feat(desktop): inline CI check annotations across the three forges

Author: Laurent Guitton

CHANGELOG.md

@@ -5,14 +5,31 @@ All notable changes to GitWand will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [2.18.0] - 2026-06-12
+
+v2.18 brings the CI back to the code: check-run annotations now overlay the PR diff — the exact line that failed the linter or typecheck, right where you review — across all three forges. GitHub Copilot CLI also joins the AI-provider lineup.
 
 ### Added
 
+- **Inline CI check annotations** — check-run annotations are fetched per PR and anchored to the diff:
+  - **Gutter icons** (❌ failure, ⚠ warning, ℹ notice) on affected lines in the PR inline diff, with a subtle colored edge on annotated rows. Hovering shows a tooltip with the annotation title, message, and the check that produced it. Multi-line annotations flag their whole range (capped at 20 lines); when several annotations hit the same line, the worst level wins the icon.
+  - **"N annotations" badge in the CI tab** — check-runs that produced annotations show a clickable badge that jumps straight to the diff.
+  - **Per-file ⚠ count in the diff file sidebar** — spot which files the CI flagged before opening them.
+  - **All three forges**: GitHub (check-runs annotations API), GitLab (`artifacts:reports:codequality` — Code Climate severities mapped to failure/warning/notice), Bitbucket (Reports API annotations). Everything is non-fatal: a repo with no checks, an expired report, or a forge with nothing to offer simply shows no annotations.
+  - **Lazy by design** — annotations are fetched once per PR, the first time the Diff or CI tab is opened; never during PR-list browsing.
 - **GitHub Copilot CLI as an AI provider** — `copilot-cli` joins `claude-code-cli`, `codex-cli`, and `opencode-cli` in the `AIProvider` union. It piggybacks on the user's locally-installed `copilot` binary and their GitHub Copilot subscription — no API key required. Detection mirrors the existing CLI providers (binary discovery across PATH + common install locations) and it appears in Settings → AI with the same status/re-detect pattern. Prompts run one-shot via `copilot -p` (model selectable via the per-provider model picker, free-text since Copilot has no enumeration command). Tool permissions are deliberately restricted (`--deny-tool=shell`, `--deny-tool=write`, `--no-ask-user`, and `COPILOT_ALLOW_ALL` stripped from the child env) so Copilot only produces text and cannot edit files, run shell commands, or block on interactive prompts.
 
+### Changed
+
+- **Sidebar quick actions trimmed** — the Changes and History quick actions were removed from the repo sidebar (#39); both remain reachable from their primary surfaces (commit area, Git Tree).
+
 ### Technical
 
+- New forge-agnostic type `CIAnnotation { check_name, path, start_line, end_line, level, title, message }` (`types.rs`, mirrored as camelCase in `backend-pr.ts` with a shared `mapAnnotation` normalizer — unknown levels degrade to `notice`).
+- Three new Rust commands following the per-forge pattern: `gh_check_annotations` (head SHA → `commits/{sha}/check-runs` → `check-runs/{id}/annotations`, capped at 20 annotated runs), `gl_mr_annotations` (MR pipelines → jobs with a `codequality` artifact → `gl-code-quality-report.json`), `bb_pr_annotations` (commit Reports → per-report annotations). Registered in `lib.rs`; GitHub path mirrored in `dev-server.mjs` (`/api/gh-check-annotations`); TS wrappers in `backend-pr.ts` / `backend-gitlab.ts` / `backend-bitbucket.ts`.
+- `ForgeProvider.getCheckAnnotations()` added to the forge contract and implemented by the three providers. `usePrPanel` gains `prAnnotations` (lazy, one flight per PR), `annotationCountByCheck`, and `annotationsByFile`.
+- Gutter rendering in `PrInlineDiff` is anchored on `newLineNo` (annotations target the head commit); CSS-only hover tooltip, no new dependency.
+- i18n: `pr.annotations.{badge,badgeTooltip}` across all five locales; unit tests in `v2.18-ci-annotations.test.ts`.
 - New Rust commands `detect_copilot_cli` and `copilot_cli_prompt` (`copilot --no-color --deny-tool=shell --deny-tool=write --no-ask-user [--model …] -p <prompt>`), plus a `CopilotCliInfo` type; registered in `lib.rs`. Mirrored across all three layers: `commands/ai.rs`, `dev-server.mjs`, and the `backend-ai.ts` wrapper.
 - `useAIProvider` adds `copilot-cli` to `CLI_AGENT_PROVIDERS`, dispatches it in `suggest()` / `rawPrompt()`, and forwards the per-provider model. `SettingsPanel` gains the provider option, detection state, and status block.
 - i18n: `aiProviderCopilotCli`, `aiProviderCopilotCliNotFound`, `aiCopilotCliDetectedHint`, `aiCopilotCliInfoBox` across all five locales (en, fr, es, pt-BR, zh-CN).
@@ -984,7 +1001,11 @@ Design-system foundations — the app header and every overlay now ride on a sha
 - CI pipeline via GitHub Actions (Node 18, 20, 22)
 - 28 tests covering all patterns + real-world scenarios (package.json, Laravel routes, Vue SFC, CSS, .env files)
 
