June Security AI (Beta) — Multi-LLM Pull Request Code Reviewer

June Security AI is an extensible and professional task extension for Azure Pipelines designed to perform automated, actionable code reviews on Pull Requests. It detects, explains and hands you a ready-to-use prompt to fix each finding with your AI coding agent, with no risk of half-applied changes. Built with Clean Architecture, SOLID principles, and the Strategy Design Pattern, it enables development teams to plug in any state-of-the-art AI model using simple API keys.

✨ Key Features

• 🤖 Multi-LLM AI Strategy: Natively supports Requesty AI Gateway, Google Gemini, OpenAI, Anthropic Claude, Azure OpenAI Service, and OpenAI-compatible endpoints (DeepSeek, Groq, Ollama, vLLM).
• 🤖 Prompt for your AI Coding Agent: Every comment includes a ready-to-paste prompt for Copilot, Claude Code, Cursor or any coding agent. The agent sees the whole repository, applies the complete change and the developer tests it before pushing. Built from a template, so it costs no AI tokens.
• 📋 Coordinated Changes: When a fix spans several files, a single thread lists every place that must change together. The extension never applies changes with one click, so fixes are never left half done.
• 🎯 Verified Locations: The AI quotes the exact code and the task finds it in the diff to comment on the right line; findings that cannot be placed go to the summary, never to a wrong line.
• 🔐 Secrets Never Reach the AI: Secret-looking values are redacted before the diff is sent, and each secret on an added line becomes a CRITICAL finding independent of the AI.
• 🛡️ Prompt-Injection Defense: The diff is treated as untrusted data, conventions are read from the target branch, and a deterministic detector flags text aimed at the AI reviewer.
• 🧷 No Duplicate Comments: Each run recognizes its own threads, does not repeat comments on the same line and updates the existing summary.
• ⚠️ Visible Coverage: If the diff exceeds the size limit, the summary lists the files the AI did not review and the task ends with a warning.
• 📊 Executive Summary Table (publishSummary): Posts an executive summary comment directly to the Pull Request overview conversation with severity metrics (Critical 🔴, High 🟡, Medium 🔵) and Quality Gate status.
• 🛡️ Glob-based Noise Filtering (excludePatterns): Automatically excludes auto-generated code, package lockfiles, minified bundles, migrations, and build outputs from git diffs, saving tokens and eliminating noisy comments.
• 🚦 Quality Gate & Thresholds (minSeverity, failOnViolations): Configure the minimum severity to report (CRITICA, ALTA, MEDIA) and enforce automated pipeline blocks for critical/high security flaws.
• 🛑 Anti-Spam Throttling (maxComments): Limits the number of published inline PR comments, prioritizing the highest-severity findings first.
• 📝 Ad-Hoc Rule Injection (customRules): Inject immediate project or architectural rules on the fly directly in the pipeline YAML without creating or committing repo files.
• 🌐 Native Bilingual Output (es / en): Delivers complete review findings, didactic guidance, and actionable recommendations in either Spanish or English.
• 🏷️ Customizable Bot Identity: Customize the bot's display name header (e.g. June Security AI, SecOps Bot, Architecture Sentinel).
• 📚 Smart Conventions Detection & Universal Fallback: Reads repository rule files (AGENTS.md, docs/conventions.md) from the target branch of the Pull Request. If none are present, it dynamically applies industry-standard best practices (SOLID, OWASP Top 10, Clean Code, Concurrency).

🚀 Supported AI Engines

🛠️ Practical YAML Pipeline Examples by AI Provider

Ensure your pipeline checkout includes fetchDepth: 0 (so Git can calculate the Pull Request diff) and passes SYSTEM_ACCESSTOKEN: $(System.AccessToken).

1️⃣ Requesty AI Gateway (Recommended for Teams)

Unified access to Anthropic Claude, OpenAI, and Google models using a single router API key:

trigger: none
pr:
  branches:
    include:
      - main
      - develop

pool:
  vmImage: 'ubuntu-latest'

steps:
  # 1. Full checkout to enable git diff against target branch
  - checkout: self
    fetchDepth: 0
    persistCredentials: true

  # 2. Automated AI Code Review
  - task: JuneSecurityAi@0
    displayName: 'June Security AI (via Requesty)'
    inputs:
      agentName: 'June Security AI'
      language: 'en'
      reviewerSkills: 'Clean Architecture, .NET 10, Angular 21, SQL Server, DevSecOps'
      conventionsFiles: 'AGENTS.md, docs/conventions.md'
      aiProvider: 'Requesty'
      apiKey: $(REQUESTY_API_KEY)
      aiModel: 'anthropic/claude-opus-5-5' # or 'google/gemini-2.0-flash', 'openai/gpt-4o'
      failOnViolations: false
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

2️⃣ Google Gemini (Direct Connection)

Connects directly to Google AI Studio with automatic retry with gemini-3.8-flash and then gemini-2.5-flash (older accounts only) when the requested model does not exist (404):

