feat(0.7.0): AI-ready risk gate — SARIF, MCP server, incremental cache - #22
Merged
Conversation
Repeated runs only re-parse files whose content changed; everything else is served from a cached surface under .ripple/cache, keeping the stable JSON contract byte-identical while large-codebase runs get faster. - buildGraphFromParsed extracted so the pipeline can reuse parsed surfaces - ts-morph project drops stale SourceFiles before re-parsing a changed file - parseSourceFile now records parseError for extractor throws too, so broken files lower confidence instead of aborting the run - discovery hard-excludes .ripple so the cache is never scanned - RIPPLE_NO_CACHE=1 forces a cold run (for benchmarks); .ripple gitignored
- ripple diff --format sarif: one finding per changed file, error for CRITICAL/HIGH, warning for MEDIUM, note for LOW; allowlisted files are emitted as note with an in-source suppression - ripple analyze --sarif: single-file finding - stable primaryLocationLineHash fingerprints for GitHub Code Scanning deduplication; gate verdict still carried by the exit code - docs: README diff/analyze flag tables + Code Scanning upload example, CHANGELOG [Unreleased] - tests: unit (level mapping, fingerprints, suppressions, stability) and integration (analyze --sarif, diff --format sarif, updated format error)
ripple mcp serves Ripple's analysis over stdio as MCP tools: - impact: blast radius of a file (affected files, routes, tests, components, risk level) - dependents: who imports a file, up to a depth - risk: score with factor breakdown - gate_status: current change set vs the merge gate, pass/block verdict Hand-rolled JSON-RPC 2.0 core (initialize, ping, tools/list, tools/call) - no new dependencies. Tool failures return isError results instead of killing the session; stdout stays strict protocol-only. Project loads lazily on first tool call and is cached for the session. docs: README MCP section with client config example, CHANGELOG [Unreleased] tests: protocol unit tests (10), tool unit tests (10), and two spawn-based integration tests exercising the real stdio server
…hmark harness - cache entries carry size+mtimeMs; unchanged files hit on stat alone (no read, no hash), stats run in parallel, and the cache is only rewritten when something changed - RIPPLE_TRACE=1 per-stage timings for pipeline/cache/graph profiling - scripts/bench.mjs: seeded synthetic layered projects (200..2000 files), cold vs warm, determinism check; BENCHMARKS.md documents methodology - eslint: node globals for scripts/*.mjs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four commits building toward the 0.7.0 launch (AI-agent tooling + performance):
1. Incremental parse cache (
5dee94d, refined inf14dea5).ripple/cache/caches parsed surfaces; unchanged files are served without re-parsing, so repeatedanalyze/graph/diff/doctorruns are byte-identical to cold runs.RIPPLE_NO_CACHE=1to disable.2. SARIF 2.1.0 output (
b511c51)ripple diff --format sarifandripple analyze --sariffor GitHub Code Scanning, with stableprimaryLocationLineHashfingerprints and allowlist entries emitted asnotewith in-source suppression.3.
ripple mcp(685e8bb)impact,dependents,risk,gate_status— lets AI agents risk-check refactors before touching code.4. Benchmarks (
f14dea5)scripts/bench.mjs: seeded synthetic layered projects (200–2000 files), cold-vs-warm, determinism check. Results inBENCHMARKS.md: ~1.2x–1.7x warm speedup, byte-identical output.RIPPLE_TRACE=1per-stage timing instrumentation.Companion repo: alimaandev/ripple-action (GitHub Action wrapping these features, tag
v1, smoke-tested on real PRs).