-[Unreleased]: https://github.com/devlint/GitWand/compare/v2.15.0...HEAD
+[Unreleased]: https://github.com/devlint/GitWand/compare/v2.18.0...HEAD
+[2.18.0]: https://github.com/devlint/GitWand/compare/v2.17.0...v2.18.0
+[2.17.0]: https://github.com/devlint/GitWand/compare/v2.16.0...v2.17.0
+[2.16.0]: https://github.com/devlint/GitWand/compare/v2.15.1...v2.16.0
+[2.15.1]: https://github.com/devlint/GitWand/compare/v2.15.0...v2.15.1
 [2.15.0]: https://github.com/devlint/GitWand/compare/v2.14.0...v2.15.0
 [2.14.0]: https://github.com/devlint/GitWand/compare/v2.13.0...v2.14.0
 [2.13.0]: https://github.com/devlint/GitWand/compare/v2.12.0...v2.13.0

ROADMAP.md

@@ -6,25 +6,6 @@
 
 ## What's Next
 
-### v2.18.0 — Inline CI Check Annotations
-
-Overlay check-run annotations in the diff — the exact line that failed the linter or typecheck, right where you need it in the review.
-
-**Backend**
-
-- GitHub: `GET /repos/{owner}/{repo}/check-runs/{check_run_id}/annotations`
-- GitLab: pipeline job trace + `artifacts:reports:codequality` (common JSON format)
-- Bitbucket: `/commit/{commit}/statuses` enriched with Pipelines annotations
-- New type `CIAnnotation { path, line, level: "failure"|"warning"|"notice", title, message }`
-
-**UI — DiffViewer**
-
-- Gutter icons (❌ failure, ⚠ warning, ℹ notice) on affected lines
-- On hover: tooltip with `title` + `message` — same pattern as inline comments
-- In the CI tab: check-runs with annotations show a clickable "N annotations" badge
-
----
-
 ### v2.19.0 — Scratch worktree + extended Conflict Predictor
 
 _Inspired by GitSquid. A natural extension of the GitWand engine and Worktree first-class (v2.7)._
@@ -153,6 +134,7 @@ Positioning: neither "yet another Git GUI" nor an IDE. A first-class Git navigat
 
