.env.example

# Multi-Provider Code Review - Environment Configuration
#
# ⚠️  IMPORTANT: This is a TEMPLATE file that should be committed to version control ⚠️
#
# This file contains:
# - PLACEHOLDERS (YOUR_*_HERE) that MUST be replaced with your actual credentials
# - SAFE DEFAULTS (numbers, booleans, empty strings) that can be used as-is or customized
#
# SETUP INSTRUCTIONS:
# 1. Copy this file to .env: cp .env.example .env
# 2. Replace all YOUR_*_HERE placeholders with your actual values
# 3. Customize safe defaults as needed (PORT, timeouts, etc.)
# 4. NEVER commit the .env file (it's in .gitignore)
#
# SECURITY:
# - NEVER commit real API keys, tokens, or secrets to version control
# - Use GitHub Secrets for CI/CD workflows
# - Use environment variables or secrets management for self-hosted deployments
# - Rotate keys regularly and revoke compromised keys immediately

# ============================================================================
# GitHub Configuration (Required)
# ============================================================================

# GitHub personal access token or GitHub Actions token
# Scopes required: repo, pull_requests
# Get yours at: https://github.com/settings/tokens
# WARNING: Never commit real tokens! Use GitHub Secrets in CI/CD.
GITHUB_TOKEN=YOUR_GITHUB_TOKEN_HERE

# GitHub repository in format: owner/repo
# Example: GITHUB_REPOSITORY=keithah/multi-provider-code-review
GITHUB_REPOSITORY=

# Pull request number to review
# Example: PR_NUMBER=123
PR_NUMBER=

# ============================================================================
# Provider Configuration
# ============================================================================

# Comma-separated list of review providers to use
# Supports: openai, anthropic, openrouter, cohere, mistral, groq
# OpenRouter providers: openrouter/provider/model:variant
# Examples:
#   REVIEW_PROVIDERS=openai/gpt-4,anthropic/claude-3-5-sonnet
#   REVIEW_PROVIDERS=openrouter/free  # Recommended: Auto-routes to best available free model
REVIEW_PROVIDERS=

# Fallback providers if primary providers fail
# Example: FALLBACK_PROVIDERS=openrouter/free
FALLBACK_PROVIDERS=

# Model to use for synthesis (combining results)
# Default: openai/gpt-4o-mini
SYNTHESIS_MODEL=openai/gpt-4o-mini

# ============================================================================
# API Keys (Add only the providers you're using)
# ⚠️  CRITICAL: Never commit real API keys to git!
# ⚠️  Use GitHub Secrets for CI/CD, environment variables for production
# ============================================================================

# OpenAI API Key (https://platform.openai.com/api-keys)
# Format: sk-proj-... or sk-...
OPENAI_API_KEY=YOUR_OPENAI_API_KEY_HERE

# Anthropic API Key (https://console.anthropic.com/)
# Format: sk-ant-...
ANTHROPIC_API_KEY=YOUR_ANTHROPIC_API_KEY_HERE

# OpenRouter API Key (https://openrouter.ai/keys)
# Format: sk-or-v1-...
OPENROUTER_API_KEY=YOUR_OPENROUTER_API_KEY_HERE

# Cohere API Key (https://dashboard.cohere.com/)
COHERE_API_KEY=YOUR_COHERE_API_KEY_HERE

# Mistral API Key (https://console.mistral.ai/)
MISTRAL_API_KEY=YOUR_MISTRAL_API_KEY_HERE

# Groq API Key (https://console.groq.com/)
# Format: gsk_...
GROQ_API_KEY=YOUR_GROQ_API_KEY_HERE

# ============================================================================
# Feature Flags (Phase 1-3)
# ============================================================================

