Not analysing PRS of private repos and of contributers

[yb175]

[yb175]

@coderabbitai the issues of contributers and in private repos are not analysed , please gothrough the codebase and mention the root cause , along with short prd and giving details of files to be modified

[coderabbitai]

🧩 Analysis chain

@yb175, I'll investigate the codebase to identify why issues from contributors and in private repos are not being analyzed.

---

🏁 Script executed:

#!/bin/bash

# First, let's understand the repository structure
echo "=== Repository Structure ==="
tree -L 2 -I 'node_modules|dist|build|.git'

echo -e "\n=== Looking for issue-related files ==="
fd -e js -e ts -e py issue

echo -e "\n=== Looking for contributor-related code ==="
rg -n -C3 "contributor" --type-add 'code:*.{js,ts,py,jsx,tsx}' --type code

echo -e "\n=== Looking for private repo handling ==="
rg -n -C3 "private" --type-add 'code:*.{js,ts,py,jsx,tsx}' --type code

echo -e "\n=== Looking for GitHub API calls related to issues ==="
rg -n -C3 "issues" --type-add 'code:*.{js,ts,py,jsx,tsx}' --type code | head -100

Length of output: 46684

---

@yb175, I'll investigate further to find the issue processing logic.

---

🏁 Script executed:

#!/bin/bash

echo "=== Examining worker files ==="
fd -e js -e ts . backend/worker --exec cat {}

echo -e "\n=== Examining queue files ==="
fd -e js -e ts . backend/queues --exec cat {}

echo -e "\n=== Examining service files ==="
fd -e js -e ts . backend/services | head -20

echo -e "\n=== Searching for issue processing logic ==="
rg -n -C5 "process.*issue|analyze.*issue|fetch.*issue" --type-add 'code:*.{js,ts}' --type code backend/

echo -e "\n=== Searching for PR/webhook handling ==="
rg -n -C5 "pull_request|webhook" --type-add 'code:*.{js,ts}' --type code backend/

Length of output: 8851

---

🏁 Script executed:

#!/bin/bash

echo "=== Reading complete handleWebhook.js ==="
cat backend/controllers/webhook/handleWebhook.js

echo -e "\n=== Reading analysis.service.js ==="
cat backend/services/analysis.service.js

echo -e "\n=== Searching for contributor or private repo filtering ==="
rg -n -C5 "contributor|author\.association|repo\.private|repository\.private" --type-add 'code:*.{js,ts}' --type code backend/

Length of output: 9175

---

🏁 Script executed:

#!/bin/bash

echo "=== Checking for any filtering configuration ==="
rg -n "ALLOW_PRIVATE|SKIP_CONTRIBUTOR|FILTER.*REPO|FILTER.*PR" --type-add 'code:*.{js,ts,env}' --type code backend/

echo -e "\n=== Checking .env files for configuration ==="
fd -H "^\.env" --exec cat {}

echo -e "\n=== Checking models/schema for repo tracking ==="
cat backend/prisma/schema.prisma 2>/dev/null || echo "Schema file not found in expected location"

echo -e "\n=== Looking for any repo or PR filtering utilities ==="
fd -e js -e ts . backend/utils | xargs grep -l "filter\|private\|contributor" 2>/dev/null || echo "No filtering utilities found"

Length of output: 1348

---

@yb175, I've identified the root cause. Here's my analysis:

🔍 Root Cause Analysis

Location: backend/controllers/webhook/handleWebhook.js (lines 74-103)

Problem: The webhook handler processes ALL pull request events without filtering based on:

1. Repository visibility (repo.private)
2. PR author association (pr.author_association)

Current Flow:

// Line 74-76: Extract data from webhook payload
const pr = payload.pull_request;
const repo = payload.repository;
const installationId = payload.installation?.id;

// Lines 86-92: Unconditionally queue ALL PRs for analysis
analysisRun = await prisma.analysisRun.create({
  data: {
    pr_number: pr.number,
    pr_owner: pr.user.login,
    repo_name: repo.name,
    commit_sha: pr.head.sha,
  },
});

Missing Checks:

• No validation of repo.private (boolean field in GitHub payload)
• No validation of pr.author_association (values: "OWNER", "MEMBER", "CONTRIBUTOR", "FIRST_TIME_CONTRIBUTOR", etc.)