 | Version | Highlights |
 |---------|-----------|
+| **v2.18.0** | Inline CI Check Annotations — check-run annotations overlaid in the PR diff across the three forges (GitHub check-runs API, GitLab `artifacts:reports:codequality`, Bitbucket Reports API), gutter icons ❌/⚠/ℹ with hover tooltip, clickable "N annotations" badge in the CI tab, per-file ⚠ count in the diff sidebar, forge-agnostic `CIAnnotation` type + `ForgeProvider.getCheckAnnotations()`, lazy one-shot fetch per PR; Copilot CLI as a fourth AI provider (text-only sandbox) |
 | **v2.17.0** | opencode provider + per-CLI model picker — `opencode-cli` as a first-class AI provider (`opencode run`, binary discovery, Settings status), second model select under the provider picker for the three CLI agents (opencode enumerates via `opencode models`, Claude Code aliases, Codex free-text), `aiModelByProvider` persisted per provider, `--model` threaded through all three CLIs |
 | **v2.16.0** | PR Activity Notifications — background Launchpad poller, zero-network snapshot diff (`useLaunchpadNotifications`) for CI flips / review requests / new comments / merge-close, native OS notifications via `tauri-plugin-notification` (background-only), Settings granularity (All · Reviews & comments · CI failures only · None) + "by people" bot filter, enriched `workspace_prs_all` (CI/review/comment fields) |
 | **v2.15.1** | Git Tree polish & quick actions — Force push (branch context menu + protected-trunk/diverged-remote guard), Quick Stash `⌘⇧,` (instant, AI label) + pending badge in the commit area, Submodules in the Git Tree (branch-picker section, per-commit pointed-SHA badge, click-to-navigate) |

apps/desktop/dev-server.mjs

@@ -2535,6 +2535,53 @@ async function handleRequest(req, res) {
       }
     }
 
+    // GET /api/gh-check-annotations?cwd=<path>&number=<n>  (v2.18)
+    if (url.pathname === "/api/gh-check-annotations" && req.method === "GET") {
+      const cwd = url.searchParams.get("cwd");
+      const number = url.searchParams.get("number");
+      if (!cwd || !number) return jsonResponse(req, res, { error: "Missing cwd or number" }, 400);
+      try {
+        const token = getGithubToken();
+        if (!token) return jsonResponse(req, res, { error: "No GitHub token" }, 401);
+        const nwo = getRepoNwo(resolve(cwd));
+        if (!nwo) return jsonResponse(req, res, { error: "Could not determine GitHub repo" }, 400);
+        // PR head SHA
+        const prResp = await githubFetch(`/repos/${nwo}/pulls/${number}`, token);
+        if (!prResp.ok) return jsonResponse(req, res, { error: `GitHub API ${prResp.status}` }, 500);
+        const pr = await prResp.json();
+        const sha = pr.head?.sha;
+        if (!sha) return jsonResponse(req, res, []);
+        // Check runs with annotation counts
+        const checksResp = await githubFetch(`/repos/${nwo}/commits/${sha}/check-runs?per_page=100`, token);
+        if (!checksResp.ok) return jsonResponse(req, res, { error: `GitHub API ${checksResp.status}` }, 500);
+        const data = await checksResp.json();
+        const annotated = (data.check_runs ?? [])
+          .filter((c) => (c.output?.annotations_count ?? 0) > 0)
+          .slice(0, 20); // mirror the Rust MAX_ANNOTATED_RUNS cap
+        const annotations = [];
+        for (const run of annotated) {
+          const annResp = await githubFetch(`/repos/${nwo}/check-runs/${run.id}/annotations?per_page=100`, token);
+          if (!annResp.ok) continue; // annotations expired — skip run
+          const items = await annResp.json();
+          for (const a of items ?? []) {
+            annotations.push({
+              check_name: run.name ?? "",
+              path: a.path ?? "",
+              start_line: a.start_line ?? 0,
+              end_line: Math.max(a.end_line ?? 0, a.start_line ?? 0),
+              level: a.annotation_level === "failure" || a.annotation_level === "warning"
+                ? a.annotation_level : "notice",
+              title: a.title ?? "",
+              message: a.message ?? "",
+            });
+          }
+        }
+        return jsonResponse(req, res, annotations);
+      } catch (err) {
+        return jsonResponse(req, res, { error: err.stderr?.toString() || err.message }, 500);
+      }
+    }
+
     // ─── PR Review Comments ────────────────────────────────
 