# Enable AST (Abstract Syntax Tree) analysis for deeper code understanding
ENABLE_AST_ANALYSIS=true

# Enable security vulnerability scanning
ENABLE_SECURITY=true

# Enable caching of review results
ENABLE_CACHING=true

# Enable incremental reviews (only review changed code)
INCREMENTAL_ENABLED=true

# Enable feedback learning system (Phase 2)
LEARNING_ENABLED=true

# Enable code graph builder for context analysis (Phase 2)
GRAPH_ENABLED=true

# Generate fix prompts for findings (Phase 2)
GENERATE_FIX_PROMPTS=false

# Enable analytics collection (Phase 3)
ANALYTICS_ENABLED=true

# Enable plugin system (Phase 3)
PLUGINS_ENABLED=false

# ============================================================================
# Quiet Mode (Phase 2 - Feedback Learning)
# ============================================================================

# Enable quiet mode to suppress low-confidence findings
QUIET_MODE_ENABLED=false

# Minimum confidence threshold for quiet mode (0.0-1.0)
QUIET_MIN_CONFIDENCE=0.5

# Use learning data to adjust quiet mode thresholds
QUIET_USE_LEARNING=true

# ============================================================================
# Feedback Learning Configuration (Phase 2)
# ============================================================================

# Minimum number of feedback samples required to adjust confidence
LEARNING_MIN_FEEDBACK_COUNT=5

# Number of days to look back for feedback data
LEARNING_LOOKBACK_DAYS=90

# ============================================================================
# Code Graph Configuration (Phase 2)
# ============================================================================

# Maximum depth for code graph traversal
GRAPH_MAX_DEPTH=5

# Timeout for graph building (seconds)
GRAPH_TIMEOUT_SECONDS=10

# ============================================================================
# Auto-Fix Configuration (Phase 2)
# ============================================================================

# Format for fix prompts: plain, vscode, cursor, github-copilot
FIX_PROMPT_FORMAT=plain

# ============================================================================
# Analytics Configuration (Phase 3)
# ============================================================================

# Maximum number of review records to store (prevents unbounded growth)
ANALYTICS_MAX_REVIEWS=1000

# ============================================================================
# Plugin System Configuration (Phase 3)
# ⚠️  EXTREME SECURITY WARNING ⚠️
# Plugins execute arbitrary code with FULL system access and NO sandboxing!
# Only use in trusted, private, self-hosted environments you fully control.
# NEVER enable plugins in public GitHub Actions or untrusted environments.
# ============================================================================

# Security acknowledgment (REQUIRED to enable plugins)
# Set to 'true' ONLY if you:
# - Understand plugins have unrestricted system access
# - Have reviewed all plugin source code
# - Are in a private, controlled environment
# - Accept full responsibility for security risks
PLUGIN_SECURITY_ACKNOWLEDGED=false

# Directory containing custom provider plugins
# Each plugin directory should contain:
# - index.js (required): Plugin entry point
# - plugin-manifest.json (optional): Integrity verification
#   Format: {"sha256": "checksum_of_index.js", "created": "timestamp"}
#   Generate with: shasum -a 256 index.js
PLUGIN_DIR=./plugins

# Comma-separated list of allowed plugin names (empty = allow all)
PLUGIN_ALLOWLIST=

# Comma-separated list of blocked plugin names
PLUGIN_BLOCKLIST=

# ============================================================================
# Webhook Server Configuration (Phase 3 - Self-Hosted Only)
# ============================================================================

# Webhook secret for GitHub webhook verification
# Generate with: openssl rand -hex 32
# MUST be at least 32 characters for security
# ⚠️  WARNING: Never use a weak or guessable secret!
# ⚠️  The placeholder below is INVALID and will be rejected - replace with generated secret
# DO NOT use placeholder values in production - validation will fail
WEBHOOK_SECRET=INVALID_PLACEHOLDER_MUST_GENERATE

# Port for webhook server (default: 3000)
PORT=3000

# Auto-review when PR is opened
WEBHOOK_AUTO_REVIEW_ON_OPEN=true

# Auto-review when PR is synchronized (new commits pushed)
WEBHOOK_AUTO_REVIEW_ON_SYNC=true

# Auto-review when PR is reopened
WEBHOOK_AUTO_REVIEW_ON_REOPEN=true

# Maximum reviews per minute (rate limiting)
WEBHOOK_RATE_LIMIT_PER_MINUTE=10

# Maximum reviews per PR per hour (rate limiting)
WEBHOOK_RATE_LIMIT_PER_PR=5

# ============================================================================
# Provider Configuration
# ============================================================================

