Voting on code review is pretty cool Can we also ...
# proj-extensions
q
Voting on code review is pretty cool Can we also add the same voting option to individual inline comments in addition to the main review comment?
➕ 1
e.g here i'm assuming better signal when voting on individual aspects of the review?
➕ 2
w
Shouts out to @red-crayon-20970 for this! Voting on inline suggestions would definitely be a more precise signal. We're working on calibrating the suggestions atm, voting will be a good next step.
🙌 2
r
Thanks for the feedback @quick-window-91705! Voting on inline suggestions is definitely something that we are interested in!
c
I haven’t seen how is this implemented, sorry: out of curiosity, is it possible to send a request referencing some other random comment, not the reviewer agent comment, and it will be received and processed?
w
Our data pipeline is basically scraping all the comments from the review. You can leave thumbs-{up, down} on any of those and we'll be able to find it. (Inline suggestions will really just be a little footer in the comment that has the same "give us feedback" text)
c
Aha, thank you. Does it scrape other comments, left by a random passerby?
I ask because the comments from the review should be ok and safe. But these are public repos where anyone can post a comment, inline comment, reply to a bot comment, etc
w
It does. We're using the GH API to grab any comments on the PR, so we can tune the review bot to match human suggestions as much as possible. We've got some data-cleaning going on to ensure we only pick up the "useful" suggestions for this analysis though.
c
I'd love to see what credentials we use (gh token, llm token, something else?) for an agent that gets the random comments in context. I mean, I’d like to know the credentials names, because this sounds prone to prompt injection, and it would be good to know what the blast radius is, exactly
w
It's not a pure agentic workflow. We're scraping comments using the Github API, using some LLM-as-judge analysis to extract suggestions and analyze the code, then more manual analysis to process those suggestions. I think the worst a prompt injection attack could do right now is mess with our analysis, but since the end result is just a PR updating a skill we're still manually reviewing any generated changes.
👍 1
thanks on a stick 1
c
Perfect, thank you!
My agent decided to do it 😅