open-code-review

The project follows semantic versioning. Only the latest version is supported (documented in SECURITY.md). Each release includes auto-generated release notes from conventional commits, listing features, fixes, and breaking changes to guide upgrade. See: https://github.com/alibaba/open-code-review/releases

https://github.com/alibaba/open-code-review/issues

No vulnerabilities have been reported or resolved in the last 12 months. SECURITY.md § Recognition commits to crediting reporters of future vulnerability reports.
URL: https://github.com/alibaba/open-code-review/blob/main/SECURITY.md#recognition

• URL：
  https://github.com/alibaba/open-code-review/blob/main/SECURITY.md#response-timeline
• Justification：
  SECURITY.md documents the full response process: acknowledgment within 3 business days, initial assessment within 7 business days, fix and coordinated disclosure within 14 days for critical/high-severity issues.

• URL：https://github.com/alibaba/open-code-review/blob/main/CONTRIBUTING.md#code-quality
• Justification：Go: the project follows the standard gofmt formatting enforced by "go fmt ./...". Commit messages follow Conventional Commits format as documented in CONTRIBUTING.md §"Commit Messages".

The Makefile "check" target runs "go mod tidy", "go fmt ./...", and "go vet ./..." in sequence. CI automatically runs "go vet ./..." on every push and PR. See: https://github.com/alibaba/open-code-review/blob/main/.github/workflows/ci.yml

The Go toolchain honors standard build environment variables (GOOS, GOARCH, CGO_ENABLED, GOFLAGS). The Makefile passes linker flags via -ldflags and does not overrideuser-provided values. Cross-compilation uses standard GOOS/GOARCH variables. CC/CFLAGS are not applicable as CGO is disabled (CGO_ENABLED=0).

The development build target (make build) preserves full debugging information. Only release/distribution builds apply -s -w linker flags to strip debug info for smaller binaries. Developers can always build with full debug symbols using the default make build or plain go build.

The project uses a single flat Makefile with no recursive make calls. Go's build system natively resolves cross-package dependencies without recursive invocation. See: https://github.com/alibaba/open-code-review/blob/main/Makefile

Go produces reproducible builds by default when using the same Go version and OS/arch. The project pins the Go version (go 1.25.0 in go.mod), uses CGO_ENABLED=0 to eliminate C compiler variance, and locks all dependency versions via go.sum. Build metadata (version, commit, date) is injected via -ldflags, producing identical output for the same input parameters.

The project supports three standard installation methods: (1) npm: "npm install -g opencodereview" with "npm uninstall -g opencodereview" for removal; (2) shell script: "curl -fsSL ... | sh"; (3) Go: "go install github.com/open-code-review/open-code-review/cmd/opencodereview@latest". See README § Quick Start.
URL: https://github.com/alibaba/open-code-review#quick-start

The project does not use a custom installation system. Installation is handled by standard package managers (npm, go install) which follow their own conventions for installation paths. There is no "make install" target that writes to custom paths.

CONTRIBUTING.md § "Getting Started" documents the quick setup: git clone, make build, make test. Prerequisites are Go 1.25+, Git, and Make — all standard developer tools. No additional configuration or external services required.
URL: https://github.com/alibaba/open-code-review/blob/main/CONTRIBUTING.md#getting-started

• URL：https://github.com/alibaba/open-code-review/blob/main/go.mod
• Justification：All external dependencies are declared in go.mod (Go modules) with exact version constraints. The go.sum file provides cryptographic checksums for integrity verification. npm dependencies are listed in package.json.

URL: https://github.com/alibaba/open-code-review/blob/main/.github/dependabot.yml
Justification: The project uses GitHub Dependabot to automatically monitor Go module and GitHub Actions dependencies for known vulnerabilities and outdated versions.
Additionally, govulncheck runs in CI on every push/PR to detect known Go vulnerabilities.

Justification: All reused components are Go modules managed via go.mod. They can be individually updated with "go get -u <module>" or bulk-updated with "go get -u ./...". Dependabot also automates dependency update PRs.

Justification: The project uses current, maintained APIs: Go 1.25+ stdlib, OpenAI Go SDK v3, Anthropic Go SDK v1, OpenTelemetry v1.43. "go vet" runs in CI to catch deprecated API usage. No deprecated APIs are knowingly used.

Justification: GitHub Actions CI runs the full test suite (go test -v -race -count=1 ./...) on every push to main and every pull request. Test results are reported in the PR checks. See: https://github.com/alibaba/open-code-review/blob/main/.github/workflows/ci.yml

Justification: CONTRIBUTING.md mandates "Write tests — Add or update tests for any behavior changes" for all PRs. Bug fix PRs are required to include regression tests. The project has 35 test files covering all major packages. Review process enforces this requirement before merge.

