Merge request review
Olympusx AI reviews merge requests (pull requests, on GitHub and Bitbucket) in the repositories a code source indexes. A webhook from the code host starts a review when a merge request is opened, reopened or given new commits; anyone who uses the Code Assistant can also ask for one by number. The Code Assistant’s chat model reads the diff, with secrets removed, and writes a summary and comments on bugs, security, performance, maintainability and tests. With a review token, the review is posted to the merge request. The Reviews tab lists every review.
A review comments on the change. People approve and merge it, and the change itself is never run.
Who can do what
Section titled “Who can do what”| Role | What they can do |
|---|---|
| Admin | Turn a source’s webhook on or off, replace its secret, and set or remove its review token. Everything a builder does. |
| Builder | Read reviews; Review a merge request by number; Review again. |
| Auditor | Read reviews. |
| End user, Reviewer | Cannot open the page. |
Before you start
Section titled “Before you start”- The repository belongs to a code source that has synced at least once.
- The Code Assistant has a chat model. Without one, a review reads the changes and stops at Not reviewed.
- The platform’s guardrails service is installed: every patch is scanned for secrets before it is kept.
- The code host can reach the console’s address over HTTPS. For gitlab.com, github.com and bitbucket.org, that means an address reachable from the internet; a self-managed GitLab on your network needs only a route to the console.
Turn on the webhook
Section titled “Turn on the webhook”- Open Use cases › Code Assistant and select the Codebase knowledge tab.
- In the source’s actions menu, select Merge request webhook, then Turn on.
- Copy the Address and the Secret. The secret is shown only here; if it is lost, select Replace the secret and give the new one to the host.
- Add the webhook on the host as below.
The address has the shape:
https://<console-host>/api/v1/hooks/code-sources/<source-id>GitLab
Section titled “GitLab”In each project, or in the group on GitLab Premium, open Settings › Webhooks › Add new webhook.
| Field | Value |
|---|---|
| URL | The Address |
| Secret token | The Secret. GitLab sends it as X-Gitlab-Token. |
| Trigger | Merge request events |
GitHub
Section titled “GitHub”In each repository, or in the organization, open Settings › Webhooks › Add webhook.
| Field | Value |
|---|---|
| Payload URL | The Address |
| Content type | application/json |
| Secret | The Secret. GitHub signs each delivery with it in X-Hub-Signature-256. |
| Events | Let me select individual events › Pull requests |
Bitbucket Cloud
Section titled “Bitbucket Cloud”In each repository, or in the workspace, open Repository settings › Webhooks › Add webhook.
| Field | Value |
|---|---|
| URL | The Address |
| Secret | The Secret. Bitbucket signs each delivery with it in X-Hub-Signature. |
| Triggers | Pull request › Created and Updated |
Which deliveries start a review
Section titled “Which deliveries start a review”| Host | Starts a review | Ignored |
|---|---|---|
| GitLab | open, reopen, and update with new commits |
An update without new commits; drafts |
| GitHub | opened, reopened, synchronize, ready_for_review |
Every other action; drafts |
| Bitbucket Cloud | pullrequest:created, pullrequest:updated |
Other events; drafts |
A delivery for a repository the source does not read is acknowledged and ignored. A repeated delivery for the same commit does not start a second review. A host’s test delivery (a ping) is answered 200.
Post reviews to the merge request
Section titled “Post reviews to the merge request”Without a review token, reviews stay in Olympusx AI. With one, each finished review is posted under the token’s account: comments on their lines, and a summary. The source’s own token keeps reading your code and never writes.
- In the source’s actions menu, select Review token.
- Paste a token created as below, and for Bitbucket enter the bot account’s Account email.
- Select Check and save. Olympusx AI asks the host who the token is; the dialog then reads Reviews now post as that account.
| Host | Review token |
|---|---|
| GitLab | A token on a bot user, or a project or group access token, with the api scope and at least the Reporter role. GitLab has no narrower scope that can comment, which is why it is kept apart from the token that reads your code. |
| GitHub | A fine-grained personal access token on a bot account, for these repositories, with Pull requests: Read and write and nothing else. |
| Bitbucket Cloud | An API token on a bot account with Pull requests: Write, and the account’s email. |
Remove the review token stops posting. Posted text is labelled as a reasoned review that ran nothing, and @ mentions in it are broken so a review cannot notify people. A comment that cannot be placed on its line goes into the summary.
Review a merge request by number
Section titled “Review a merge request by number”- Select the Reviews tab, then Review a merge request.
- Choose the Repository and enter the Merge request number: the number the host shows,
!12on GitLab and#12on GitHub and Bitbucket, without the!or#. - Select Review it. Olympusx AI reads the merge request as it is now, with the source’s token.
Read a review
Section titled “Read a review”The Reviews list shows each review’s Merge request, Commit, Status, Changes, Comments (with how many are on security), Asked by (The webhook or a person) and Received. The status is one of:
| Status | Meaning |
|---|---|
| Reading the changes | Olympusx AI is reading the diff from the host and scanning it for secrets. |
| Not reviewed | The changes were read but the Code Assistant has no chat model. Choose one in Settings, then Review again. |
| Reviewing | The model is reading the diff. |
| Reviewed | Done. |
| Failed | The reason is shown on the review. |
Open a review to see its Summary, its comments by file and line with category, severity and any suggested change, the Files read, and whether it was Posted to the merge request. Secrets removed from patches are counted.
Security comments
Section titled “Security comments”A security comment must say how an attacker exploits the weakness, step by step; one that cannot is dropped. Each security comment that remains is also a security finding, first found by A merge request review: Open the finding in Security goes to it.
Limits
Section titled “Limits”| Limit | Value |
|---|---|
| Patches kept per review | 1 MiB. Every changed file is listed; the last ones without their lines. |
| Diff one model call reads | About 24,000 characters |
| Calls per review | 20. A larger merge request is reviewed in part, and the summary says so. |
| Comments per call | 15 |
| Reading a merge request and scanning its diff | 10 minutes |
| A whole review | 1 hour |
| Posting a review | 2 minutes |
| One webhook delivery | 2 MiB |
| One model call | The platform’s Security model call limit; see Settings and limits |
When it does not work
Section titled “When it does not work”| Symptom | Cause and fix |
|---|---|
The host shows 401 for deliveries |
The secret on the host does not match. Replace the secret and paste the new one. |
The host shows 404 |
The webhook is off, or the address names another source. |
| The dialog says On, but nothing has come from the host yet | The host does not have the address, cannot reach it, or has the wrong events ticked. |
| Deliveries arrive but no review appears | The event was ignored: a draft, an update without new commits, or a repository the source does not read. The host’s delivery log shows the reason Olympusx AI answered. |
| Not posted: followed by a reason | The review token was refused or lacks the permission above. Set it again. |