Agent-PR Reviewer (apr)
Deterministic + AI-pattern review for pull requests. Wave 2 lead bet of the DevTrust connected platform.
Status
v0.2.0 beta — deterministic Python + JS/TS rules, deterministic AI-pattern checker (ai-review:hallucinated-symbol) now multi-language via Repo X-ray v0.4 call edges, plus optional LLM-backed ai-review:diff-comprehension (Anthropic).
Why
Three of your existing GitHub Apps — ai-quality-gate, pr-coach, commit-craft — each solve part of "make PR review better" but ship as separate apps with separate auth, separate webhooks, separate UIs. apr consolidates them into one engine so:
- One install. One webhook. One sticky comment per PR.
- Deterministic rules first (testable, gradeable, cheap), LLM layer second.
- Reuses Repo X-ray's architecture model for file context.
Rules shipped through v0.0.2
Python (.py)
| Rule ID | Severity | Category | What it catches |
|---|---|---|---|
bare-except |
warning | quality | except: without an exception class |
print-debug |
info | quality | leftover print(...) calls (skipped in __main__ guard files) |
todo-no-ticket |
info | todo | TODO/FIXME/XXX/HACK without #123 / PROJ-123 reference |
empty-function-body |
info | ai-pattern | function body is only pass |
syntax-error |
error | quality | file does not parse |
mutable-default-arg |
warning | quality | def f(x=[]) shares state across calls |
broad-except |
info | quality | except Exception: is broader than most code needs |
assert-in-prod |
warning | security | assert is stripped under python -O. Test files exempt. |
hardcoded-secret |
critical | security | AWS / GitHub / OpenAI / Anthropic / Slack tokens, inline credential literals |
JavaScript / TypeScript (.js .jsx .mjs .cjs .ts .tsx) — v0.0.2+
| Rule ID | Severity | Category | What it catches |
|---|---|---|---|
console-log |
info | quality | leftover console.log/debug/info. Skipped in entry files (process.argv, .listen(, import.meta.main). |
debugger-statement |
warning | quality | debugger; left in code |
var-declaration |
info | style | var instead of let/const |
todo-no-ticket |
info | todo | mirror of the Python rule |
PR-level
| Rule ID | Severity | Category | What it catches |
|---|---|---|---|
pr-title-uninformative |
warning | commit | PR title too short or one of wip/draft/tmp/test |
pr-description-too-short |
info | commit | PR description under 30 characters |
AI-pattern (opt-in via --enable-ai) — v0.1.0+ / v0.2.0 multi-language
| Rule ID | Severity | Category | What it catches |
|---|---|---|---|
ai-review:hallucinated-symbol |
warning | ai-pattern | A function call whose name doesn't resolve to an in-repo symbol, an imported alias, or a known stdlib / global / popular package root. Now spans Python + JS/TS as of v0.2.0. Requires .repox/architecture.json (run repox first). |
ai-review:diff-comprehension |
warning/info | ai-pattern | LLM-backed check for "does the PR description accurately describe the diff?". Pass --ai-provider anthropic and set ANTHROPIC_API_KEY. |
CLI
apr version
apr review --repo .
apr review --repo . --changed src/foo.py --changed src/bar.py
apr review --repo . --title "Fix nullable fields" --description "..."
Output: .apr/review.json (schema-versioned, machine-readable) + .apr/review.md (human companion).
Roadmap
- ✅ v0.0.2 — JS/TS rule pack (
console-log,debugger-statement,var-declaration,todo-no-ticket). - ✅ v0.1.0 — AI rule pack: deterministic
ai-review:hallucinated-symbol+ LLM-pluggableai-review:diff-comprehension. - ✅ v0.1.1 — real Anthropic backend for
ai-review:diff-comprehension. - ✅ v0.2.0 —
ai-review:hallucinated-symbolextended to JS/TS via repox v0.4 call edges. APR now covers all three Wave-1 languages. - v0.3.0 (next) — auto-suggest fixes via the GitHub Suggested Changes API; per-import
local_namesfor renamed JS imports.
Status
Apache-2.0. See CHANGELOG.
1 maintainer
Metadata
1 maintainer
Release files for devtrust-apr 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| devtrust_apr-0.2.0.tar.gz | 37.7 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| devtrust_apr-0.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 68.1 kB
Release files / devtrust_apr-0.2.0.tar.gz
| Download URL | devtrust_apr-0.2.0.tar.gz |
|---|---|
| Size | 37.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8f3de3584b7ec6999067988658062cc1269e0a22b2954714df4a4ae2216a4c39
|
|
BLAKE2b-256 checksum How to use checksums |
608496c3e03f5e50a2be6b728c5351ad6aab86458ba83bda361dc052ae6323b7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 9, 2026.
Transparency logRelease files / devtrust_apr-0.2.0-py3-none-any.whl
| Download URL | devtrust_apr-0.2.0-py3-none-any.whl |
|---|---|
| Size | 30.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0bf0be5e92f91f6c2e9edacd24b9125ee82ef2cd59a72097ecdf977f35d0844d
|
|
BLAKE2b-256 checksum How to use checksums |
0dd9ad755b004333b9e1ec041cf1f2e1a0b670551c98809da21da6901aaf09d3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 9, 2026.
Transparency log
