Full Repository Security Scan - Command and Tools

[satvikkk]

This PR introduces the capability for a comprehensive repository security analysis and adds specialized tools to optimize the audit workflow.

Key Changes:

• Full Repository Analysis: Added a new analyze-full command implementing a two-pass "Recon & Investigate" workflow for auditing entire codebases.
• Audit Scope Reduction: Introducing a reduce_audit_scope tool to automatically filter out irrelevant files (e.g., node_modules, build artifacts, documentation) to focus security scans on executable source code.
• Line Count Utility: Added a get_line_count tool to help estimate the scale and duration of full repo scans (threshold to inform user is adjustable).
• Tooling & MCP Server: Registered the new scope reduction and line counting utilities as MCP tools and updated the PoC execution tests to reflect improved error reporting.
• Reliability: Added unit tests for scope reduction logic and improved test environment isolation for filesystem operations.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the repository's security analysis capabilities by introducing a new command for full repository scans and specialized tools to refine the audit process. The changes aim to streamline security audits by intelligently narrowing the scope of analysis and providing better insights into scan duration, ultimately improving the efficiency and reliability of security assessments.

Highlights

• Full Repository Security Analysis Command: Introduced a new analyze-full command that implements a two-pass 'Recon & Investigate' workflow for comprehensive codebase auditing.
• Audit Scope Reduction Tool: Added a reduce_audit_scope tool to automatically filter out irrelevant files (e.g., build artifacts, documentation) and focus security scans on executable source code.
• Line Count Utility: Implemented a get_line_count tool to estimate the scale and duration of full repository scans, with an adjustable threshold to inform the user.
• MCP Server Tooling and Reliability: Registered the new scope reduction and line counting utilities as MCP tools and updated PoC execution tests to reflect improved error reporting, alongside adding unit tests for scope reduction logic and enhancing test environment isolation.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• commands/security/analyze-full.toml
  • Added a new configuration file for the analyze-full command, defining its description and a detailed prompt for a security and privacy analyst persona.
• mcp-server/package-lock.json
  • Updated package-lock.json to include new platform-specific @esbuild and @rollup dependencies, likely supporting broader compatibility for the build process.
• mcp-server/src/filesystem.test.ts
  • Modified beforeAll and afterAll hooks to use temporary directories and process.chdir for better test environment isolation.
  • Added a new test case for reduceAuditScope to verify its filtering logic.
  • Updated git add commands in tests to be more specific.
• mcp-server/src/filesystem.ts
  • Implemented reduceAuditScope function to filter files based on ignored folders, extensions, and exact file names.
  • Implemented getLineCount function to calculate the total lines of code for a given list of files.
• mcp-server/src/index.ts
  • Imported reduceAuditScope and getLineCount functions.
  • Registered reduce_audit_scope as a new MCP server tool.
  • Registered get_line_count as a new MCP server tool.
• mcp-server/src/poc.test.ts
  • Updated the expected error message format in runPoc tests to include stdout and stderr fields.

Activity

• No human activity has been recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a new analyze-full command and the necessary tooling for full-repository security scans. However, a critical issue has been identified: the reduce_audit_scope and get_line_count tools, which are essential for defining the audit scope, are not available in the default_api. This prevents the security audit from proceeding. Additionally, there are minor issues such as typos, a tool name inconsistency in the main prompt file, and a cross-platform compatibility issue in the getLineCount implementation. Please address the missing tools in default_api to enable security analysis, and then resolve the other identified issues to improve reliability and correctness.

[shrishabh]

nit: can we rename this? reduce_audit_scope inherently assumes that there is an audit scope that is being reduced.

[shrishabh]

nit: can we move these to constants file to keep things clean?