# Catch the Bugs Your Code Review Misses - Killian Carlsen-Phelan & Taylor Luttrell-Williams, Sonar

## Executive summary

This hands-on workshop introduces Gitar, a code change verification agent designed to address the challenges of reviewing code generated at high volume and velocity by AI coding agents. Gitar goes beyond traditional static analysis and simple diff reviews by analyzing Pull Requests (PRs) against multiple context sources—including project business rules, CI logs, and external tickets (Jira, Linear, Slack)—to identify subtle bugs, enforce non-code business logic, and autonomously diagnose and fix CI failures, ultimately enabling confident, automated merging.

## Key takeaways

- Catching Bugs Outside the Diff: Gitar identified a critical edge case bug (a buyer refunding a ticket after transferring it) that was not visible in the PR diff, demonstrating its ability to infer business intent and find flaws in existing application logic. (15:43)
- Enforcing Business Rules: The agent enforced a non-code business rule—that all displayed prices must be the 'all-in price'—by utilizing project-specific configurations (`.gitar/rulesdirectory`), ensuring compliance even when the code itself was technically correct. (22:07)
- CI Failure Diagnosis and Auto-Merge: Gitar autonomously diagnosed a failing CI test (e.g., 'Test ticket cannot be scanned twice'), inspected the CI logs, applied necessary fixes, and iterated until the PR passed all checks, enabling automated merging. (26:36)

## Technical details

- Gitar Functionality: Gitar is a code change verification agent that analyzes PRs using a wide body of context sources, including PR diffs, CI logs, project-specific instructions, and external tickets. It aims for a high signal-to-noise ratio by minimizing false positives. (0:39)
- Context Sources: Gitar leverages multiple context sources: PR diffs, CI logs, project-specific rules (via `.gitar/rulesdirectory`), and external integrations like Jira, Linear, and Slack. (10:30)
- Automation Workflow: The process involves setting up GitHub Actions and enabling auto-merging. Users can set the level of automation (e.g., `guitar auto apply on` and `guitar auto merge on`) to allow the agent to continuously push fixes and merge upon full verification. (26:36)
- Advanced Analysis: Advanced features include cross-repo analysis (finding PRs that break code in other repositories) and cross-PR analysis (checking multiple in-flight PRs against each other for conflicts). (33:24)

## Practical implications

- Reduces review bottlenecks by automating the diagnosis and fixing of complex bugs and CI failures.
- Ensures code integrity by verifying changes against business logic and project conventions, not just syntax.
- Allows engineering teams to ship code with confidence at 'agentic volume and agentic velocity' when using AI coding agents.

## Topics

Code Review, Continuous Integration (CI), AI Development, Software Architecture, DevOps Automation, GitHub Workshop Repo, GitGuardian Trial

Source: https://www.youtube.com/watch?v=wP3P89YB9fA