repowave-dev-tool installs statistics

RepoWave audits Python, FastAPI, GitHub Actions, and Dockerfiles on every push. It opens draft Pull Requests for fixes that are safe to apply unattended — formatting and import order — and posts a commit-comment summary for everything else.

All other autofix categories are blocked by a hardcoded safety policy you can read in the source. No source code is persisted; only metadata and findings.

What it does

Every push to your default branch triggers a static-analysis run across:

• Python — unused imports, dead functions/classes, async-safety, HTTP timeout hygiene, logging hygiene, Pydantic v1/v2 compatibility • FastAPI — route quality, response-model presence, direct-DB-access-in-route detection • GitHub Actions — action pinning, permissions hygiene, workflow syntax • Dockerfiles — root-user checks, missing healthcheck, layer hygiene

Findings surface as a commit-comment table on the SHA you pushed.

What it changes

For findings whose fixer category is allow-listed — currently formatting and import order — RepoWave opens a draft Pull Request against your default branch with one commit that applies the fix. Nothing merges automatically; you review the

diff and mark it ready for review when satisfied.

Every other fixer category (security, secrets, deployment, migration, CI permissions) is policy-blocked and surfaces as advisory commit comments only. This is enforced in core/security/autofix_policy.py.

What it never reads

A hardcoded denylist of sensitive paths — secrets/, **/.env*, Terraform files, **/auth/**, **/security/**, **/*token*, **/*credential* — that cannot be overridden by configuration or feature flags.

Privacy

No source code is persisted. The cloned commit lives in ephemeral container storage and is deleted at the end of every scan. We retain finding metadata (rule ID, severity, file path, line number, message) for 90 days. See

PRIVACY.md → Privacy Policy for the full data-handling description.

Description from the GitHub Marketplace listing.