Shift-Left Code Review: Pre-PR Tools That Catch What Humans Miss

// TypeScript 4.9+ - Make consumers handle both formats first
import { validatePaymentMetadata, processPayment as processPaymentCore } from './payment-core';

// Step 1: Update consumer interface - make new field optional
interface PaymentRequest {
  amount: number;
  currency: string;
  metadata?: PaymentMetadata; // Optional during migration
}

interface PaymentMetadata {
  transactionId: string;
  merchantId: string;
  riskScore?: number;
}

// Step 2: Handle both old and new formats
function processPayment(request: PaymentRequest) {
  // Default to legacy extraction if metadata missing
  const metadata = request.metadata ?? extractLegacyMetadata(request);
  const validatedMetadata = validatePaymentMetadata(metadata);
  return processPaymentCore(validatedMetadata, request.amount, request.currency);
}

function extractLegacyMetadata(request: PaymentRequest): PaymentMetadata {
  return {
    transactionId: generateTransactionId(),
    merchantId: extractMerchantFromRequest(request),
    riskScore: calculateLegacyRiskScore(request.amount)
  };
}

// Common failure mode: Teams skip "verify all consumers deployed" step
// Fix: Use feature flags to validate each consumer before producer changes

# Git 2.40+ - Pre-commit hook integration
#!/bin/bash

# Step 1: Configure Pre-Commit Code Review Integration
cat > .pre-commit-config.yaml << EOF
repos:
  - repo: local
    hooks:
      - id: semantic-code-analysis
        name: Semantic Code Analysis
        entry: ./scripts/pre-commit-analysis.sh
        language: system
        files: \.(ts|js|py|go)$
        stages: [commit]
EOF

# Create pre-commit analysis script
cat > ./scripts/pre-commit-analysis.sh << 'EOF'
#!/bin/bash
set -e

# Get staged files for analysis
STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|js|py|go)$' || true)

if [ -z "$STAGED_FILES" ]; then exit 0; fi

echo "Running semantic analysis on staged files..."
for file in $STAGED_FILES; do
  echo "Analyzing: $file"
  
  # Run semantic analysis with architectural context
  if ! npx semantic-analyzer --file="$file" --context=architectural; then
    echo "❌ Semantic analysis failed for $file"
    exit 1
  fi
done

echo "✅ All files passed semantic analysis"
EOF

chmod +x ./scripts/pre-commit-analysis.sh

# Step 2: Enable architectural dependency checking
augment-review configure --scan-depth=architectural --cross-service=enabled --security-checks=true --compliance-rules=./compliance-config.json

# Common failure mode: Scanning only changed files misses dependencies
# Fix: Expand context analysis for comprehensive codebase understanding

# Python 3.11+ - Organization compliance rules
import re
import json
import hashlib
from typing import Dict, List, Optional
from dataclasses import dataclass

@dataclass
class ComplianceViolation:
    rule: str
    file_path: str
    line_number: int
    severity: str
    message: str

# Step 1: Define security policy scanning
compliance_rules = {
    'secrets_detection': {
        'enabled': True,
        'patterns': [
            r'(?i)(password|pwd|secret|key|token)\s*[=:]\s*["\'][^"\']{8,}["\']',
            r'(?i)api[_-]?key\s*[=:]\s*["\'][^"\']{20,}["\']'
        ]
    },
    'dependency_vulnerabilities': {
        'enabled': True,
        'min_severity': 'CVE-2024+'
    },
    'data_classification': {
        'enabled': True,
        'patterns': ['PII', 'PHI', 'PCI']
    },
    'encryption_requirements': {
        'algorithm': 'AES-256-GCM',
        'key_rotation': True
    }
}

def scan_for_secrets(file_path: str, content: str) -> List[ComplianceViolation]:
    violations = []
    patterns = compliance_rules['secrets_detection']['patterns']
    for line_num, line in enumerate(content.split('\n'), 1):
        for pattern in patterns:
            if re.search(pattern, line):
                violations.append(ComplianceViolation(
                    rule='secrets_detection',
                    file_path=file_path,
                    line_number=line_num,
                    severity='critical',
                    message=f'Potential secret detected: {line[:50]}...'
                ))
    return violations

# Step 2: Integrate with development workflow
def pre_commit_compliance_check(staged_files: List[str]) -> bool:
    all_violations = []
    for rule, config in compliance_rules.items():
        if isinstance(config, dict) and config.get('enabled'):
            violations = scan_files(staged_files, rule, config)
            all_violations.extend(violations)
    
    if all_violations:
        print(f"Compliance violations found: {len(all_violations)}")
        for violation in all_violations[:10]:  # Show first 10
            print(f"  {violation.severity.upper()}: {violation.file_path}:{violation.line_number} - {violation.message}")
        return False
    print("✅ All compliance checks passed")
    return True

# Common implementation challenge: Adoption resistance and cultural barriers
# Fix: Build confidence through quick test suites and visible wins

# Python 3.11+ - Real-time security analysis
import ast
import re
from typing import Dict, List, Tuple, Optional
from dataclasses import dataclass
from enum import Enum

class Severity(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class SecurityFinding:
    vulnerability_type: str
    severity: Severity
    file_path: str
    line_number: int
    description: str
    recommendation: str

