Developer builds CodeRift to automate GitLab code reviews using AI and AST analysis

·1 views

A developer has created CodeRift, an automated code review platform designed to address the inefficiency and superficiality of manual code reviews in software teams. The tool integrates with GitLab and analyzes every merge request through a seven-step pipeline that includes diff parsing, AST analysis via tree-sitter, a TOML rule engine, and parallel AI agents. Three specialized AI agents run simultaneously on each code chunk, focusing respectively on security vulnerabilities, logic bugs, and performance issues. The platform is built on a Rust-based API and worker architecture, orchestrated by a custom workflow engine called IronFlow, which handles retries, structured logging, and status updates. CodeRift supports multiple languages including Rust, TypeScript, Python, Go, and SQL, and allows per-project rule customization through a configuration file.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How PHP Password Reset Flows Become Account Takeover Vulnerabilities

A detailed security analysis highlights how PHP and Laravel developers often combine individually sound concepts incorrectly when building password reset features, resulting in serious account takeover vulnerabilities. Common mistakes include using predictable token sources like md5(time()), uniqid(), or mt_rand() instead of the cryptographically secure random_bytes() function. Even when tokens are generated securely, storing them in plaintext exposes users to risk if the database is ever compromised through SQL injection or misconfigured backups. The article recommends hashing tokens with SHA-256 before storage, mirroring best practices already applied to passwords. It also covers additional failure points such as missing rate limiting, unsafe string comparisons, and inadequate session invalidation after a password change.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude API Offers Three Tool-Calling Methods With Distinct Trade-offs in Cost and Complexity

When integrating tools with Anthropic's Claude API in 2026, developers can choose from three approaches: traditional JSON tool calling, a Tool Runner helper, or programmatic tool calling. The traditional method uses a manual request-response loop where each tool invocation requires a full round trip with the model, which can become costly and token-heavy at scale — tool definitions alone can exceed 134,000 tokens in multi-server setups. The Tool Runner, available across multiple official SDKs including Python and TypeScript, automates the agentic loop by handling schema generation, execution, and conversation state management. Programmatic tool calling offers a third path, aimed at reducing inference passes and context bloat by allowing more direct execution control. Each method involves distinct trade-offs between developer control, boilerplate complexity, token consumption, and overall performance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Developer Structured a 20-Crate Rust API with Strict Layered Architecture

A developer building IronFlow, a Rust-based workflow engine, adopted a strict layered architecture across a 20-crate Cargo workspace to address the scalability limits of single-file API designs. The project separates concerns into distinct crates — including ironflow-store, ironflow-engine, ironflow-api, and ironflow-auth — with dependencies flowing only downward, preventing REST handlers from directly accessing SQL queries. At the core of IronFlow is a finite state machine that governs workflow lifecycle, with all valid status transitions explicitly defined using Rust's matches! macro for clarity and compiler-enforced safety. Terminal-to-same-terminal state transitions are treated as idempotent, simplifying concurrency handling across workers. The author shares both the architectural decisions that proved effective and those they would revisit, offering a practical reference for production-grade Rust API design.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Write Production-Ready Claude Code Skills That Actually Trigger

Claude Code skills — folders containing a SKILL.md file with YAML metadata and Markdown instructions — are a largely underused feature that can automate tasks from Git commits to content creation. The system loads skills across three levels: a lightweight discovery phase using roughly 100 tokens per skill, a full activation phase under 5,000 tokens, and an on-demand execution phase for referenced files or scripts. Keeping the SKILL.md body under 5,000 tokens is critical, as oversized files waste context every time a skill activates. The frontmatter description is the most important element, since it is the only text Claude reads before deciding whether to trigger a skill, and should include explicit use-case phrases in all languages users might employ. Skills written in this open standard, created by Anthropic, are also compatible with other AI coding tools such as Cursor.

0 comments Read more at DEV Community