# Provider allowlist (comma-separated, empty = allow all)
PROVIDER_ALLOWLIST=

# Provider blocklist (comma-separated)
PROVIDER_BLOCKLIST=

# Maximum number of providers to use per review
PROVIDER_LIMIT=5

# Number of retries for failed provider calls
PROVIDER_RETRIES=3

# Maximum parallel provider executions
PROVIDER_MAX_PARALLEL=3

# ============================================================================
# Budget & Cost Controls
# ============================================================================

# Maximum budget in USD for reviews
BUDGET_MAX_USD=1.0

# Cost per 1K input tokens (USD) - for custom providers
COST_INPUT_PER_1K=0.0

# Cost per 1K output tokens (USD) - for custom providers
COST_OUTPUT_PER_1K=0.0

# ============================================================================
# Comment Posting Configuration
# ============================================================================

# Maximum number of inline comments to post
INLINE_MAX_COMMENTS=20

# Minimum severity for inline comments (info, minor, major, critical)
INLINE_MIN_SEVERITY=minor

# Minimum number of agreeing providers for inline comments (integer count)
# Default: 2 providers must agree before posting an inline comment
# Set to 1 to post all findings, higher values for stricter consensus
# See src/analysis/consensus.ts for implementation details
INLINE_MIN_AGREEMENT=2

# ============================================================================
# Review Behavior
# ============================================================================

# Labels that trigger skipping review (comma-separated)
SKIP_LABELS=wip,do-not-review,draft

# Skip draft PRs
SKIP_DRAFTS=true

# Minimum files changed to trigger review
MIN_FILES=1

# Maximum files to review (prevents massive PRs)
MAX_FILES=100

# File patterns to include (glob patterns, comma-separated)
INCLUDE_PATTERNS=**/*.ts,**/*.tsx,**/*.js,**/*.jsx,**/*.py

# File patterns to exclude (glob patterns, comma-separated)
EXCLUDE_PATTERNS=**/*.test.ts,**/*.spec.ts,dist/**,node_modules/**

# ============================================================================
# Logging & Debugging
# ============================================================================

# Log level: debug, info, warn, error
LOG_LEVEL=info

# Enable verbose output
VERBOSE=false

# Node environment: development, production
NODE_ENV=production

# ============================================================================
# ROI Calculation (Analytics)
# ============================================================================

# Assumed developer hourly rate for ROI calculation (USD)
ANALYTICS_DEVELOPER_RATE=100

# Assumed manual review time per PR (minutes)
ANALYTICS_MANUAL_REVIEW_TIME=30

# ============================================================================
# Advanced Configuration
# ============================================================================

# Enable reliability tracking for providers (Phase 2)
RELIABILITY_TRACKING_ENABLED=true

# Minimum reliability score to keep using a provider (0.0-1.0)
RELIABILITY_MIN_SCORE=0.5

# Window size for reliability tracking (number of attempts)
RELIABILITY_WINDOW_SIZE=20

# ============================================================================
# Output Configuration
# ============================================================================

# Directory for output reports
REPORTS_DIR=./reports

# Enable SARIF output
ENABLE_SARIF=true

# Enable JSON output
ENABLE_JSON=true

# Enable Mermaid diagram generation
ENABLE_MERMAID=true

# ============================================================================
# Cache Configuration
# ============================================================================

# Cache directory
CACHE_DIR=./.cache

# Cache TTL in seconds (default: 7 days)
CACHE_TTL=604800

# ============================================================================
# Notes
# ============================================================================
#
# 1. For GitHub Actions, use repository secrets instead of .env file
# 2. For self-hosted deployment, ensure WEBHOOK_SECRET is at least 32 characters
# 3. Plugin system should only be used in trusted, private environments
# 4. Free OpenRouter models are great for getting started at zero cost
# 5. Enable incremental reviews to save 80%+ on costs for large PRs
# 6. Use quiet mode after collecting feedback to reduce noise
#
# Documentation:
# - Self-hosted: docs/self-hosted.md
# - Analytics: docs/analytics.md
# - Plugins: docs/plugins.md