# Step 1: Configure vulnerability detection
security_monitors = {
    'sql_injection': {
        'severity': Severity.CRITICAL,
        'patterns': [
            r'SELECT\s+.*\+.*',  # String concatenation in SQL
            r'execute\s*\(\s*["\'].*\+.*["\']',  # Dynamic SQL execution
        ],
        'safe_patterns': [
            r'prepare\(',  # Prepared statements
            r'parameterized',
        ]
    },
    'race_conditions': {
        'severity': Severity.HIGH,
        'context': 'concurrent_access',
        'patterns': [
            r'global\s+\w+',  # Global variables
            r'threading\.Thread',  # Threading usage
        ]
    },
    'auth_bypass': {
        'severity': Severity.CRITICAL,
        'scope': 'session_management',
        'patterns': [
            r'if\s+.*==\s*["\']admin["\']',  # Hardcoded admin check
            r'user\.role\s*=\s*["\']',  # Direct role assignment
        ]
    }
}

def analyze_security_context(code_fragment: str, file_path: str) -> List[SecurityFinding]:
    all_findings = []
    # Run all security checks
    all_findings.extend(detect_sql_injection(code_fragment, file_path))
    all_findings.extend(detect_race_conditions(code_fragment, file_path))
    all_findings.extend(detect_auth_bypass(code_fragment, file_path))
    
    # Filter by severity
    critical_and_high = [f for f in all_findings 
                        if f.severity in [Severity.CRITICAL, Severity.HIGH]]
    return prioritize_findings(critical_and_high)

# Common failure mode: Missing architectural context in code analysis
# Fix: Use architectural understanding for precise vulnerability detection

// Node.js 18+ - Cross-service impact analysis
const fs = require('fs').promises;
const path = require('path');
const yaml = require('js-yaml');

// Step 1: Map service dependency graph
const impact_analyzer = {
  service_dependencies: new Map(),
  shared_resources: new Set(['user_database', 'redis_cache', 'message_queue']),
  event_subscriptions: new Map(),
  api_contracts: new Map()
};

class ServiceDependency {
  constructor(serviceName, dependencyType, resourceName) {
    this.serviceName = serviceName;
    this.dependencyType = dependencyType;  // 'api', 'database', 'event', 'shared_resource'
    this.resourceName = resourceName;
    this.riskLevel = this.calculateRiskLevel();
  }

  calculateRiskLevel() {
    const highRiskResources = ['user_database', 'payment_service', 'auth_service'];
    return highRiskResources.includes(this.resourceName) ? 'high' : 'medium';
  }
}

// Step 2: Analyze change impact
function assessCrossServiceImpact(changedFiles, serviceContext) {
  const impacts = {
    direct_dependencies: [],
    indirect_effects: [],
    resource_contention: [],
    event_propagation: []
  };
  
  changedFiles.forEach(file => {
    const serviceName = extractServiceNameFromPath(file);
    const changeType = determineChangeType(file);
    
    if (impact_analyzer.service_dependencies.has(serviceName)) {
      const dependencies = impact_analyzer.service_dependencies.get(serviceName);
      dependencies.forEach(dep => {
        // Assess impact based on dependency type and change type
        evaluateImpact(dep, changeType, impacts, file);
      });
    }
  });
  
  return prioritizeByRisk(impacts);
}

// Common failure mode: Missing runtime dependencies and event flows
// Fix: Combine static analysis with runtime dependency tracking

module.exports = { buildDependencyGraph, assessCrossServiceImpact, impact_analyzer };

// TypeScript 4.9+ - Semantic analysis integration
import * as ts from 'typescript';
import { readFileSync, existsSync } from 'fs';
import { join, dirname } from 'path';

// Step 1: Configure semantic context analysis
interface SemanticAnalysisConfig {
  business_logic_patterns: string[];
  architectural_constraints: string[];
  performance_requirements: Record<string, number>;
  coding_standards: {
    max_function_complexity: number;
    max_class_methods: number;
    required_documentation: string[];
  };
}

interface SemanticViolation {
  type: 'business_logic' | 'architectural' | 'performance' | 'maintainability';
  severity: 'low' | 'medium' | 'high' | 'critical';
  message: string;
  file: string;
  line: number;
  column: number;
  suggestion: string;
}

// Step 2: Analyze code semantics during development
function analyzeSemanticIntent(
  filePath: string,
  sourceCode: string,
  config: SemanticAnalysisConfig
): SemanticViolation[] {
  const violations: SemanticViolation[] = [];
  
  // Create TypeScript program for semantic analysis
  const sourceFile = ts.createSourceFile(
    filePath,
    sourceCode,
    ts.ScriptTarget.Latest,
    true
  );
  
  // Analyze business logic patterns
  violations.push(...detectBusinessLogicViolations(sourceFile, config, filePath));
  
  // Analyze architectural consistency
  violations.push(...analyzeArchitecturalPatterns(sourceFile, config, filePath));
  
  // Assess performance implications
  violations.push(...assessPerformanceImpact(sourceFile, config, filePath));
  
  // Check maintainability metrics
  violations.push(...checkMaintainabilityIssues(sourceFile, config, filePath));
  
  return violations.sort((a, b) => {
    const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
    return severityOrder[a.severity] - severityOrder[b.severity];
  });
}

// Common failure mode: Generic rules miss organization-specific patterns
// Fix: Train analysis on organization's architectural patterns and business rules

export { analyzeSemanticIntent, defaultConfig, SemanticAnalysisConfig, SemanticViolation };