Agent-PR Reviewer — GitHub App (apr-app)

A FastAPI service that runs the apr engine on every pull request and posts the verdict as a sticky comment.

Status

v0.0.1 alpha. Same overall shape as sts-app: HMAC-verified webhooks, GitHub App JWT auth, tempdir-based per-file review.

What it does

1. Receives pull_request webhook deliveries from GitHub.
2. Verifies the HMAC signature with APR_APP_WEBHOOK_SECRET.
3. Calls the GitHub API to:
   • Fetch the PR's title + body + head SHA (GET /pulls/{n})
   • List the PR's changed files (GET /pulls/{n}/files)
   • Download each known-extension changed file's contents (GET /contents/{path}?ref=SHA) into a temp directory
4. Runs apr.engine.review() against the temp directory with the PR title + description.
5. Formats the ReviewReport as Markdown and either creates a sticky comment on the PR or updates the existing one (identified by an HTML marker).
6. Cleans up the temp directory.

Configuration

All settings are read from environment variables prefixed APR_APP_. A .env file in the working directory is also loaded automatically.

Running locally

uv sync --all-packages --all-groups
export APR_APP_WEBHOOK_SECRET="something-long-and-random"
export APR_APP_GITHUB_TOKEN="ghp_..."
apr-app
# or
python -m apr_app

# Smoke check
curl http://127.0.0.1:8000/health
curl http://127.0.0.1:8000/version

Endpoints

Sticky comment format

The bot's comment includes:

• A hidden HTML marker so subsequent runs find and update it
• An emoji headline summarizing the worst severity (🛑 critical / ❌ error / ⚠️ warning / ℹ️ info / ✅ clean)
• Counts by severity
• A table of up to 30 findings with severity, file:line, rule_id, and message
• Footer with apr engine version + schema version + changed-file count

Apache-2.0 license. See CHANGELOG.