     // GET /api/gh-pr-comments?cwd=<path>&number=<n>
@@ -4731,6 +4778,7 @@ server.listen(PORT, "127.0.0.1", () => {
   console.log(`    GET  /api/gh-pr-detail?cwd=<path>&number=<n>`);
   console.log(`    GET  /api/gh-pr-diff?cwd=<path>&number=<n>`);
   console.log(`    GET  /api/gh-pr-checks?cwd=<path>&number=<n>`);
+  console.log(`    GET  /api/gh-check-annotations?cwd=<path>&number=<n>`);
   console.log(`    GET  /api/pr-files?repo=<path>&pr=<n>`);
   console.log(`    GET  /api/git-remote-info?cwd=<path>`);
   console.log(`    GET  /api/git-merge-base?cwd=<path>&ref1=<ref>&ref2=<ref>`);

apps/desktop/src-tauri/src/commands/bitbucket.rs

@@ -908,6 +908,95 @@ pub(crate) fn bb_pr_ci_checks(cwd: String, pr_id: i64) -> Result<Vec<CICheck>, S
     Ok(checks)
 }
 
+/// Get report annotations for a PR (v2.18 — Inline CI Check Annotations).
+///
+/// Uses the Bitbucket Reports API:
+///   1. PR → head commit SHA
+///   2. `GET /commit/{sha}/reports` → reports created by Pipelines / linters
+///   3. `GET /commit/{sha}/reports/{id}/annotations` per report
+///
+/// Severity mapping: CRITICAL|HIGH → failure, MEDIUM → warning, LOW → notice.
+/// Non-fatal everywhere: no reports → `[]`.
+#[tauri::command]
+pub(crate) fn bb_pr_annotations(cwd: String, pr_id: i64) -> Result<Vec<CIAnnotation>, String> {
+    let (workspace, slug) = parse_workspace_slug(&cwd)?;
+    let (username, app_password) = get_bb_creds(&cwd)?;
+    let auth = basic_auth_header(&username, &app_password);
+
+    // 1. Head commit SHA.
+    let pr_url = format!("{}/pullrequests/{}", repo_api(&workspace, &slug), pr_id);
+    let pr = bb_curl("GET", &pr_url, None, &auth)?;
+    let head_sha = jdeep(&pr, "source", "commit", "hash");
+    if head_sha.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    // 2. Reports on that commit.
+    let reports_url = format!(
+        "{}/commit/{}/reports?pagelen=20",
+        repo_api(&workspace, &slug),
+        head_sha
+    );
+    let resp = bb_curl("GET", &reports_url, None, &auth).unwrap_or(serde_json::Value::Null);
+    let reports = resp
+        .get("values")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default();
+
+    // 3. Annotations per report.
+    let mut annotations = Vec::new();
+    for report in &reports {
+        let report_id = js(report, "uuid");
+        if report_id.is_empty() {
+            continue;
+        }
+        let report_title = js(report, "title");
+        let ann_url = format!(
+            "{}/commit/{}/reports/{}/annotations?pagelen=100",
+            repo_api(&workspace, &slug),
+            head_sha,
+            report_id
+        );
+        let resp = match bb_curl("GET", &ann_url, None, &auth) {
+            Ok(v) => v,
+            Err(_) => continue,
+        };
+        let values = resp
+            .get("values")
+            .and_then(|v| v.as_array())
+            .cloned()
+            .unwrap_or_default();
+
+        for a in &values {
+            let path = js(a, "path");
+            let line = ji(a, "line");
+            if path.is_empty() || line == 0 {
+                continue; // commit-level annotation — nothing to anchor in the diff
+            }
+            let level = match js(a, "severity").as_str() {
+                "CRITICAL" | "HIGH" => "failure",
+                "MEDIUM" => "warning",
+                _ => "notice", // LOW + unknown
+            };
+            annotations.push(CIAnnotation {
+                check_name: report_title.clone(),
+                path,
+                start_line: line,
+                end_line: line,
+                level: level.to_string(),
+                title: js(a, "summary"),
+                message: {
+                    let d = js(a, "details");
+                    if d.is_empty() { js(a, "summary") } else { d }
+                },
+            });
+        }
+    }
+
+    Ok(annotations)
+}
+
 /// Convert a "Draft: …" Bitbucket PR to ready-for-review by stripping the prefix.
 ///
 /// Bitbucket has no native draft concept — the convention is a "Draft: " title

apps/desktop/src-tauri/src/commands/gh.rs

@@ -519,3 +519,115 @@ pub(crate) fn gh_pr_checks(cwd: String, number: i64) -> Result<Vec<CICheck>, Str
 
