// Bug 1: Hallucinated import — package doesn't exist
import { validateEmail } from 'email-validator-pro'; // ❌ Doesn't exist on npm // Bug 2: Deprecated API — worked fine in 2020
const parsed = url.parse(request.url); // ⚠️ Deprecated since Node 15 // Bug 3: Security anti-pattern
const query = `SELECT * FROM users WHERE id = ${userId}`; // 🔴 SQL injection
// Bug 1: Hallucinated import — package doesn't exist
import { validateEmail } from 'email-validator-pro'; // ❌ Doesn't exist on npm // Bug 2: Deprecated API — worked fine in 2020
const parsed = url.parse(request.url); // ⚠️ Deprecated since Node 15 // Bug 3: Security anti-pattern
const query = `SELECT * FROM users WHERE id = ${userId}`; // 🔴 SQL injection
// Bug 1: Hallucinated import — package doesn't exist
import { validateEmail } from 'email-validator-pro'; // ❌ Doesn't exist on npm // Bug 2: Deprecated API — worked fine in 2020
const parsed = url.parse(request.url); // ⚠️ Deprecated since Node 15 // Bug 3: Security anti-pattern
const query = `SELECT * FROM users WHERE id = ${userId}`; // 🔴 SQL injection
npm install -g @opencodereview/cli
npm install -g @opencodereview/cli
npm install -g @opencodereview/cli
ocr scan src/ --sla L1
ocr scan src/ --sla L1
ocr scan src/ --sla L1
╔══════════════════════════════════════════════════════════════╗
║ Open Code Review V4 — Quality Report ║
╚══════════════════════════════════════════════════════════════╝ Overall Score: 72/100 🟠 C Files Scanned: 48 | Duration: 6.3s 🔴 [error] api/handler.ts:45 — Possible hardcoded API key 🟡 [warn] utils/request.ts:12 — url.parse() deprecated → WHATWG URL API 🟡 [warn] services/auth.ts:67 — Cyclomatic complexity 22 (max: 15) ⚪ [info] types/index.ts:8 — Unused interface (context window artifact)
╔══════════════════════════════════════════════════════════════╗
║ Open Code Review V4 — Quality Report ║
╚══════════════════════════════════════════════════════════════╝ Overall Score: 72/100 🟠 C Files Scanned: 48 | Duration: 6.3s 🔴 [error] api/handler.ts:45 — Possible hardcoded API key 🟡 [warn] utils/request.ts:12 — url.parse() deprecated → WHATWG URL API 🟡 [warn] services/auth.ts:67 — Cyclomatic complexity 22 (max: 15) ⚪ [info] types/index.ts:8 — Unused interface (context window artifact)
╔══════════════════════════════════════════════════════════════╗
║ Open Code Review V4 — Quality Report ║
╚══════════════════════════════════════════════════════════════╝ Overall Score: 72/100 🟠 C Files Scanned: 48 | Duration: 6.3s 🔴 [error] api/handler.ts:45 — Possible hardcoded API key 🟡 [warn] utils/request.ts:12 — url.parse() deprecated → WHATWG URL API 🟡 [warn] services/auth.ts:67 — Cyclomatic complexity 22 (max: 15) ⚪ [info] types/index.ts:8 — Unused interface (context window artifact)
name: AI Code Quality Check on: [pull_request] jobs: code-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install OCR run: npm install -g @opencodereview/cli - name: Scan changed files uses: raye-deng/open-code-review@v1 with: sla: L1 threshold: 60 scan-mode: diff github-token: ${{ secrets.GITHUB_TOKEN }}
name: AI Code Quality Check on: [pull_request] jobs: code-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install OCR run: npm install -g @opencodereview/cli - name: Scan changed files uses: raye-deng/open-code-review@v1 with: sla: L1 threshold: 60 scan-mode: diff github-token: ${{ secrets.GITHUB_TOKEN }}
name: AI Code Quality Check on: [pull_request] jobs: code-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install OCR run: npm install -g @opencodereview/cli - name: Scan changed files uses: raye-deng/open-code-review@v1 with: sla: L1 threshold: 60 scan-mode: diff github-token: ${{ secrets.GITHUB_TOKEN }}
- name: Generate SARIF run: ocr scan src/ --sla L1 --format sarif -o ocr-results.sarif - name: Upload SARIF uses: github/codeql-action/upload-sarif@v3 with: sarif_file: ocr-results.sarif
- name: Generate SARIF run: ocr scan src/ --sla L1 --format sarif -o ocr-results.sarif - name: Upload SARIF uses: github/codeql-action/upload-sarif@v3 with: sarif_file: ocr-results.sarif
- name: Generate SARIF run: ocr scan src/ --sla L1 --format sarif -o ocr-results.sarif - name: Upload SARIF uses: github/codeql-action/upload-sarif@v3 with: sarif_file: ocr-results.sarif
threshold: 70 # Adjust based on your team's tolerance
threshold: 70 # Adjust based on your team's tolerance
threshold: 70 # Adjust based on your team's tolerance
# .ocrrc.yml
sla: L2
ai: embedding: provider: ollama model: nomic-embed-text baseUrl: http://localhost:11434 llm: provider: ollama model: qwen3-coder endpoint: http://localhost:11434
# .ocrrc.yml
sla: L2
ai: embedding: provider: ollama model: nomic-embed-text baseUrl: http://localhost:11434 llm: provider: ollama model: qwen3-coder endpoint: http://localhost:11434
# .ocrrc.yml
sla: L2
ai: embedding: provider: ollama model: nomic-embed-text baseUrl: http://localhost:11434 llm: provider: ollama model: qwen3-coder endpoint: http://localhost:11434
code-review: script: - npx @opencodereview/cli scan src/ --sla L1 --threshold 60 --format json --output ocr-report.json artifacts: reports: codequality: ocr-report.json
code-review: script: - npx @opencodereview/cli scan src/ --sla L1 --threshold 60 --format json --output ocr-report.json artifacts: reports: codequality: ocr-report.json
code-review: script: - npx @opencodereview/cli scan src/ --sla L1 --threshold 60 --format json --output ocr-report.json artifacts: reports: codequality: ocr-report.json
npm install -g @opencodereview/cli
ocr scan src/ --sla L1
npm install -g @opencodereview/cli
ocr scan src/ --sla L1
npm install -g @opencodereview/cli
ocr scan src/ --sla L1 - Hallucinated imports — Verifies every import against npm/PyPI registries
- Stale APIs — AST-based deprecated API detection
- Security anti-patterns — Hardcoded secrets, eval(), SQL injection
- Over-engineering — Cyclomatic complexity, nesting depth
- Context artifacts — Unused interfaces, dead code from truncated generation - Cross-file coherence checking
- Semantic duplication detection
- AI confidence scoring - Start with L1. It's fast enough for every PR. Add L2 later for critical paths.
- Use scan-mode: diff in CI to only scan changed files — keeps PR checks fast.
- Don't set threshold too high initially. Start at 50-60 and raise it as you fix existing issues.
- Use --format html for human-readable reports in pull request comments.
- Run a full scan weekly (not just diffs) to catch gradual drift.
