Grit automatically fixes technical debt by combining static analysis and machine learning to generate pull requests that clean up code and migrate to the latest frameworks.
How Grit.io can help you:
Why choose Grit.io: Key features
Who should choose Grit.io:
Categories
Connecting ChatGPT to Code Review Made Easy - DZone
The era of artificial intelligence is already already in bloom. Everyone working in IT is already familiar with our "new best friend" for development -- AI. Working as a DevOps Engineer at Innovecs, I'd like to share one of my latest findings. We're perfectly aware that GPT can generate code quite well. . . but it turns out it can review it just as smoothly! I will immediately show how this works in practice (parts of the code are blurred to avoid showing too much). I created a test merge request in which I added a JSON file with slightly broken formatting and plaintext passwords, recreating a security leak: As we can see, AI not only detected the sensitive information but also masked it in its comment + tagged me to remove it. Much more powerful analytics compared to tools like GitLeaks, which perform simple searches statically using regex and wildcards. Examples from frontend merge requests (colleague's screenshots), highlighting only certain points: The GPT-4o model shows quite a good knowledge of React. Everyone knows this design with the key, but they always forget it. I can give many examples, but the point is that its recommendations make sense! Of course, not all comments are worth attention, but a large part is invaluable. I'll explain how you can program an automated review process in Python in just one hour. This code should be added immediately to the CI/CD flow for maximum effect and process automation. It's perfect to wrap it into one CI/CD job and execute it on each MR/PR (just make an exception for changes from renovate/dependabot). I would love to share the ready-made code, but unfortunately, I can't (due to company restrictions). So, I'll share the idea with architectural blocks for you to piece it together like a constructor. It could be GPT-4o from OpenAI. But I recommend Azure OpenAI, as Azure promises not to transfer code and not to train on it. Get the code changes and comments on these changes. We use GitLab, so I'll immediately provide the endpoints as an example: For aesthetic purposes, the JSON response from GitLab needs to be parsed. Do not forget to add a prompt at the beginning with explanations on what to do, and put it all into one request: In the prompt, you need to politely ask the AI to analyze your code changes based on criteria -- something like this (a very simplified version compared to what we use): "As a Developer, I want to ask you to perform a GitLab Merge Request review. Consider previous comments noted below and avoid repeating similar recommendations. If you spot a recurring issue, skip it. For security issues or sensitive information leaks, mention the assignee's username with @. Make your feedback clear, concise, and actionable, with specific improvement recommendations. Review the code snippet below based on these criteria: That's it! Simply post the received response as a comment. Create a GitLab PAT token for this with the name AI MR review and direct POST to the MR notes API: Implementing this solution will bring improvements for: Imagine the opportunities: it will be your script, so you can, for example: So let's make our code better and life easier. Welcome to the AI era, dear colleagues!
dzone.com
Fri, 9 Aug, 2:10 PM UTC
GitHub rolls out new tool to fix code errors even before you see them
GitHub has announced the general availability of Copilot Autofix within its GitHub Advanced Security (GHAS) suite, designed to prevent new vulnerabilities from entering code before you even see them. The tool, announced by Chief Security Officer Mike Hanley in a blog post, will also tackle existing vulnerabilities in code, which was previously unmanageable without automation. Besides identifying code vulnerabilities, Copilot Autofix also promises to explain their significance and offer automated code suggestions to fix them. According to the company's research, the tool has already proven to be around three times more efficient than doing the process manually. Early adopters like Optum and Otto Group have also reported saving thousands of hours monthly on remediation tasks. Kevin Cooper, Principal Engineer at Optum, commented: "Since implementing Copilot Autofix, we've observed a 60% reduction in the time spent on security-related code reviews and a 25% increase in overall development productivity." In the announcement, Hanley was proud to highlight Copilot Autofix's ability to address the backlog of security debt - vulnerabilities that linger in software for extended periods, often going unnoticed. Tackling these types of vulnerabilities can significantly reduce the risk of costly security breaches. Hanley added: "Vulnerabilities can live forever, and the longer they've remained dormant, the harder and more expensive they are to fix." In addition to serving enterprise customers, GitHub will offer the tool to the open-source community for no cost from September 2024. Maintainers will be able to enhance the security of their own software, which aligns with the Microsoft-owned company's commitment to creating a safer software scene. Hanley concluded by stating that "AI agents can help relieve much of the burden" in a world of limited security talent, adding that Copilot Autofix will help ensure that "a vulnerability found means a vulnerability fixed."
