Repository navigation
feat: add GitHub Copilot privacy checks - #9
Conversation
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Warning Review limit reached
Next review available in: 31 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughGitHub Copilot settings are read from authenticated browser sessions, merged by GitHub login, included in reports and status output, and exposed through commands that disable model training while leaving repository and partner-agent settings unchanged. ChangesGitHub Copilot settings
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant nosnitch
participant Browser
participant GitHub
User->>nosnitch: run github training
nosnitch->>Browser: read GitHub session cookies
Browser-->>nosnitch: return cookies
nosnitch->>GitHub: check Copilot features and coding-agent settings
GitHub-->>nosnitch: return account and settings
nosnitch->>User: request confirmation
User-->>nosnitch: confirm disablement
nosnitch->>GitHub: submit training disablement
GitHub-->>nosnitch: return updated settings
nosnitch->>User: report result
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:XL
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
internal/github/github.go (1)
338-368: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAddress flagged errcheck/noctx findings.
golangci-lint flags unchecked
resp.Body.Close()errors (Lines 348, 365) andhttp.NewRequestinstead ofNewRequestWithContext(Lines 339, 354). Both are cheap to fix without changing the exported API.🛠️ Proposed fix
+import ( + "context" ... ) func get(client doer, target, cookie string) (int, []byte, error) { - req, err := http.NewRequest(http.MethodGet, target, nil) + req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, target, nil) if err != nil { return 0, nil, err } requestHeaders(req, cookie) resp, err := client.Do(req) if err != nil { return 0, nil, err } - defer resp.Body.Close() + defer func() { _ = resp.Body.Close() }() body, err := io.ReadAll(resp.Body) return resp.StatusCode, body, err } func postForm(client doer, target, referer, cookie string, form url.Values) (int, []byte, error) { - req, err := http.NewRequest(http.MethodPost, target, strings.NewReader(form.Encode())) + req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, target, strings.NewReader(form.Encode())) if err != nil { return 0, nil, err } requestHeaders(req, cookie) req.Header.Set("content-type", "application/x-www-form-urlencoded") req.Header.Set("referer", referer) resp, err := client.Do(req) if err != nil { return 0, nil, err } - defer resp.Body.Close() + defer func() { _ = resp.Body.Close() }() body, err := io.ReadAll(resp.Body) return resp.StatusCode, body, err }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/github/github.go` around lines 338 - 368, Update get and postForm to create requests with http.NewRequestWithContext using an appropriate context, and handle errors returned by resp.Body.Close instead of discarding them. Preserve the existing request behavior and function signatures while satisfying the errcheck/noctx findings.Source: Linters/SAST tools
internal/account/account_test.go (1)
64-95: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider testing partial-result merges, not just identical duplicates.
Both
mergeGitHubcalls here use the same fully-populatedresult, so the test doesn't cover the nil-safe merge behavior inaccount.go'smergeGitHub(e.g., a second session withModelTraining == nilshould preserve the first session's value instead of clobbering it). A second scenario with a partially-populatedResultwould give more confidence in that logic.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/account/account_test.go` around lines 64 - 95, Extend TestGitHubBrowserSessionsMergeByLogin with a second mergeGitHub call using a partially populated Result, including ModelTraining set to nil, while retaining the same login. Assert the merged account still preserves the first result’s non-nil settings and existing metadata, while continuing to merge the session source as expected.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@main.go`:
- Around line 442-455: Update the GitHub session loop around CheckWith and the
cookie-read error branch so unreadable cookies and checks with a populated
Reason are marked outcome.indeterminate before continuing. Preserve continuing
to OffWith for usable sessions, including checks reporting OK with partial-read
details, so finishOff cannot report clean after an incomplete GitHub check.
---
Nitpick comments:
In `@internal/account/account_test.go`:
- Around line 64-95: Extend TestGitHubBrowserSessionsMergeByLogin with a second
mergeGitHub call using a partially populated Result, including ModelTraining set
to nil, while retaining the same login. Assert the merged account still
preserves the first result’s non-nil settings and existing metadata, while
continuing to merge the session source as expected.
In `@internal/github/github.go`:
- Around line 338-368: Update get and postForm to create requests with
http.NewRequestWithContext using an appropriate context, and handle errors
returned by resp.Body.Close instead of discarding them. Preserve the existing
request behavior and function signatures while satisfying the errcheck/noctx
findings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 80244acd-222c-478d-86d2-61cdc4c5a937
📒 Files selected for processing (8)
README.mdinternal/account/account.gointernal/account/account_test.gointernal/cookies/cookies.gointernal/github/github.gointernal/github/github_test.gomain.gomain_test.go
1 participant
User description
Closes #8
Changes
nosnitch github training [--yes]opt-out and include it innosnitch offwithout changing repository or partner-agent access.Testing
go test ./...go vet ./...go build ./...NO_COLOR=1 go run . checkNO_COLOR=1 go run . check --jsonnosnitch github trainingdefaults to cancellation on empty input.Notes
CodeAnt-AI Description
Add GitHub Copilot privacy checks and controls
What Changed
checkandstatusnow report GitHub Copilot license, model-training preference, cloud-agent repository scope, and Claude/Codex partner-agent access.nosnitch github training [--yes]to disable Copilot model training after confirmation and verify the change.nosnitch offnow disables GitHub Copilot model training without changing cloud-agent repository access or partner-agent settings.Impact
✅ GitHub Copilot training exposure is visible✅ Incomplete GitHub checks are clearly reported✅ Safer Copilot opt-out with post-change verification💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
nosnitch github trainingwith optional confirmation bypass to disable Copilot model training.nosnitch offto include GitHub Copilot model-training settings.