fix(review-agent): fetch private GitHub PR diffs via API

[BashOpsDev]

Summary

Fixes #1277.

The Review Agent currently fetches pull request diffs using the diff_url returned by GitHub. For private repositories, this URL can return 404 Not Found even when the GitHub App token has permission to access the pull request through the GitHub API.

This change updates githubPrParser to fetch diffs through the GitHub Pull Requests API using the application/vnd.github.diff accept header. This allows authenticated access to PR diffs in private repositories.

Changes

• Replace direct requests to pullRequest.diff_url
• Fetch PR diffs using GET /repos/{owner}/{repo}/pulls/{pull_number}
• Request diff content via application/vnd.github.diff
• Update tests to verify API-based diff fetching

Testing

cd packages/web
yarn vitest githubPrParser

Result:

• Test Files: 1 passed
• Tests: 9 passed

Summary by CodeRabbit

• Bug Fixes
  • Improved pull request diff retrieval to use the official GitHub Pulls API endpoint and the correct diff Accept header, rather than relying on the pull request’s direct diff URL.
  • Updated the related test to assert the new API request behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d27d1deb-933d-42df-989a-4d0ab3bdcf45

📥 Commits

Reviewing files that changed from the base of the PR and between 0f2efb5 and a43e11b.

📒 Files selected for processing (1)

• packages/web/src/features/agents/review-agent/nodes/githubPrParser.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/web/src/features/agents/review-agent/nodes/githubPrParser.ts

---

Walkthrough

githubPrParser is changed to fetch the PR diff via an authenticated Octokit request (GET /repos/{owner}/{repo}/pulls/{pull_number}) with accept: application/vnd.github.diff, replacing the previous direct request to pullRequest.diff_url. The test is updated to assert this new call signature.

Changes

Authenticated PR diff fetching via Octokit Pulls API

Layer / File(s)	Summary
Diff fetch implementation and test packages/web/src/features/agents/review-agent/nodes/githubPrParser.ts, packages/web/src/features/agents/review-agent/nodes/githubPrParser.test.ts	githubPrParser now derives owner and repo from pullRequest.base.repo and calls the GitHub Pulls API endpoint with accept: application/vnd.github.diff, parsing the response as a string. The direct diff_url request is removed. The test replaces the diff_url assertion with a check that the Octokit mock receives owner, repo, pull_number, and the correct accept header.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: fetching private GitHub PR diffs via API instead of using the diff_url approach.
Linked Issues check	✅ Passed	The code changes directly address issue #1277 by implementing API-based diff fetching for private repositories using the GitHub Pull Requests endpoint with proper authentication.
Out of Scope Changes check	✅ Passed	All changes are scoped to fixing diff fetching for private repositories by modifying githubPrParser implementation and its tests, with no extraneous modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/web/src/features/agents/review-agent/nodes/githubPrParser.ts`:
- Around line 15-20: The local variable `pull_number` violates
TypeScript/JavaScript naming conventions which require camelCase for
identifiers. Rename the local variable from `pull_number` to `pullNumber` on the
line where it is assigned from `pullRequest.number`. Then in the octokit.request
call, update the parameter mapping to use `pull_number: pullNumber` to keep the
API field name in snake_case while the local variable follows camelCase
conventions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 963e0c7a-35ed-491d-b985-0d8e52b18c72

📥 Commits

Reviewing files that changed from the base of the PR and between 26435a4 and 0f2efb5.

📒 Files selected for processing (2)

• packages/web/src/features/agents/review-agent/nodes/githubPrParser.test.ts
• packages/web/src/features/agents/review-agent/nodes/githubPrParser.ts