# Pre Pr Review

> Use before running `gh pr create` or `git push`. Runs the full pre-PR gate from CLAUDE.md (format, lint, lint:pkg, build, test) plus the code-reviewer agent on the diff. Catches P0/P1 findings before the review bot blocks the PR. Triggers on "create PR", "open pull request", "ready to push", "pre-PR check".

- Skill: `decentraland/pre-pr-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add decentraland/pre-pr-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/decentraland/pre-pr-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: decentraland (https://skillmd.com/u/decentraland)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/decentraland/pre-pr-review

---


# pre-pr-review

Mandatory gate before `git push` / `gh pr create` for `@dcl/sites`. Catches the same things the review bot would catch, locally.

## When to use

- Before pushing a branch.
- Before opening a PR.
- After significant rebase/merge conflicts.

## When NOT to use

- Mid-development snapshot — too slow on every save. Use `npm run lint -- --fix` while iterating.

## Steps (in order — stop on first failure)

```bash
npm run format            # 1. Prettier
npm run lint:fix          # 2. ESLint (auto-fix where possible)
npm run lint:pkg          # 3. package.json lint (silent on success — easy to skip; do not skip)
npm run build             # 4. tsc -b + vite build + hero prerender. Catches stricter TS than tsc --noEmit.
npm test                  # 5. Jest
```

If `4` succeeds but `npm run preview` blows up at runtime, see CLAUDE.md rule 14 (CJS-heavy deps).

## Step 6 — code-reviewer agent

Dispatch the project's `code-reviewer` agent on the diff:

> Use the `code-reviewer` subagent on `git diff master...HEAD`. Treat any P0 or P1 finding as a blocker. Surface P2 to me.

The agent enforces rules 1-25 from `CLAUDE.md` and the security checklist.

## Step 7 — barrier-specific spot checks

Beyond the agent, manually verify these high-risk patterns if your diff touches them:

| If the diff touches…                                     | Run                                                                         |
| -------------------------------------------------------- | --------------------------------------------------------------------------- |
| `src/intl/en.json`                                       | `i18n-auditor` agent (locale parity, rule 9)                                |
| New `<Route>` in `src/App.tsx`                           | `npm run build && npm run preview` then navigate dynamic variants (rule 14) |
| `package-lock.json` after rebase                         | `rm -rf node_modules package-lock.json && npm install` (rule 21)            |
| React HTML-injection prop (`dangerously-set-inner-html`) | DOMPurify with scoped allowlist (rule 19)                                   |
| iframe / embed URLs                                      | `new URL()` + hostname `Set` + regex ID (rule 20)                           |
| `src/shells/*` import outside `src/App.tsx`              | Boundary violation — STOP (rule 2)                                          |
| `src/config/env/*.json`                                  | Confirm no secrets — these ship to the client (security checklist)          |

## Step 8 — branch + commit hygiene

- Branch name: `<type>/<description>` (feat, fix, chore, docs, refactor, style, test) — ADR-6.
- Each commit: `<type>: <summary>` — single line, no `Co-Authored-By`, no body via HEREDOC.
- PR title: lowercase subject (action-semantic-pull-request CI requires it).
- PR description: concise, no agent/tool attribution, no `## Summary` boilerplate (ADR-6).

## Step 9 — push + post-push

```bash
git push
gh pr create --title "..." --body "..."
```

ADR-6 requires clean commits and PR descriptions: **no `Co-authored-by` trailers and no tooling attribution** (e.g. "Generated by …", "Made with …", "🤖"). If your local toolchain wraps `git` or `gh` and injects either, bypass the wrapper before running these commands — that's a per-developer setup concern, not something this skill prescribes.

After `gh pr create`, fetch reviews and inline comments:

```bash
gh pr view <N>
gh api repos/decentraland/sites/pulls/<N>/comments
```

Triage review-bot findings before handing back to the user. Always include the full PR URL in the report.

## Pitfalls

- Skipping `lint:pkg` because it's silent on success.
- `npm run build` passes but `npm run preview` doesn't — still ship-broken (rule 14).
- Running tests only on changed files via `--testPathPattern` and missing a regression in a sibling suite.
- A toolchain wrapper (Orca, Cursor, etc.) silently injecting `Co-authored-by` or "Made with …" into the commit/PR. If your wrapper does this, bypass it before committing/pushing — per-developer setup, not prescribed here.