TechRadar
Fri, 16 Aug, 12:04 PM UTC
GitHub rolls out AI-powered Autofix Copilot to catch and fix vulnerabilities in code - SiliconANGLE
GitHub rolls out AI-powered Autofix Copilot to catch and fix vulnerabilities in code In a "move fast and break things" world, Microsoft Corp.'s GitHub today announced the launch of a new way, using artificial intelligence, to move fast while fixing problems during software development before they become bigger issues down the line. The company said Autofix Copilot, an AI-powered vulnerability remediation tool in GitHub Advanced Security, is now generally available. Originally introduced in public beta test in March, the tool uses advanced generative AI during pull requests to detect vulnerabilities in new code and offers solutions to fix problems before they're pushed into production. "Code scanning tools detect vulnerabilities, but they don't address the fundamental problem: remediation takes security expertise and time, two valuable resources in critically short supply," said Mike Hanley, chief security officer and senior vice president of engineering at GitHub. "In other words, finding vulnerabilities isn't the problem. Fixing them is." Autofix works similarly to the company's AI-powered co-assistance tool Copilot, which helps developers generate software quickly. The tool operates alongside software developers like a security expert partner that can scan through existing code, detect vulnerabilities and provide on-point explanations as to why a piece of code is problematic, alongside a fix that will resolve the problem. According to GitHub, based on customer data during the beta release of the product between May and July, customers saw excellent results in reducing the time needed to detect issues and fix them. The company said that overall, the median time to automatically commit a fix from pull-request alerts became three times faster with Autofix at 28 minutes, compared with 1.5 hours when done manually. Specific vulnerabilities such as cross-site scripting saw fixes happen even faster, the company claimed: 22 minutes using Copilot, compared with 2.8 hours manually, and 18 minutes using the AI-tool, compared with 3.7 hours for SQL injection. "Since implementing Copilot Autofix, we've observed a 60% reduction in the time spent on security-related code reviews and a 25% increase in overall development productivity," said Kevin Cooper, principal engineer at American healthcare technology provider Optum Inc. "In the healthcare space, where security is critical, it helps us act on proven industry solutions quickly. This proactive approach to security helps us prevent potential issues, saving thousands of hours per month that would otherwise be spent on remediation." The ideal importance of Autofix is that it doesn't just provide meaningful fixes and remediation for vulnerabilities in scanned code as developers go about their everyday work, Hanley said. Developers who aren't necessarily security experts can rely on it to explain why its recommendation is necessary and how to implement the fix properly. That makes the AI tool not just a simple scanning device that's part of developers' arsenal in cybersecurity, but a way to upgrade their security awareness overall. Under the hood, Autofix uses a specialized code scanning engine called CodeQL in combination with OpenAI's flagship AI model GPT-4o to generate code fix suggestions. It can work with large swaths of internal private enterprise codebases provided by users and open-source code libraries. "As the global home of the open-source community, GitHub is uniquely positioned to help maintainers detect and remediate vulnerabilities so that open-source software is safer and more reliable for everyone," said Hanley.
