Format code review findings as inline PR comments (GitHub, GitLab, Bitbucket). Each comment includes file path, line number, severity emoji, finding description, evidence snippet, and suggested fix. Optimized for PR review workflows where findings appear directly on changed lines.
Transform code review findings into inline comments on PR diff lines. Each finding becomes a targeted comment attached to the specific line of code.
**🔴 Critical: SQL Injection**
User input flows to SQL query without parameterization.
**Evidence:**
```python
query = f"SELECT * FROM users WHERE id = {user_id}"
cursor.execute(query)
Fix:
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))
Reference: OWASP SQL Injection Prevention
### GitLab Comment Format
```markdown
🔴 **SQL Injection** (Critical)
User input `user_id` is directly interpolated into SQL query.
```suggestion
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))
### Bitbucket Comment Format
```markdown
**[CRITICAL] SQL Injection**
Direct string interpolation in SQL query allows injection attacks.
Vulnerable code:
query = f"SELECT * FROM users WHERE id = {user_id}"
Suggested fix:
query = "SELECT * FROM users WHERE id = %s" cursor.execute(query, (user_id,))
def create_inline_comment(finding, platform='github'):
comment = {
'path': finding.file,
'line': finding.line,
'side': 'RIGHT', # Comment on new code
'body': format_comment_body(finding, platform)
}
return comment
def format_comment_body(finding, platform):
severity_emoji = {
'critical': '🔴',
'high': '🟠',
'medium': '🟡',
'low': '⚪'
}
emoji = severity_emoji[finding.severity]
if platform == 'github':
return f"""**{emoji} {finding.severity.title()}: {finding.title}**
{finding.description}
**Evidence:**
```{finding.language}
{finding.code_snippet}
Fix:
{finding.fix_suggestion}
Reference: {finding.reference}"""
elif platform == 'gitlab':
return f"""{emoji} **{finding.title}** ({finding.severity.title()})
{finding.description}
{finding.fix_suggestion}
Reference"""
### Step 3: Batch Comments API Call
```python
# GitHub
comments = [create_inline_comment(f, 'github') for f in findings]
github_api.create_review(pr_number, comments=comments, event='COMMENT')
# GitLab
for comment in comments:
gitlab_api.create_discussion(mr_id, comment)
| Severity | Emoji | GitHub | GitLab | Bitbucket |
|---|---|---|---|---|
| Critical | 🔴 | **🔴 Critical** | 🔴 **Title** (Critical) | [CRITICAL] |
| High | 🟠 | **🟠 High** | 🟠 **Title** (High) | [HIGH] |
| Medium | 🟡 | **🟡 Medium** | 🟡 **Title** (Medium) | [MEDIUM] |
| Low | ⚪ | **⚪ Low** | ⚪ **Title** (Low) | [LOW] |
# Span across lines
comment = {
'path': finding.file,
'start_line': finding.start_line,
'line': finding.end_line,
'side': 'RIGHT'
}
# Comment on old code (deletion)
comment = {
'path': finding.file,
'line': finding.line,
'side': 'LEFT' # Left side of diff
}