Toolbox & code review

The Toolbox section of the sidebar is being reworked, and the current screens under it don’t load your organization’s data - for browsing and managing your organization’s repositories, use Repositories instead; for container images, use Container registry. This page covers Code Reviews.

Code Reviews

Code Reviews (/gravity/dev/code-reviews) runs an automated review against a pull request’s diff in one of your repositories and reports a score, a summary, and a list of flagged issues.

Requesting a review

New Review Request asks for:

• Repository URL - the repository the pull request lives in.
• PR number - required.
• PR title (optional) - for your own reference in the list.

Any member of the active organization can submit a request; the list (/gravity/dev/code-reviews) is scoped to that organization and shows every request in it, regardless of who submitted it. The repository needs to be one hosted on Sencai - see Repositories - since that’s where the pull request diff is read from.

The request starts at Pending, moves to Analyzing once Sencai has the diff, and finishes at Completed or Failed. The list shows every request’s status, score, issue count, model, and when it was requested - click a row to see the full result.

Note

Review requests are processed asynchronously. If a request stays at Pending for a while, no action is needed on your side - check back later, or open a new request for the same pull request if you’d rather not wait.

Reviewing a result

Opening a request shows its score out of 100 with a progress bar, the repository and PR number, a written summary, and a table of every issue found - severity, file, line, and a short message per finding. A completed review with nothing flagged shows a plain “No issues found” instead of an empty table.

What the review checks

The review scans the diff itself for a fixed set of common issues rather than reviewing your application’s behavior or business logic:

• Debug statements left in (console.log/console.error)
• Patterns that look like a hardcoded password or secret
• Use of eval()
• Unresolved TODO/FIXME/HACK comments

Each finding gets a severity (low, medium, high, or critical - a suspected hardcoded secret is always critical) and contributes to a 0–100 score shown on the request. A finding’s file and line aren’t always resolvable from the diff alone, in which case they show as unknown rather than a guess.

Availability

Code review is one of the capabilities included with the AI and Unlimited personal plans - see Personal plans for what’s included at each tier.

What’s next

• Repositories - the repositories you request a review against
• Container registry - where images from those repositories end up
• Personal plans - plan tiers and what each includes
• Vulnerabilities - a separate, deeper scan that runs against deployed images and instances rather than a pull request diff