Combo Draft: CI/CD Quality Gate (swe-rex + deepcode + code-review-graph)

Scenario

Quality-gate chain = sandboxed safe execution (swe-rex, run code without fear of breaking the environment) + static analysis (deepcode, catch problems before commit) + review graph (crg, build a code association graph for review). Covers runtime / analyzer / graph capability classes; write surfaces don't overlap (3/3 pairs verified). Users usually get stuck on "the sandbox needs Docker, the analyzer needs a provider, will three pip packages conflict" — this combo answers that.

Combo members

swe-rex: sandbox execution server (heavy piece)

Download: official PyPI (package swe-rex); China must use the Tsinghua mirror (official PyPI direct connection times out)
Version: [1.4.0, 1.4.0] (manifest locked; Python >= 3.10; release v1.4.0 has no separate assets, distribution via PyPI)
Install:

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple swe-rex==1.4.0
swerex-remote --help   # expected output: usage: swerex-remote [-h] [--host HOST] [--port PORT] --auth-token AUTH_TOKEN

note: real sandbox execution depends on Docker; sandbox execution not measured in this environment (no Docker execution sandbox), CLI layer measured passing.

deepcode: static analysis (heavy piece)

Download: official PyPI (package deepcode-hku); China recommends the Tsinghua mirror (official PyPI borderline at 16s and prone to timeout, measured 40.3s full dependency install)
Version: [2.1.0, 2.1.0] (manifest locked; Python >= 3.12)
Install:

pip install deepcode-hku --index-url https://pypi.tuna.tsinghua.edu.cn/simple
deepcode --version   # expected output: DeepCode 2.1.0

note: running tasks needs deepcode init + deepcode provider set <vendor> --api-key <key> first (LLM provider config; local providers don't need a cloud key).

code-review-graph (crg): review graph (light piece)

Download: official PyPI (package code-review-graph, ==2.3.8); China must use the Tsinghua mirror (official PyPI direct connection times out)
Version: [2.3.8, 2.3.8] (manifest locked; Python >= 3.10)
Install:

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple code-review-graph==2.3.8
code-review-graph --version   # expected output: code-review-graph 2.3.8

note: this combo only uses the CLI surface (build/status); code-review-graph install registration subcommand (writes ~/.claude.json etc.) is outside this combo's scope.

Install order

swe-rex first (sandbox server base) — after pip install only verify the CLI surface (swerex-remote --help), don't start the server.
Then deepcode (analyzer) — co-install with swe-rex in the same venv measured compatible (coexist-deepcode evidence).
Finally crg (graph) — all three co-installed in the same venv measured compatible; any order works, but install semantically as "base → analyzer → graph"; conflict checks also have hints on the install.sh side (inferred pairs).

Dependency warnings

Conflicts: swe-rex×deepcode compatible (verified 2026-08-28, co-install measured with dual smoke exit 0, no write-surface overlap); crg×deepcode compatible (verified); crg×swe-rex compatible (verified) — 3/3 pairs verified, source: site docs. Unmeasured surface: crg's MCP registration surface (Claude plugin form, not logged in on this machine) and combos with the Claude ecosystem entries; the matrix stays at possible-conflict inferred state.
Versions: swe-rex [1.4.0,1.4.0]; deepcode [2.1.0,2.1.0] (Python >= 3.12, note this is stricter than swe-rex/crg's 3.10); crg [2.3.8,2.3.8].
Environment: swe-rex sandbox execution needs Docker (not measured); deepcode analysis needs LLM provider config; crg build writes workspace .code-review-graph/; the three don't occupy fixed ports at CLI level (swe-rex takes --port as needed).
China network: pip three-piece via Tsinghua mirror; the most likely sticking point = deepcode full dependency install (~40s scale, longer on bad networks), the command already carries the mirror flag.

Acceptance check (one shot)

Run this block after installing; all green = combo ready; any failure -> back to the matching step in the install walkthrough.

swerex-remote --help
deepcode --version
code-review-graph --version

预期输出: swerex-remote prints usage; DeepCode 2.1.0; code-review-graph 2.3.8. All green = quality gate trio command surface ready

Note: member-level commands measured; real sandbox execution needs Docker (not measured, honestly marked).

Verification evidence

Every combo is measured in an isolated environment (smoke + write-surface check); unmeasured items are honestly marked in the text, and measurement dates are listed in the verification section below.

Verified 2026-08-29 · TTL expires 2027-02-25 (180 days)

Local verification record（2026-08-28）

Evidence paths: local repro log 2026-08-28; local repro log 2026-08-28; local repro log 2026-08-28.
Not measured (stated honestly): swe-rex real sandbox execution (needs Docker + auth token, sandbox not run in this environment); deepcode real gate flow (needs provider config); crg registration subcommand (not executed in this combo).

Combo Draft: CI/CD Quality Gate (swe-rex + deepcode + code-review-graph) ✓ Verified