IronBee reviews every GitHub pull request, writes a summary into its description, comments on the line with a suggested fix, and follows up after every push.
See a PR summary[ How it works ]
Install it once. Every pull request after that is read, reviewed on its lines, and followed in IronBee after every push.
Repository access
coupons into mainIronBee ReviewreadingIronBee Review3 findingsorders.ts:18pay.ts:27cart.ts:43
Pull requestsstorefrontThe severity, the claim, the line and the fix, with a diagram when the bug is about order, state or a path.
await placeOrder(order)if (charge.ok) await placeOrder(order)ironbeeA declined card still places the orderFocus area Correctnessconst order = await db.orders.find(id)const order = await db.orders.find(id, { owner: user.id })ironbeeAny signed-in user can read any orderFocus area Securityawait charge(order.id, subtotal)await charge(order.id, shown)ironbeeThe coupon never reaches the cardFocus area Correctness, with a diagram[ In the pull request ]
A summary in the description shows the approver what changed and how it flows. In the thread it answers questions and comes back after every push.
ironbeeSummaryfor 36804e53 files, +47 −6, 2 commits
cart.tsPayments1applies SAVE202setTotal(shown)3charge(subtotal)src/checkout/cart.ts:431 medium finding
[ PR summary ]
IronBee adds its own section to the end of the pull request description, or a pinned comment if you prefer: what changed by area, sequence and state diagrams, where to look, a reading order and what is missing. After a push it keeps what still holds and says what changed since.
3f2a1c7Highcorrectness
The refresh runs after the expiry check, so a request in the last second still carries the old token.
Happens when: a request starts less than one second before expiresAt.
Suggested change
Rule no-stale-token: a request is never sent with a token inside its refresh window.
Why high? The interceptor refreshes on a 401.
The interceptor runs on a response; this request is already sent with the old token, and the retry in lib/net stops after one 401.
Looks addressed in 9c4d2e1: the refresh now runs before the expiry check. Resolved
[ In the thread ]
Ask why and it answers in the thread. When a push addresses the finding, it says so and resolves the thread. A thumbs down keeps a finding out of later reviews.
[ Settings ]
Set them once for the account; any repository can change what is different. The example comment follows them.
Example commentIt follows the settings beside it.
Reviewed on push 3f2a1c7, Auto
Pull request description
Summary of this pull requestRefreshes the session before the token expires and moves the retry into lib/net.
ironbeebot
Highcorrectness
The refresh runs after the expiry check, so a request in the last second still carries the old token.
How it happens
Suggested change
2 1teaches the next review
IronBee Review, action required3 findings: 1 high, 1 medium, 1 low
[ And verification ]
Verification opens the pull request's preview deployment, uses it like a customer and reports what broke. Same GitHub App, same credits, its own check.
Steps
SummaryChecks2Issues1Suggested fixes1
Root cause: src/checkout/cart.ts:43 passes the subtotal to charge(), not the total after the coupon.
charge(order.id, shown)
Each review sees one repository, and nothing else.
Each review runs in its own sandboxed machine with a short-lived, read-only token for that one repository.
Replies, reactions and memories shape the reviews of their own project only. Nothing one team teaches it reaches another account.
It posts its review as a comment and never approves. It blocks a merge only through its check.
No. It posts its review as a comment and never approves. It blocks a merge only through its check, and only where branch protection requires that check.
What changed, grouped by area and linked to the lines; sequence, state or path diagrams of the flow; where to look, with the review findings; a reading order; and what is missing, such as tests left unchanged. It sits at the end of the description, or in a pinned comment, and is rewritten after every push.
Yes. The PR summary draws the flow of the change as sequence, state or path diagrams, and a finding about order, state or a path carries a small diagram of how it happens. Both are on by default.
Yes, in place, without copying them. It also reads REVIEW.md and Copilot's instructions file.
Credits by the size of the change and the depth, from the pool verification also uses: 100 credits a month on Free, 100 per seat on Team. Failed reviews, answers and rechecks are free.
GitHub today. GitHub Enterprise Cloud, GitLab and Bitbucket are planned.
Comment @ironbee review, or @ironbee full review to start over.
A reviewer that reads a pull request's changes and comments on the problems it finds, the way a teammate would, before anyone merges.
Can't find your answer? Talk to us.