Metadata-Version: 2.5
Name: bubo
Version: 0.28.4
Summary: Bubo — agentic AI code review for GitLab MRs and GitHub PRs, with the LLM of your choice.
License-Expression: MIT
License-File: LICENSE
Requires-Python: >=3.14
Requires-Dist: mcp<2,>=1.2.0
Requires-Dist: opentelemetry-api>=1.42.1
Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.42.1
Requires-Dist: opentelemetry-exporter-otlp-proto-http>=1.42.1
Requires-Dist: opentelemetry-sdk>=1.42.1
Description-Content-Type: text/markdown

# Bubo 🦉

[![PyPI](https://img.shields.io/pypi/v/bubo?logo=pypi&logoColor=white)](https://pypi.org/project/bubo/)
[![Python 3.14+](https://img.shields.io/badge/python-3.14%2B-3776ab?logo=python&logoColor=white)](https://github.com/mountainowl/bubo/blob/main/pyproject.toml)
[![Docker: GHCR](https://img.shields.io/badge/docker-ghcr.io-2496ED?logo=docker&logoColor=white)](https://github.com/mountainowl/bubo/pkgs/container/bubo)
[![GitHub Action](https://img.shields.io/badge/GitHub-Action-2088FF?logo=githubactions&logoColor=white)](https://mountainowl.github.io/bubo/github-action/)
[![CI](https://github.com/mountainowl/bubo/actions/workflows/ci.yml/badge.svg)](https://github.com/mountainowl/bubo/actions/workflows/ci.yml)
[![SCM adapters](https://img.shields.io/badge/SCM-adapters-2f3542)](https://mountainowl.github.io/bubo/features/)
[![OpenTelemetry](https://img.shields.io/badge/metrics-OpenTelemetry-4f62ad)](https://mountainowl.github.io/bubo/telemetry/)
[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/mountainowl/bubo?label=OpenSSF%20Scorecard)](https://scorecard.dev/viewer/?uri=github.com/mountainowl/bubo)
[![Signed with cosign](https://img.shields.io/badge/release-cosign%20signed-2bb4ab?logo=sigstore&logoColor=white)](https://github.com/mountainowl/bubo/releases)
[![SLSA 3](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev)
[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
[![Managed with uv](https://img.shields.io/badge/managed%20with-uv-2f3542)](https://github.com/astral-sh/uv)
[![Docs](https://img.shields.io/badge/docs-mountainowl.github.io%2Fbubo-4f62ad)](https://mountainowl.github.io/bubo/)
[![License: MIT](https://img.shields.io/badge/license-MIT-111827)](https://github.com/mountainowl/bubo/blob/main/LICENSE)

<img src="assets/bubo-readme-features.gif" width="960" alt="Bubo AI code review tone examples">

## Just facts • No noise • Always learning • Compliant • Auditable • Proven ROI

**[See metrics & ROI →](https://mountainowl.github.io/bubo/operate/#governance-report) · [Install Bubo →](#install)**

## Install

```sh
uv tool install bubo     # or: pipx install bubo
bubo init                # idempotent; seeds config + workspace + DB
bubo doctor              # verify before the first poll
bubo-poller service start # start the review service (polling + outcome sync)
```

Prefer a container? `docker pull ghcr.io/mountainowl/bubo` (multi-arch; the
review-agent CLI is BYO). Continue with the
[recipes and quickstart](https://mountainowl.github.io/bubo/recipes/).

## Documentation

Everything lives on the docs site — this README is just the front door.

| | |
|---|---|
| [Recipes](https://mountainowl.github.io/bubo/recipes/) | Copy-paste GitLab / GitHub / in-house-model setups. |
| [Features](https://mountainowl.github.io/bubo/features/) | The full capability list. |
| [Configuration](https://mountainowl.github.io/bubo/configuration/) | Every setting, per section, plus a quick-start config. |
| [GitHub Action](https://mountainowl.github.io/bubo/github-action/) | Run one synchronous PR review in GitHub Actions. |
| [Operate](https://mountainowl.github.io/bubo/operate/) | Deploy, run the review service, grade outcomes, governance report. |
| [Troubleshooting](https://mountainowl.github.io/bubo/troubleshooting/) | Host / infra fixes (sandbox, AppArmor). |
| [Metrics & telemetry](https://mountainowl.github.io/bubo/telemetry/) | Emitted `llm_review.*` metrics and dashboards. |

## Status

- **GitLab & GitHub posting via polling** — production path, at outcome-metric
  parity. Set `[scm].provider = "github"` (or `BUBO_PROVIDER=github`).
- **GitHub Marketplace Action** — experimental synchronous review for the PR
  that triggered a GitHub Actions workflow; start in dry-run mode.
- **MCP server (`bubo-mcp`)** — read-only metrics + triggered reviews; stdio or HTTP.
- **Codex or Claude** — Bubo runs the review through a wrapper around your agent
  CLI; Codex ships pre-wired.
- **Webhook service** — not yet; long-running deployments use polling, while
  the GitHub Action can run one review from a `pull_request` workflow.

For continuous operation, run the service beside your pipelines. Use the
Marketplace Action only when a CI-scoped review is the intended deployment.

## Security

- `config/env.toml` is gitignored and holds tokens. **Do not print or commit real values.**
- Review-agent stdout is redacted (`GITLAB_TOKEN=`, `OPENAI_API_KEY=`, `glpat-…`,
  `sk-…`, credentialed Git URLs) before it touches reports, logs, or the database.
- The reviewer subprocess runs under a strict env allowlist — host secrets aren't
  handed wholesale to the LLM agent.
- Releases are cosign-signed via Sigstore keyless OIDC, with an SBOM on every release.
- Report vulnerabilities per [SECURITY.md](SECURITY.md).

## Community

[Contributing](CONTRIBUTING.md) · [Security policy](SECURITY.md) · [Support](SUPPORT.md) · [Code of conduct](CODE_OF_CONDUCT.md) · [License: MIT](LICENSE)
