codacy-place-limits-on-the-code-analysis.md). +The AI Reviewer skips pull requests that are too large (merges of whole branches, or git diffs larger than 1 MB). Instead, it posts a short review saying the pull request is too large and suggesting you split it. See the [limits Codacy applies](../../faq/code-analysis/does-codacy-place-limits-on-the-code-analysis.md). !!! tip Improve the AI Reviewer results by providing custom instructions. [Learn how to do it here](../../codacy-ai/codacy-ai.md#custom-instructions).