Justification:
OpenCodeReview uses Go's built-in FLOSS coverage tool (go test -coverprofile). The CI workflow enforces an 80% statement coverage threshold — builds fail if coverage drops below 80%. Current total statement coverage is 81.2%.
URL: https://github.com/open-code-review/open-code-review/blob/main/.github/workflows/ci.yml

URL: https://github.com/alibaba/open-code-review/blob/main/CONTRIBUTING.md#pull-request-process
Justification: CONTRIBUTING.md § "Pull Request Process" states: "Write tests — Add or update tests for any behavior changes." This is enforced during code review — PRs without tests for new functionality are not merged. CI gates ensure all tests pass before merge.

The CONTRIBUTING.md Pull Request Process section requires contributors to "Write tests — Add or update tests for any behavior changes" (item 2). This policy is documented and enforced during code review.

Go does not have traditional compiler warning flags; go vet is the standard static analyzer. The project runs go vet ./... on every push and PR in CI, failing the build on any diagnostic. Additionally, govulncheck scans for known vulnerabilities, and the race detector (-race) is enabled for all tests. Release builds use CGO_ENABLED=0 to eliminate C-level warnings entirely.

Justification: The project implements secure design principles: (1) Least privilege: CGO_ENABLED=0, no unnecessary system access; (2) Defense in depth: input validation at CLI, diff parser, and LLM response boundaries; (3) Fail-safe defaults: API keys are never logged or transmitted beyond the configured LLM provider; (4) Complete mediation: the viewer component uses Host-header allowlist and DNS-rebinding protection. See SECURITY.md for scope and design rationale.

N/A Justification: The project does not implement its own cryptographic algorithms. All cryptographic operations (TLS for HTTPS API calls) are delegated to the Go standard library, which natively supports algorithm agility and is updated with Go releases.

Justification: Authentication credentials (LLM API keys) are provided exclusively via environment variables, completely separated from configuration files, code, and logs. Users can rotate keys at any time without recompilation or configuration changes — simply update the environment variable.

Justification: All network communications use HTTPS exclusively. The project communicates with LLM API providers (OpenAI, Anthropic, etc.) via HTTPS using Go's net/http standard library. There is no support for insecure HTTP connections to API endpoints. The viewer component also serves over HTTPS when configured.

Justification: Go's crypto/tls package enforces TLS 1.2 as the minimum version by default (since Go 1.18). The project does not override this default. All outbound HTTPS connections to LLM APIs use TLS 1.2 or later.

Justification: Go's net/http and crypto/tls perform full TLS certificate verification by default. The project does not set InsecureSkipVerify or disable certificate checking in any HTTP client configuration. All LLM API connections verify server certificates against the system trust store.

Justification: Go's net/http client completes the full TLS handshake (including certificate verification) before sending any HTTP headers or request data. API keys are sent as HTTP headers (Authorization/x-api-key) only after TLS verification succeeds. The project does not customize this behavior.

Release binaries are signed using GitHub Artifact Attestations (Sigstore keyless signing backed by GitHub Actions OIDC). No long-lived private key exists. Verification process is documented in SECURITY.md § Release Signatures.
URL: https://github.com/alibaba/open-code-review/blob/main/SECURITY.md#release-signatures

Starting from the next release, all version tags are cryptographically signed using SSH keys via git tag -s. Git signing is configured with gpg.format=ssh. Users can verify tag signatures with git tag -v <tag>.

Justification: The project validates inputs at multiple boundaries: (1) CLI flags and configuration are validated before use; (2) Git diff output is parsed with strict format validation; (3) LLM responses are validated before being used for code comments (JSON schema validation, line number bounds checking); (4) The viewer validates Host headers against an allowlist to prevent DNS rebinding attacks. File paths are validated against path traversal attempts.

Justification: The project employs multiple hardening measures: (1) Compiled with CGO_ENABLED=0, eliminating C memory safety risks; (2) Go's built-in bounds checking, nil pointer protection, and race detector (used in CI via -race flag); (3) Release binaries are statically linked with no external shared library dependencies; (4) Viewer component sets security headers (Host allowlist, DNS-rebinding protection); (5) Tests run with -race to detect data races.

• URL: https://github.com/alibaba/open-code-review/blob/main/ASSURANCE_CASE.md
• Justification: ASSURANCE_CASE.md documents the threat model (5 actors, 4 trust boundaries, 7 identified threats), maps Saltzer & Schroeder's 8 secure design

URL: https://github.com/alibaba/open-code-review/blob/main/.github/workflows/ci.yml
Justification: The project runs govulncheck in CI on every push and PR to detect known Go vulnerabilities. Additionally, go vet runs in CI to catch common code issues including suspicious constructs and potential bugs.

The project is written entirely in Go and TypeScript, both memory-safe languages. CGO is disabled (CGO_ENABLED=0), so no C/C++ code is linked. N/A applies.