Static demo
AI-assisted pull request analysis shown with canned data, so the public demo costs nothing to run.
lokeshkaki/pullmint #42
34
Medium risk
Pullmint identifies a mostly safe workflow change with two review risks around webhook validation and retry behavior.
GitHub sends a pull_request event. Pullmint verifies the signature before accepting work.
The API records the run and queues a background job so ingestion stays fast.
Relevant diff, file metadata, and prior findings are compressed into a bounded prompt.
The worker groups observations into actionable review comments and risk signals.
The dashboard shows the risk score, findings, and next action without exposing secrets.
apps/api/src/routes/webhooks.tsInvalid signatures should produce a clear 401 response and avoid queueing analysis work.
Recommendation: Return 401 before parsing the payload into the job contract, and add a regression test for invalid signatures.
apps/workers/src/analyze-pr.tsA worker retry after a GitHub API timeout may post duplicate comments if the first request succeeded remotely.
Recommendation: Use a deterministic finding fingerprint and upsert comments instead of blindly creating new ones.
apps/dashboard/src/pages/RunDetail.tsxThe UI waits for completed findings before showing useful status, which makes long analyses look stalled.
Recommendation: Render queued, analyzing, and publishing states from the run timeline.
Fastify receives webhooks, verifies HMAC signatures, persists runs, and enqueues analysis jobs.
BullMQ workers run bounded LLM analysis, retry recoverable failures, and write structured findings.
Postgres stores runs and findings, Redis backs queues, and MinIO stores larger analysis artifacts.
React/Vite presents run status, findings, risk scores, and review history.