Add GitHub App manifest CLI setup by OMCHOKSI108 · Pull Request #6 · OMCHOKSI108/CodeSecurityAuditAgent

OMCHOKSI108 · 2026-06-22T09:04:32Z

Summary

Adds CLI scripts for GitHub App Manifest flow
Adds manifest generation and conversion helpers
Adds safe local env apply script
Adds GitHub App setup documentation
Adds env verification script

Verification

python -m compileall scripts
python scripts/create_github_app_manifest.py --help
python scripts/complete_github_app_manifest.py --help
python scripts/apply_github_app_env.py --help
python scripts/verify_github_app_env.py
python scripts/evaluate_reviewer.py

Notes

Does not commit secrets
Does not implement webhook processing yet
Existing GitHub Action MVP remains unchanged

Summary by CodeRabbit

New Features
- Added Flask-based website dashboard with GitHub OAuth login
- Implemented user account page displaying review usage and plan details
- Added dashboard view showing recent security reviews and statistics
- Integrated email welcome notifications for new users
- Added GitHub App setup workflow with manifest-based registration
Documentation
- Updated README with live service URLs and quickstart instructions
- Added comprehensive GitHub App setup guide
- Added website deployment and configuration documentation
Chores
- Updated .gitignore to exclude sensitive credential files
- Added Render deployment configuration
- Updated project dependencies for website support
- Added helper scripts for GitHub App credential management

- Flask marketing website + dashboard (landing, login, dashboard, reviews, usage, contact, settings, error pages) - GitHub OAuth login flow with /auth/github/start, /auth/github/callback, /logout - MongoDB-backed user storage (users collection) with in-memory fallback - Resend welcome email on first sign-in (safe opt-in, never blocks login) - Usage display: 30 PR reviews/month with progress bar and remaining count - GitHub App install CTA button (configured via GITHUB_APP_SLUG env var) - API client: fetches review history from FastAPI backend - Render deployment: render.yaml + website.Dockerfile + start script - pyproject.toml: website extra (flask, requests, gunicorn) - docs/website.md: full setup, OAuth, deployment, limitations

- create_github_app_manifest.py: generates manifest JSON + prints registration URL (supports --org for org-level apps, --callback-url, --webhook-url) - complete_github_app_manifest.py: exchanges manifest code for credentials via POST /app-manifests/{code}/conversions, saves to secrets/ - apply_github_app_env.py: safe .env updater (dry-run by default, --write to apply) - verify_github_app_env.py: checks 8 env vars are set without printing values - docs/github_app_setup.md: full setup guide with permissions, events, security - .gitignore: added secrets/, *.pem, github_app_credentials.local.json - README.md: added GitHub App Setup section with quick commands

coderabbitai · 2026-06-22T09:04:41Z

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 85947784-d9f5-4e7a-8e94-7abeca6ad23e

📥 Commits

Reviewing files that changed from the base of the PR and between 78c7c97 and 8cdc2ee.

📒 Files selected for processing (31)

.gitignore
README.md
deploy/render/website.Dockerfile
deploy/render/website_start.sh
docs/github_app_setup.md
docs/website.md
pyproject.toml
render.yaml
scripts/apply_github_app_env.py
scripts/complete_github_app_manifest.py
scripts/create_github_app_manifest.py
scripts/verify_github_app_env.py
website/__init__.py
website/api_client.py
website/app.py
website/auth.py
website/config.py
website/db.py
website/email_service.py
website/static/css/styles.css
website/static/js/app.js
website/templates/base.html
website/templates/contact.html
website/templates/dashboard.html
website/templates/error.html
website/templates/index.html
website/templates/login.html
website/templates/reviews.html
website/templates/settings.html
website/templates/usage.html
website/usage.py

📝 Walkthrough

Walkthrough

Introduces a Flask-based SaaS website (website/) with GitHub OAuth login, MongoDB-backed user persistence with in-memory fallback, PR usage tracking, Resend welcome email, and a FastAPI review API client. Adds three CLI scripts for GitHub App manifest registration and credential exchange, a Render Dockerfile/render.yaml, and full documentation.