---

📋 Short PRD: Selective PR Analysis

Objective

Enable filtering of PRs based on repository visibility and author association to allow users to control which PRs get analyzed.

User Stories

1. As a user, I want to skip analysis for private repositories to protect sensitive code
2. As a user, I want to skip analysis for external contributor PRs to reduce analysis load or apply different review workflows

Technical Requirements

1. Configuration Layer

• Add environment variables:
  • ANALYZE_PRIVATE_REPOS (boolean, default: true)
  • ANALYZE_CONTRIBUTOR_PRS (boolean, default: true)
  • ALLOWED_AUTHOR_ASSOCIATIONS (comma-separated: "OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR")

2. Webhook Filtering Logic

• Check repository visibility before queueing
• Check author association against allowed list
• Log skipped PRs with reason
• Return early with 200 OK for filtered PRs

3. Database Schema (Optional Enhancement)

• Add repo-level preferences table for per-repo filtering rules
• Track filtering decisions for analytics

Success Criteria

• Private repo PRs are skipped when ANALYZE_PRIVATE_REPOS=false
• Contributor PRs are skipped when author_association not in allowed list
• Existing functionality preserved for allowed PRs
• Proper logging for debugging

---

📁 Files to Modify

1. backend/controllers/webhook/handleWebhook.js (Primary Fix)

Changes needed:

• Add filtering logic after line 76 (after extracting pr/repo data)
• Check repo.private against config
• Check pr.author_association against allowed list
• Return early for filtered PRs with appropriate logging

Example implementation:

// After line 76, add:
const repoIsPrivate = repo.private;
const authorAssociation = pr.author_association; // OWNER, MEMBER, CONTRIBUTOR, etc.

// Filter private repos
const analyzePrivateRepos = process.env.ANALYZE_PRIVATE_REPOS !== 'false';
if (repoIsPrivate && !analyzePrivateRepos) {
  console.log(`Skipping private repo: ${repo.full_name}`);
  return res.status(200).json({ 
    success: true, 
    message: 'Private repo analysis disabled' 
  });
}

// Filter external contributors
const allowedAssociations = (process.env.ALLOWED_AUTHOR_ASSOCIATIONS || 'OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR').split(',');
if (!allowedAssociations.includes(authorAssociation)) {
  console.log(`Skipping PR from ${authorAssociation}: ${repo.full_name}#${pr.number}`);
  return res.status(200).json({ 
    success: true, 
    message: `Author association ${authorAssociation} not allowed` 
  });
}

2. .env / .env.example (Configuration)

Add:

# PR Analysis Filters
ANALYZE_PRIVATE_REPOS=true
ANALYZE_CONTRIBUTOR_PRS=true
ALLOWED_AUTHOR_ASSOCIATIONS=OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR

3. backend/README.md (Documentation)

Add section:

• Document new environment variables
• Explain filtering behavior
• List GitHub author_association values

4. Optional: backend/prisma/schema.prisma (Future Enhancement)

Add model for per-repo settings:

model RepoSettings {
  id                String   `@id` `@default`(uuid())
  repo_full_name    String   `@unique`
  analyze_private   Boolean  `@default`(true)
  allowed_associations String[] `@default`(["OWNER", "MEMBER", "COLLABORATOR"])
  createdAt         DateTime `@default`(now())
  updatedAt         DateTime `@updatedAt`
}

---

🎯 Priority Implementation Order

1. Immediate Fix (High Priority):

   • Modify handleWebhook.js with filtering logic
   • Add environment variables to .env

2. Short-term (Medium Priority):

   • Add comprehensive logging
   • Update documentation

3. Future Enhancement (Low Priority):

   • Per-repo filtering settings in database
   • UI for managing filtering preferences

Would you like me to create a plan to implement these changes?

---

🧠 Learnings used

Learnt from: yb175
Repo: yb175/pullShark PR: 0
File: :0-0
Timestamp: 2026-02-26T04:45:52.017Z
Learning: Repo yb175/pullShark: Reviewer preference — focus reviews on security, database performance, proper error handling, clean architecture, and low complexity. Feedback must be concise and actionable; avoid generic praise.