Skip to content

Commit fc91f94

Browse files
FuzzysToddFuzzysTodd
authored
Merge pull request #17 from FuzzysTodd/copilot/analyze-code-for-vulnerabilities
[WIP] Analyze provided code for vulnerabilities and best practices
2 parents b936762 + 9cf274c commit fc91f94

6 files changed

Lines changed: 313 additions & 1 deletion

File tree

‎.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,3 +51,11 @@ yarn-error.log
5151

5252
/.tmp
5353
tools/k6/.env
54+
55+
# API Keys and Secrets
56+
.env
57+
.env.local
58+
*.key
59+
.api-key
60+
api-key.txt
61+

‎package.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@
1414
"lint:fix": "yarn lint --fix",
1515
"format": "prettier --check .",
1616
"format:fix": "prettier --write .",
17-
"prepare:manually": "husky install"
17+
"prepare:manually": "husky install",
18+
"analyze:gemini": "node scripts/analysis/gemini-agent.js"
1819
},
1920
"lint-staged": {
2021
"*.{ts,tsx,scss}": "yarn format:fix"
@@ -69,6 +70,7 @@
6970
"husky": "^8.0.3",
7071
"lint-staged": "^15.0.2",
7172
"mini-css-extract-plugin": "^2.7.5",
73+
"node-fetch": "^2.7.0",
7274
"optimize-css-assets-webpack-plugin": "^6.0.1",
7375
"prettier": "2.8.8",
7476
"react-svg-loader": "^3.0.3",

‎scripts/analysis/.env.example‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Gemini Agent Configuration
2+
# Copy this file to .env and fill in your actual values
3+
4+
# Gemini API Key
5+
# Obtain from: https://aistudio.google.com/
6+
GEMINI_API_KEY=your_gemini_api_key_here

