Catch the Bugs Your Code Review Misses - Killian Carlsen-Phelan & Taylor Luttrell-Williams, Sonar

Highlights

• AI coding agents accelerate code volume beyond human review capacity, driving up PR backlogs and production incidents due to missing architectural context.

• Guitar infers functional intent and business logic edge cases that pass static analysis like SonarQube, such as allowing a buyer to cancel a ticket after transferring it.

• Custom project rules and Markdown files placed in .guitar/review and .guitar/rules directories steer reviews against domain-specific conventions like all-in pricing policies.

• Commenting 'guitar auto apply on' and 'guitar auto merge on' directs Guitar to diagnose failing CI test logs, push new commits, and auto-merge once all status checks pass.

• Cross-repo and cross-PR analysis detect conflicts between in-flight pull requests that pass isolation tests but break production when merged together.

Timeline

1. 00:00 - 10:29

   The Verification Bottleneck in Agentic Software Development

   Developer velocity enabled by coding agents introduces more changes than fixed-size engineering teams can inspect manually. Unchecked code lacks organizational context and risks breaking production systems. Guitar complements SonarQube by evaluating change intent, differentiating flaky CI runs from real breakages, and generating context-aware fixes directly in pull request threads.

   • Rapid code generation by AI agents creates review bottlenecks and causes production incidents when changes ignore architectural standards.
   • Static code analysis detects vulnerabilities like SQL injection across files but cannot infer intent or business logic correctness.
   • Guitar acts as a verification agent that ingests PR diffs, CI logs, and repository rules to eliminate false positives and reduce token expenditure.
2. 10:30 - 22:00

   Hands-On Environment Setup and Out-of-the-Box Edge Case Detection

   Participants fork a sample concert venue ticketing API across three sequential stages to test review workflows. In the stage one PR, all standard CI test suites pass cleanly. Guitar inspects the code diff against existing logic in orders.py, discovers that order cancellation improperly revokes transferred tickets, and applies a commit patch when triggered by a 'Guitar Fix' PR comment.

   • The workshop uses a Python ticketing API repository with pre-built branches requiring all branches to be included during the GitHub fork.
   • GitHub Actions workflows must be manually enabled on the forked repository to support automated status checks and merge actions.
   • Guitar identifies an unhandled business logic flaw where refunding an original order voids a ticket already transferred to another user.
3. 22:01 - 26:39

   Enforcing Business Rules with Context Files and Trigger Rules

   Internal business policies and architectural agreements often reside in senior developers' heads or internal wikis rather than code tests. By storing documentation inside .guitar/review and defining condition-action triggers inside .guitar/rules, teams enforce domain constraints during reviews. The tool can also ingest Slack thread links pasted into PR descriptions to verify implementations against team discussions.

   • Repository context stored in the .guitar/review folder ingests Markdown documentation to steer automated PR assessments.
   • Automated rules in the .guitar/rules directory trigger custom checks when specific files or criteria match PR diffs.
   • Guitar validates changes against business requirements rather than pure syntax, flagging fee additions that violate all-in customer pricing policies.
4. 26:40 - 33:23

   Autonomous CI Failure Diagnosis and Auto-Merging Configuration

   Manual CI failure triage wastes engineering hours on repetitive cycles of log inspection, local patching, and pipeline reruns. By enabling GitHub auto-merge and specifying passing test rulesets, users grant Guitar permission to manage the fix loop. Guitar analyzes failed check-in tests, commits the necessary validation logic to prevent double ticket scans, and completes the pull request merge autonomously.

   • Configuring a GitHub branch ruleset with required status checks enables safe automated merging through Guitar.
   • Guitar parses CI error logs directly to locate test failures, such as refactored gate check-in code permitting double-scanning of tickets.
   • The commands 'guitar auto apply on' and 'guitar auto merge on' instruct Guitar to push iterative fixes autonomously until CI tests pass.
5. 33:24 - 38:05

   Advanced Capabilities: Issue Tracker Integration, Seniority-Weighted Feedback, and Multi-Repo Analysis

   Guitar integrates with task tracking systems to evaluate whether PR implementations meet written ticket specifications. Its learning system adapts suggested patch patterns using seniority-weighted feedback from human code reviewers. Multi-PR and multi-repo verification evaluate branch interactions simultaneously, preventing individual pull requests from passing isolation checks while causing breaking runtime collisions.

   • Functional validation checks PR diffs directly against linked Jira tickets, Linear issues, or Slack context to guarantee full requirement coverage.
   • The Knowledge engine updates future review behavior based on team feedback weighted by reviewer seniority.
   • Cross-PR and cross-repo analysis prevent breaking changes across multiple repositories and concurrent in-flight pull requests.