view release on metacpan or  search on metacpan

lib/CPAN/Maker/Bootstrapper.pm  view on Meta::CPAN

All new findings are LOW severity.

=item *

The LLM is re-raising findings already marked WRONG or REJECT,
possibly rephrased (LLMs can and do make mistakes!).

=item *

New findings describe edge cases that cannot occur in normal usage.

=back

When all findings have dispositions and no new substantive issues
appear, the code is ready to ship.

=head2 The Release Artifact

When you are satisfied with the review state, finalize it with
C<--finalize-annotations>:

 cmb annotate --finalize-annotations -a 1:wrong -a 2:reject lib/My/Module.pm

This applies any remaining dispositions, validates that all findings
are annotated, reads the version from the F<VERSION> file, and writes
the versioned release artifact:

 CPAN-Maker-Bootstrapper-1.1.0-REVIEW.json

This file serves as a code review certification for the release - a
machine-readable record of every finding examined, every logic
confirmation made, and every disposition applied before the version
was published. Commit it to the repository alongside your ChangeLog.

All findings marked WRONG are automatically converted to
WRONG-RECONSIDER in the release artifact, prompting careful
re-examination on the first review of the next version rather
than permanent suppression.

=head2 Cost Management

Typical review costs run $0.05-0.10 per run on a moderately sized
module with POD stripped depending on the model you choose. The
default model used for POD review is C<claude-haiku-4-5-20251001> and
C<claude-sonnet-4-6> for code review. Costs decrease over successive
rounds as the model spends fewer output tokens re-explaining
suppressed findings.

Use your own prompt profiles (C<--prompt-profile>) to suppress entire
classes of noise before they reach the annotation file. A well-tuned
profile for your application type is the highest-leverage cost
reduction available.

=head2 See Also

L</LLM Commands>, L</PROMPT PROFILES>, L<CPAN::Maker::ConfigReader>

=head1 PROMPT PROFILES

Prompt profiles are additive prompt fragments that customize the review
behavior for specific application types. They are appended to the base
review prompt before submission and are intended to focus the review on
relevant concerns while suppressing noise that does not apply to the
target context.

I<NOTE: Prompts count toward your input token count. Be succinct and
accurate.>

=head2 Using Profiles

Pass one or more profiles using the C<--prompt-profile> option:

  cmb code-review --prompt-profile cli-tool MyModule.pm

Multiple profiles may be combined:

  cmb code-review --prompt-profile cli-tool --prompt-profile security MyModule.pm

Profiles are resolved from the F<.prompts/> directory in the current
project. A profile named C<cli-tool> resolves to
F<.prompts/cli-tool.prompt>. Add your own prompt profiles and commit
them to your project.

=head3 Built-in Profiles

The following profile is installed with the distribution:

=over 4

=item cli-tool

Appropriate for single-user developer CLI tools. Suppresses security
findings that assume a multi-user or hostile environment, TOCTOU race
condition findings that assume concurrent invocation, and concerns about
C<qx{}> or C<system()> calls where input originates from the user's own
configuration. Also assumes C<perlcritic> and C<perltidy> are enforced
in the development environment.

=back

=head3 Creating Custom Profiles

A profile is a plain text file in F<.prompts/> containing additional
prompt instructions, one per line. Lines beginning with C<#> are treated
as comments and stripped before submission. Profile instructions use the
same format as the base review prompt.

Example F<.prompts/security.prompt>:

  # security profile - add to any review where input handling matters
  - Treat all caller-supplied input as untrusted regardless of source.
  - Flag any use of eval, system, or exec that incorporates external data.
  - Flag missing taint checks on data used in file or system operations.

=head3 Planned Profiles

The following profiles are planned for future releases:

=over 4