SiliconANGLE
Wed, 14 Aug, 6:06 PM UTC
CodeRabbit raises $16M to bring AI to code reviews | TechCrunch
Code reviews -- peer reviews of code that help devs improve code quality -- are time-consuming. According to one source, 50% of companies spend two to five hours a week on them. Without enough people, code reviews can be overwhelming and take devs away from other important work. Harjot Gill thinks that code reviews can be largely automated using artificial intelligence. He's the co-founder and CEO of CodeRabbit, which analyzes code using AI models to provide feedback. Prior to starting CodeRabbit, Gill was the senior director of technology at datacenter software company, Nutanix. He joined the company when Nutanix acquired his startup, Netsil, in March 2018. CodeRabbit's other founder, Gur Singh, previously led dev teams at white-label healthcare payments platform, Alegeus. According to Gill, CodeRabbit's platform automates code reviews using "advanced AI reasoning" to "understand the intent" behind code and deliver "actionable," "human-like" feedback to devs. "Traditional static analysis tools and linters are rule-based and often generate high false-positive rates, while peer reviews are time-consuming and subjective," Gill told TechCrunch. "CodeRabbit, by contrast, is an AI-first platform." These are bold claims with a lot of buzzwords. Unfortunately for CodeRabbit, anecdotal evidence suggests that AI-powered code reviews tend to be inferior compared to human-in-the-loop ones. In a blog post, Graphite's Greg Foster talks about internal experiments to apply OpenAI's GPT-4 to code reviews. While the model would catch some useful things -- like minor logical errors and spelling mistakes -- it generated lots of false positives. Even attempts at fine-tuning didn't dramatically reduce these, according to Foster. These aren't revelations. A recent Stanford study found that engineers who use code-generating systems are more likely to introduce security vulnerabilities in the apps they develop. Copyright is an ongoing concern, as well. There are also logistical drawbacks of using AI for code reviews. As Foster notes, more traditional code reviews force engineers to learn through sessions and conversations with their developer peers. Offloading reviews threatens this knowledge sharing. Gill feels differently. "CodeRabbit's AI-first approach improves code quality and significantly reduces the manual effort required in the code review process," he said. Some folks are buying the sales pitch. Around 600 organizations are paying for CodeRabbit's services today, Gill claims, and CodeRabbit is in pilots with "several" Fortune 500 companies. It also has investments: CodeRabbit today announced a $16 million Series A funding round led by CRV, with participation from Flex Capital and Engineering Capital. Bringing the company's total raised to just under $20 million, the new cash will be put toward expanding CodeRabbit's 10-person sales and marketing functions and product offerings, with a focus on enhancing its security vulnerability analysis capabilities. "We'll invest in deeper integrations with platforms like Jira and Slack, as well as AI-driven analytics and reporting tools," Gill said, adding that Bay Area-based CodeRabbbit is in the process of setting up a new office in Bangalore as it roughly doubles the size of the team. "The platform will also introduce advanced AI automation for dependency management, code refactoring, unit test generation and documentation generation."
TechCrunch
Thu, 15 Aug, 4:06 PM UTC
GitHub taps AI to eradicate software vulnerabilities with Copilot-powered security updates
With Copilot Autofix, developers and security teams can keep new vulnerabilities out of code and confidently remediate their backlog security debt GitHub, the world's leading AI-powered developer platform, announced the general availability of AI-powered remediation with Copilot Autofix in GitHub Advanced Security (GHAS). Copilot Autofix analyses vulnerabilities in code, explains why they matter, and offers code suggestions that help developers fix vulnerabilities as fast as they are found. During the public beta, GitHub found that developers were fixing code vulnerabilities more than three times faster than those who do so manually, a powerful example of how AI agents can radically simplify and accelerate secure software development. Developers can keep new vulnerabilities out of their code with Copilot Autofix in the pull request, and now also pay down the backlog of security debt by generating fixes for existing vulnerabilities. "Code scanning tools detect vulnerabilities, but they don't address the fundamental problem: remediation takes security expertise and time, two valuable resources in critically short supply. In other words, finding vulnerabilities isn't the problem. Fixing them is," said Mike Hanely, CSO and SVP of Engineering at GitHub. "With Copilot Autofix, we are one step closer to our vision where a vulnerability