‎scripts/analysis/README.md‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# Gemini Agent - Code Analysis Tool
2+
3+
## Overview
4+
5+
The Gemini Agent is a Node.js-based code analysis tool that uses Google's Gemini AI to analyze code for vulnerabilities, deviations from best practices, and mathematical instability. It's particularly designed for protocol engineering, ZK-Circuits, and DAO stability analysis.
6+
7+
## Features
8+
9+
- **Protocol Stability Score**: Assigns a 1-10 score for code stability
10+
- **Vulnerability Detection**: Identifies potential security flaws
11+
- **Code Repair Suggestions**: Provides repaired code blocks when issues are found
12+
- **Best Practices Analysis**: Checks for deviations from industry standards
13+
14+
## Prerequisites
15+
16+
1. Node.js installed (version 18 or higher for native fetch support)
17+
2. Google Gemini API Key (obtain from [Google AI Studio](https://aistudio.google.com/))
18+
3. Dependencies installed (run `yarn install` or `npm install`)
19+
20+
## Installation
21+
22+
```bash
23+
# Install dependencies
24+
yarn install
25+
26+
# Or using npm
27+
npm install
28+
```
29+
30+
## Usage
31+
32+
### Command Line
33+
34+
```bash
35+
node scripts/analysis/gemini-agent.js <filepath> --api-key=<your_api_key>
36+
```
37+
38+
### Using npm/yarn script
39+
40+
```bash
41+
yarn analyze:gemini <filepath> --api-key=<your_api_key>
42+
43+
# Or
44+
npm run analyze:gemini <filepath> --api-key=<your_api_key>
45+
```
46+
47+
### Example
48+
49+
```bash
50+
# Analyze a JavaScript file
51+
node scripts/analysis/gemini-agent.js ./src/example.js --api-key=YOUR_GEMINI_API_KEY
52+
53+
# Analyze a Go file
54+
node scripts/analysis/gemini-agent.js ./pkg/example.go --api-key=YOUR_GEMINI_API_KEY
55+
```
56+
57+
## Environment Variables
58+
59+
For security, it's recommended to use environment variables instead of passing the API key directly:
60+
61+
```bash
62+
export GEMINI_API_KEY=your_api_key_here
63+
node scripts/analysis/gemini-agent.js <filepath> --api-key=$GEMINI_API_KEY
64+
```
65+
66+
## GitHub Actions Integration
67+
68+
To integrate with GitHub Actions, add the following to your workflow:
69+
70+
```yaml
71+
- name: Analyze Code with Gemini Agent
72+
env:
73+
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
74+
run: |
75+
node scripts/analysis/gemini-agent.js ${{ matrix.file }} --api-key=$GEMINI_API_KEY
76+
```
77+
78+
Make sure to add `GEMINI_API_KEY` to your GitHub repository secrets.
79+
80+
## Output
81+
82+
The tool provides:
83+
84+
1. **Protocol Stability Score**: A numerical rating (1-10)
85+
2. **Potential Flaws Summary**: Brief description of issues found
86+
3. **Repair Status**: Either:
87+
- `REPAIRED CODE BLOCK`: Contains the fixed code
88+
- `NO REPAIR NEEDED`: Code is in good condition
89+
90+
## Error Handling
91+
92+
The script handles common errors:
93+
- Missing API key
94+
- Invalid file paths
95+
- API connection issues
96+
- Malformed API responses
97+
98+
## Security Notes
99+
100+
⚠️ **Important Security Considerations:**
101+
102+
1. Never commit API keys to version control
103+
2. Use environment variables or GitHub Secrets for API keys
104+
3. Add API keys to `.gitignore` if storing them in config files
105+
4. Rotate API keys regularly
106+
5. Use least-privilege API key permissions
107+
108+
## Limitations
109+
110+
- Requires active internet connection
111+
- Depends on Gemini API availability
112+
- API rate limits may apply (check Google's documentation)
113+
- Analysis quality depends on code context and complexity
114+
115+
## Troubleshooting
116+
117+
### "GEMINI_API_KEY is missing"
118+
- Ensure you're passing the `--api-key` parameter
119+
- Check that the API key is correctly formatted
120+
121+
### "HTTP error! status: 403"
122+
- Verify your API key is valid
123+
- Check API key permissions
124+
- Ensure billing is enabled in Google Cloud Console
125+
126+
### "Error reading file"
127+
- Verify the file path is correct
128+
- Ensure the file exists and is readable
129+
- Use absolute paths if relative paths fail
130+
131+
## Contributing
132+
133+
To improve the Gemini Agent:
134+
135+
1. Follow the existing code style
136+
2. Test changes with multiple file types
137+
3. Update documentation for new features
138+
4. Consider adding unit tests
139+
140+
## License
141+
142+
This tool is part of the Grafana Pyroscope project and follows the same AGPL-3.0-only license.
143+
144+
## Support
145+
146+
For issues or questions:
147+
- Open an issue in the repository
148+
- Check existing documentation
149+
- Review Google Gemini API documentation