     Ok(checks)
 }
+
+/// Get check-run annotations for a PR (v2.18 — Inline CI Check Annotations).
+///
+/// Flow:
+///   1. `gh pr view --json headRefOid` → head commit SHA
+///   2. `gh api repos/{owner}/{repo}/commits/{sha}/check-runs` → runs with
+///      `output.annotations_count` (gh resolves `{owner}/{repo}` from cwd)
+///   3. For each run with annotations: `gh api .../check-runs/{id}/annotations`
+///
+/// Non-fatal everywhere: a repo without checks/annotations returns `[]`.
+#[tauri::command]
+pub(crate) fn gh_check_annotations(cwd: String, number: i64) -> Result<Vec<CIAnnotation>, String> {
+    // 1. Head SHA of the PR.
+    let output = hidden_cmd("gh")
+        .args(["pr", "view", &number.to_string(), "--json", "headRefOid"])
+        .current_dir(&cwd)
+        .output()
+        .map_err(|e| format!("gh pr view: {}", e))?;
+    if !output.status.success() {
+        return Ok(Vec::new());
+    }
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let sha = match extract_json_string(stdout.trim(), "headRefOid") {
+        Some(s) if !s.is_empty() => s,
+        _ => return Ok(Vec::new()),
+    };
+
+    // 2. Check-runs for that commit (id + annotations_count).
+    let output = hidden_cmd("gh")
+        .args([
+            "api",
+            &format!("repos/{{owner}}/{{repo}}/commits/{}/check-runs?per_page=100", sha),
+        ])
+        .current_dir(&cwd)
+        .output()
+        .map_err(|e| format!("gh api check-runs: {}", e))?;
+    if !output.status.success() {
+        return Ok(Vec::new());
+    }
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let parsed: serde_json::Value =
+        serde_json::from_str(stdout.trim()).unwrap_or(serde_json::Value::Null);
+    let runs = parsed
+        .get("check_runs")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default();
+
+    // 3. Fetch annotations for runs that have any. Cap the number of runs
+    //    queried so a pathological CI setup can't fan out dozens of API calls.
+    const MAX_ANNOTATED_RUNS: usize = 20;
+    let mut annotations = Vec::new();
+    for run in runs
+        .iter()
+        .filter(|r| {
+            r.get("output")
+                .and_then(|o| o.get("annotations_count"))
+                .and_then(|c| c.as_i64())
+                .unwrap_or(0)
+                > 0
+        })
+        .take(MAX_ANNOTATED_RUNS)
+    {
+        let run_id = match run.get("id").and_then(|v| v.as_i64()) {
+            Some(id) => id,
+            None => continue,
+        };
+        let check_name = run
+            .get("name")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string();
+
+        let output = hidden_cmd("gh")
+            .args([
+                "api",
+                &format!("repos/{{owner}}/{{repo}}/check-runs/{}/annotations?per_page=100", run_id),
+            ])
+            .current_dir(&cwd)
+            .output();
+        let output = match output {
+            Ok(o) if o.status.success() => o,
+            _ => continue, // annotations gone (e.g. expired) — skip this run
+        };
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        let arr: serde_json::Value =
+            serde_json::from_str(stdout.trim()).unwrap_or(serde_json::Value::Array(vec![]));
+        let Some(items) = arr.as_array() else { continue };
+
+        for a in items {
+            let s = |k: &str| a.get(k).and_then(|v| v.as_str()).unwrap_or("").to_string();
+            let n = |k: &str| a.get(k).and_then(|v| v.as_i64()).unwrap_or(0);
+            // GitHub levels are already our canonical set.
+            let level = match s("annotation_level").as_str() {
+                "failure" => "failure",
+                "warning" => "warning",
+                _ => "notice",
+            };
+            annotations.push(CIAnnotation {
+                check_name: check_name.clone(),
+                path: s("path"),
+                start_line: n("start_line"),
+                end_line: n("end_line").max(n("start_line")),
+                level: level.to_string(),
+                title: s("title"),
+                message: s("message"),
+            });
+        }
+    }
+
+    Ok(annotations)
+}