- task: JuneSecurityAi@0
  displayName: 'June Security AI (Google Gemini)'
  inputs:
    agentName: 'SecOps Sentinel'
    language: 'en'
    reviewerSkills: 'Clean Architecture, .NET 10, Angular 21, SQL Server'
    conventionsFiles: 'AGENTS.md, docs/conventions.md'
    aiProvider: 'GoogleGemini'
    apiKey: $(GEMINI_API_KEY)
    aiModel: 'gemini-3.8-flash'
    failOnViolations: false
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

3️⃣ OpenAI Official (gpt-4o-mini or gpt-4o)

Direct connection to the official OpenAI API:

- task: JuneSecurityAi@0
  displayName: 'June Security AI (OpenAI)'
  inputs:
    agentName: 'OpenAI Code Reviewer'
    language: 'en'
    reviewerSkills: 'Clean Code, Microservices, TypeScript, Node.js, OWASP'
    conventionsFiles: 'AGENTS.md, docs/conventions.md'
    aiProvider: 'OpenAI'
    apiKey: $(OPENAI_API_KEY)
    aiModel: 'gpt-4o-mini'
    failOnViolations: false
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

4️⃣ Anthropic Claude (Direct API)

Direct connection to the Anthropic Messages API (api.anthropic.com) for top-tier architectural feedback:

- task: JuneSecurityAi@0
  displayName: 'June Security AI (Anthropic Claude)'
  inputs:
    agentName: 'Claude Architect'
    language: 'en'
    reviewerSkills: 'Domain-Driven Design, TypeScript, React, Python'
    conventionsFiles: 'AGENTS.md, docs/conventions.md'
    aiProvider: 'AnthropicClaude'
    apiKey: $(ANTHROPIC_API_KEY)
    aiModel: 'claude-opus-5-5'
    failOnViolations: false
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

5️⃣ Azure OpenAI Service (Enterprise Private Tenants)

For regulated enterprises requiring private traffic routing within their Microsoft Azure tenant:

- task: JuneSecurityAi@0
  displayName: 'June Security AI (Corporate Azure OpenAI)'
  inputs:
    agentName: 'Enterprise Security AI'
    language: 'en'
    reviewerSkills: 'Clean Architecture, .NET, Angular, SQL Server'
    conventionsFiles: 'AGENTS.md, docs/conventions.md'
    aiProvider: 'AzureOpenAI'
    apiKey: $(AZURE_OPENAI_KEY)
    customEndpoint: 'https://my-company-openai.openai.azure.com'
    azureDeployment: 'gpt-4o-deployment'
    failOnViolations: false
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

6️⃣ Custom / DeepSeek / Ollama (OpenAI-Compatible)

Compatible with DeepSeek, Groq, or local self-hosted open-source models using Ollama or vLLM:

- task: JuneSecurityAi@0
  displayName: 'June Security AI (DeepSeek)'
  inputs:
    agentName: 'DeepSeek Reviewer'
    language: 'en'
    reviewerSkills: 'Clean Code, Unit Testing, Concurrency, Go, C#'
    conventionsFiles: 'AGENTS.md, docs/conventions.md'
    aiProvider: 'Custom'
    customEndpoint: 'https://api.deepseek.com/v1'
    apiKey: $(DEEPSEEK_API_KEY)
    aiModel: 'deepseek-chat'
    failOnViolations: false
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

⚙️ Task Inputs Reference

1. Bot Identity & Localization (botIdentity)

2. AI Engine Configuration (aiEngine)

3. Governance, Rules & Code Filtering (governance)

4. Quality Gate & Pull Request Policies (qualityGate)

🔒 Azure DevOps Permissions & Repository Setup Guide

To ensure smooth automated Pull Request reviews without permission issues (403 Forbidden / 401 Unauthorized), follow these essential Azure DevOps configuration steps:

1. Repository Permissions (Mandatory)

By default, the Azure DevOps Build Service identity might lack permissions to publish PR comments:

1. Navigate to Project Settings ➔ Repositories ➔ Select your repository.
2. Open the Security tab.
3. In the Users list, select Project Collection Build Service (<YourOrg>) (or <ProjectName> Build Service).
4. Set the following permissions to Allow:
   • ✅ Contribute to pull requests (Required to post and update review comments).
   • ✅ Contribute
   • ✅ Read

2. Automatic Trigger via Branch Policies (Build Validation)

To automatically trigger the AI review whenever a developer creates or updates a Pull Request:

1. Go to Project Settings ➔ Repositories ➔ Policies tab.
2. Select your protected target branch (e.g. main or develop).
3. Under Build Validation, click + (Add build policy).
4. Select your review pipeline YAML and set Trigger: Automatic.
5. (Recommended) Under Comment resolution, set Check for comment resolution: Required to enforce that all critical bot comments must be resolved before merging.

3. Pipeline YAML Prerequisites

Always specify fetchDepth: 0 in checkout (so git can compute the diff against the target branch) and pass SYSTEM_ACCESSTOKEN: $(System.AccessToken) in the task's environment block.

👤 Author & License

• Author: Nelson Valverde La Torre
• License: MIT License