‎scripts/analysis/gemini-agent.js‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
// --- Gemini Agent Script (Node.js) ---
2+
3+
const fs = require('fs');
4+
const path = require('path');
5+
6+
// NOTE: In a real Node.js environment, you would use an external library like
7+
// 'node-fetch' for making HTTP requests, and potentially 'dotenv' for keys.
8+
// For this example, we assume basic fetch is available or polyfilled.
9+
10+
const GEMINI_MODEL = 'gemini-2.5-flash-preview-09-2025';
11+
12+
// Use a simple prompt designed for code repair/analysis
13+
const AGENT_SYSTEM_PROMPT = `Act as an elite protocol engineer specializing in ZK-Circuits and DAO stability. Analyze the provided code block for vulnerabilities, deviations from best practices, and mathematical instability.
14+
1. Assign a **Protocol Stability Score (1-10)**.
15+
2. Provide a brief summary of **Potential Flaws**.
16+
3. If flaws exist, provide the **REPAIRED CODE BLOCK** only. Do not provide any conversational text before the repaired code. If the code is perfect, output 'NO REPAIR NEEDED'.`;
17+
18+
/**
19+
* Executes the Gemini API call to analyze the given code snippet.
20+
* @param {string} codeContent - The content of the file to analyze.
21+
* @param {string} filePath - The name of the file being analyzed.
22+
* @param {string} apiKey - The Gemini API key.
23+
*/
24+
async function runAnalysis(codeContent, filePath, apiKey) {
25+
if (!apiKey) {
26+
console.error("Error: GEMINI_API_KEY is missing. Check GitHub Secrets configuration.");
27+
return;
28+
}
29+
30+
const apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_MODEL}:generateContent?key=${apiKey}`;
31+
32+
// The user query includes the file content to be analyzed
33+
const userQuery = `Analyze the protocol code for ${filePath}:\n\n\`\`\`\n${codeContent}\n\`\`\``;
34+
35+
const payload = {
36+
contents: [{ parts: [{ text: userQuery }] }],
37+
systemInstruction: { parts: [{ text: AGENT_SYSTEM_PROMPT }] },
38+
// For code analysis, grounding is usually not necessary unless you need real-time data
39+
// tools: [{ "google_search": {} }],
40+
};
41+
42+
let response;
43+
try {
44+
// Simple fetch example (replace with node-fetch in a real project)
45+
response = await fetch(apiUrl, {
46+
method: 'POST',
47+
headers: { 'Content-Type': 'application/json' },
48+
body: JSON.stringify(payload)
49+
});
50+
51+
if (!response.ok) {
52+
throw new Error(`HTTP error! status: ${response.status}`);
53+
}
54+
55+
const result = await response.json();
56+
const analysisText = result.candidates?.[0]?.content?.parts?.[0]?.text || "Agent failed to generate response.";
57+
58+
console.log(`\n### Protocol Analysis for ${filePath} ###`);
59+
console.log(analysisText);
60+
61+
// --- DEEP THINK REPAIR LOGIC ---
62+
// A real agent would look for the 'REPAIRED CODE BLOCK' and attempt to
63+
// write it back to the file system or comment on the PR using the GitHub Token.
64+
const analysisComplete = analysisText.includes('REPAIRED CODE BLOCK') || analysisText.includes('NO REPAIR NEEDED');
65+
if (analysisComplete) {
66+
console.log("Analysis Complete. Check output for repair instructions.");
67+
}
68+
69+
} catch (error) {
70+
console.error(`\n--- FAILED ANALYSIS for ${filePath} ---`);
71+
console.error(`Gemini Agent Error: ${error.message}`);
72+
}
73+
}
74+
75+
/**
76+
* Main execution function to handle command-line arguments.
77+
*/
78+
async function main() {
79+
const filePath = process.argv[2];
80+
const apiKeyArg = process.argv.find(arg => arg.startsWith('--api-key='));
81+
82+
if (!filePath || !apiKeyArg) {
83+
console.error("Usage: node gemini-agent.js <filepath> --api-key=<your_key>");
84+
return;
85+
}
86+
87+
const apiKey = apiKeyArg.split('=')[1];
88+
89+
try {
90+
const codeContent = fs.readFileSync(path.resolve(filePath), 'utf8');
91+
await runAnalysis(codeContent, filePath, apiKey);
92+
} catch (error) {
93+
console.error(`Error reading file ${filePath}: ${error.message}`);
94+
}
95+
}
96+
97+
// Ensure fetch is available in Node.js environment
98+
// Node.js 18+ has built-in fetch, older versions need node-fetch
99+
if (typeof fetch === 'undefined') {
100+
try {
101+
global.fetch = require('node-fetch');
102+
} catch (error) {
103+
console.error('Error: fetch is not available. Please upgrade to Node.js 18+ or install node-fetch: npm install node-fetch');
104+
process.exit(1);
105+
}
106+
}
107+
108+
main();

‎scripts/analysis/workflow-example.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Example GitHub Actions Workflow for Gemini Code Analysis
2+
# This is an example workflow that demonstrates how to integrate the Gemini Agent
3+
# into your CI/CD pipeline.
4+
5+
name: Gemini Code Analysis (Example)
6+
7+
on:
8+
pull_request:
9+
branches:
10+
- main
11+
workflow_dispatch:
12+
inputs:
13+
file_path:
14+
description: 'Path to the file to analyze'
15+
required: true
16+
type: string
17+
18+
jobs:
19+
analyze:
20+
runs-on: ubuntu-latest
21+
22+
steps:
23+
- name: Checkout code
24+
uses: actions/checkout@v4
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@v4
28+
with:
29+
node-version: '18'
30+
31+
- name: Install dependencies
32+
run: npm install
33+
34+
- name: Run Gemini Analysis
35+
env:
36+
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
37+
run: |
38+
# Example: Analyze a specific file
39+
node scripts/analysis/gemini-agent.js ${{ github.event.inputs.file_path || 'README.md' }} --api-key=$GEMINI_API_KEY

0 commit comments

Comments
 (0)