found means a vulnerability fixed," Hanely added. Since its introduction in public beta in March 2024, developers have used Copilot Autofix in their pull requests to help them quickly fix vulnerabilities in new code before they get merged to production where they can impact customers. Fixes can be generated for dozens of classes of code vulnerabilities, such as SQL injection and cross-site scripting, which developers can dismiss, edit, or commit in their pull request. Based on customer data from public beta between May through July 2024, Copilot Autofix has already shown dramatic reductions in the amount of time between detection and successful remediation: 3x faster. Overall, the median time for developers to use Copilot Autofix to automatically commit the fix for a pull request-time alert was 28 minutes, compared to 1.5 hours to resolve the same alerts manually.7x faster. Cross-site scripting vulnerabilities: 22 minutes, compared to almost three hours.12x faster. SQL injection vulnerabilities: 18 minutes, compared to 3.7 hours. Early users of Copilot Autofix have also reported dramatic improvements in efficiency and productivity. "Since implementing Copilot Autofix, we've observed a 60% reduction in the time spent on security-related code reviews and a 25% increase in overall development productivity," says Kevin Cooper, principal engineer at Optum. "In the healthcare space, where security is critical, it helps us act on proven industry solutions quickly. This proactive approach to security helps us prevent potential issues, saving thousands of hours per month that would otherwise be spent on remediation." Just as GitHub Copilot helps developers code more quickly, Copilot Autofix accelerates the pace of remediation so security teams make real progress with the backlog of existing vulnerabilities, commonly known as security debt. When a developer is asked to fix vulnerabilities in code that they haven't seen in a while or aren't familiar with, it can take hours to assess the surrounding code and experiment with manual fixes. Copilot Autofix dramatically reduces this burden so developers can fix old vulnerabilities with more speed and confidence. Here's how it works. To initiate Copilot Autofix for vulnerabilities in existing code, a developer simply presses the "Generate fix" button on an alert in the GHAS code scanning alert. Copilot Autofix assesses the code and the vulnerability and returns an explanation and code suggestion for review. The developer can then press the "Create PR with fix" button to create a new pull request which includes code changes to fix the alert. With Copilot Autofix, teams can pay down years' worth of security debt-even those hard-to-prioritise low- and moderate-severity alerts-in just a matter of a few clicks. Behind the scenes, Copilot Autofix leverages the CodeQL engine, GPT-4o, and a combination of heuristics and GitHub Copilot APIs to generate code suggestions. Copilot Autofix builds an LLM prompt based on sources including CodeQL analysis and short snippets of code around the flow path. As the global home of the open source community, GitHub is uniquely positioned to help maintainers detect and remediate vulnerabilities so that open source software is safer and more reliable for everyone. GitHub believes that it's highly important to be both a responsible consumer of open source software and contributor back to it, which is why open source maintainers can already take advantage of GitHub's code scanning, secret scanning, dependency management, and private vulnerability reporting tools at no cost. Starting in September, GitHub will add Copilot Autofix in pull requests to this list and offer it for free to all open source projects. From GitHub Copilot Workspace to GHAS, GitHub is championing a future where AI doesn't just assist but helps transform businesses, from productivity and innovation to security and risk reduction. Within GHAS, GitHub is leveraging AI not only to help fix vulnerabilities in code, but also to improve the scope and accuracy of secret scanning, and with new workflows that scale Copilot Autofix for organisations with a high volume of security debt, all on the familiar platform that developers already know and love. About GitHub As the global home for all developers, GitHub is the world's leading AI-powered developer platform to build, scale, and deliver secure software. Over 100 million people, including developers from 90 of the Fortune 100 companies, use GitHub to build amazing things together across 420+ million repositories. With all the collaborative features of GitHub, it's never been easier for individuals and teams to write faster, better code.
CXOToday.com
Mon, 19 Aug, 2:08 PM UTC
The Outpost is a comprehensive collection of curated artificial intelligence software tools that cater to the needs of small business owners, bloggers, artists, musicians, entrepreneurs, marketers, writers, and researchers.
© 2024 TheOutpost.AI All rights reserved