Changes

SaaS Website and GitHub App Setup

Layer / File(s)	Summary
Project config and Config class `.gitignore`, `pyproject.toml`, `website/config.py`	Adds `website` optional-dependency extra (Flask, gunicorn, requests), ignores `secrets/` and PEM files in `.gitignore`, and introduces the `Config` class reading all app settings from environment variables.
MongoDB persistence and usage calculation `website/db.py`, `website/usage.py`	`db.py` adds lazy MongoDB init with 3s timeout, in-memory dict fallback, and `upsert_user`/`get_user`/`update_usage`. `usage.py` computes monthly remaining review counts and usage percentage from `Config.FREE_PR_REVIEWS_PER_MONTH`.
GitHub App manifest registration scripts `scripts/create_github_app_manifest.py`, `scripts/complete_github_app_manifest.py`, `scripts/apply_github_app_env.py`, `scripts/verify_github_app_env.py`	Four CLI scripts: generate manifest JSON and registration URL; exchange temp code with GitHub API to save credentials to `secrets/`; apply credential JSON fields to `.env` with dry-run/write modes; verify required env vars are present.
GitHub OAuth flow, welcome email, and API client `website/auth.py`, `website/email_service.py`, `website/api_client.py`	`auth.py` Blueprint handles `/auth/github/start`, callback (token exchange, user upsert, new-user welcome email via Resend), and logout. `api_client.py` provides `fetch_reviews`, `fetch_stats`, `fetch_review` with error-suppression.
Flask app factory and route handlers `website/app.py`	`create_app()` configures Flask from `Config`, registers `auth_bp`, injects template globals, and defines handlers for `/`, `/login`, `/dashboard`, `/reviews`, `/usage`, `/contact`, `/settings`, and 404/500 error pages.
Jinja2 templates and static assets `website/templates/*`, `website/static/css/styles.css`, `website/static/js/app.js`	Adds `base.html` (session theme, nav, flash messages), eight page templates, a complete CSS stylesheet with theme variables and component styles, and a JS flash-dismiss script.
Render deployment `deploy/render/website.Dockerfile`, `deploy/render/website_start.sh`, `render.yaml`	Dockerfile builds from Python 3.11 slim with editable `website` extra install. Startup script runs gunicorn on `0.0.0.0:PORT`. `render.yaml` provisions the `codesec-website` Docker web service with all required env vars.
README and docs updates `README.md`, `docs/website.md`, `docs/github_app_setup.md`	Adds live service URLs, SaaS website run command, and GitHub App setup walkthrough to README. New `docs/website.md` documents env vars, OAuth setup, Render deploy, MongoDB and email behavior, and limitations. New `docs/github_app_setup.md` is a full manifest-flow setup guide with permissions and security rules.

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant FlaskApp as website/app.py
  participant auth_bp as website/auth.py
  participant GitHubOAuth as GitHub OAuth API
  participant db as website/db.py
  participant email as website/email_service.py
  participant FastAPI as CodeSecAudit FastAPI

  Browser->>FlaskApp: GET /login
  FlaskApp-->>Browser: render login.html
  Browser->>auth_bp: GET /auth/github/start
  auth_bp->>GitHubOAuth: redirect (authorize URL + state)
  GitHubOAuth-->>Browser: redirect /auth/github/callback?code=
  Browser->>auth_bp: GET /auth/github/callback?code=
  auth_bp->>GitHubOAuth: POST token exchange
  GitHubOAuth-->>auth_bp: access_token
  auth_bp->>GitHubOAuth: GET /user + /user/emails
  GitHubOAuth-->>auth_bp: profile + emails
  auth_bp->>db: upsert_user(github_id, data)
  db-->>auth_bp: user record + is_new
  auth_bp->>email: send_welcome_email(user) if is_new
  email-->>auth_bp: True/False (non-blocking)
  auth_bp-->>Browser: session set, redirect /dashboard
  Browser->>FlaskApp: GET /dashboard
  FlaskApp->>FastAPI: fetch_reviews(limit=5)
  FastAPI-->>FlaskApp: reviews list (or [] on error)
  FlaskApp-->>Browser: render dashboard.html

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐇 A Flask app hops into the scene,
With OAuth logins, shiny and keen.
Mongo stores users, Resend sends mail,
GitHub App scripts never fail.
The rabbit deployed to Render with cheer —
The SaaS website is finally here! 🎉

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

github-actions · 2026-06-22T09:06:50Z

CodeSecAudit AI Review

Verdict: APPROVE

Summary

Reviewed 13 changed code file(s) and found 0 potential issue(s). Highest severity: None.

Risk Score

0/100

Issues Found

No security issues detected.

Notes

This is an AI-assisted defensive security review.
It does not replace manual review or professional SAST tools.

OMCHOKSI108 · 2026-06-22T09:43:29Z

Superseded by direct merge into main

OMCHOKSI108 added 2 commits June 22, 2026 14:22

Copilot AI review requested due to automatic review settings June 22, 2026 09:04

Copilot AI reviewed Jun 22, 2026

OMCHOKSI108 closed this Jun 22, 2026

OMCHOKSI108 deleted the feature/github-app-manifest-cli branch June 22, 2026 09:43

Navigation Menu

Add GitHub App manifest CLI setup - #6

Add GitHub App manifest CLI setup#6
OMCHOKSI108 wants to merge 2 commits into
mainfrom
feature/github-app-manifest-cli

OMCHOKSI108 commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

OMCHOKSI108 commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

OMCHOKSI108 commented Jun 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 22, 2026

CodeSecAudit AI Review

Verdict: APPROVE

Summary

Risk Score

Issues Found

Notes

Uh oh!

OMCHOKSI108 commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

OMCHOKSI108 commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading