pre-pr-review
Mandatory gate before git push / gh pr create for @dcl/sites. Catches the same things the review bot would catch, locally.
When to use
- Before pushing a branch.
- Before opening a PR.
- After significant rebase/merge conflicts.
When NOT to use
- Mid-development snapshot — too slow on every save. Use
npm run lint -- --fixwhile iterating.
Steps (in order — stop on first failure)
npm run format # 1. Prettier
npm run lint:fix # 2. ESLint (auto-fix where possible)
npm run lint:pkg # 3. package.json lint (silent on success — easy to skip; do not skip)
npm run build # 4. tsc -b + vite build + hero prerender. Catches stricter TS than tsc --noEmit.
npm test # 5. Jest
If 4 succeeds but npm run preview blows up at runtime, see CLAUDE.md rule 14 (CJS-heavy deps).
Step 6 — code-reviewer agent
Dispatch the project's code-reviewer agent on the diff:
Use the
code-reviewersubagent ongit diff master...HEAD. Treat any P0 or P1 finding as a blocker. Surface P2 to me.
The agent enforces rules 1-25 from CLAUDE.md and the security checklist.
Step 7 — barrier-specific spot checks
Beyond the agent, manually verify these high-risk patterns if your diff touches them:
| If the diff touches… | Run |
|---|---|
src/intl/en.json |
i18n-auditor agent (locale parity, rule 9) |
New <Route> in src/App.tsx |
npm run build && npm run preview then navigate dynamic variants (rule 14) |
package-lock.json after rebase |
rm -rf node_modules package-lock.json && npm install (rule 21) |
React HTML-injection prop (dangerously-set-inner-html) |
DOMPurify with scoped allowlist (rule 19) |
| iframe / embed URLs | new URL() + hostname Set + regex ID (rule 20) |
src/shells/* import outside src/App.tsx |
Boundary violation — STOP (rule 2) |
src/config/env/*.json |
Confirm no secrets — these ship to the client (security checklist) |
Step 8 — branch + commit hygiene
- Branch name:
<type>/<description>(feat, fix, chore, docs, refactor, style, test) — ADR-6. - Each commit:
<type>: <summary>— single line, noCo-Authored-By, no body via HEREDOC. - PR title: lowercase subject (action-semantic-pull-request CI requires it).
- PR description: concise, no agent/tool attribution, no
## Summaryboilerplate (ADR-6).
Step 9 — push + post-push
git push
gh pr create --title "..." --body "..."
ADR-6 requires clean commits and PR descriptions: no Co-authored-by trailers and no tooling attribution (e.g. "Generated by …", "Made with …", "🤖"). If your local toolchain wraps git or gh and injects either, bypass the wrapper before running these commands — that's a per-developer setup concern, not something this skill prescribes.
After gh pr create, fetch reviews and inline comments:
gh pr view <N>
gh api repos/decentraland/sites/pulls/<N>/comments
Triage review-bot findings before handing back to the user. Always include the full PR URL in the report.
Pitfalls
- Skipping
lint:pkgbecause it's silent on success. npm run buildpasses butnpm run previewdoesn't — still ship-broken (rule 14).- Running tests only on changed files via
--testPathPatternand missing a regression in a sibling suite. - A toolchain wrapper (Orca, Cursor, etc.) silently injecting
Co-authored-byor "Made with …" into the commit/PR. If your wrapper does this, bypass it before committing/pushing — per-developer setup, not prescribed here.