Code Review Protocol
This skill provides the standard operating procedure for AI agents (like GitHub Copilot, Claude, etc.) performing code reviews on the Eventyay repository.
1. Initial Triage & Architecture Checks
Before reviewing specific business logic, strictly enforce these Non-Negotiable Architecture Rules (from AGENTS.md):
- Location Verification: New product code must reside under
app/eventyay/. Tests must reside under app/tests/. Ensure legacy directories (talk/, video/, src/) are not being actively modified unless requested.
- Legacy Namespaces: Reject any new imports or logic using
pretix.*, pretalx.*, or venueless.*. All new code must use the eventyay.* namespace.
- Multi-tenancy (Crucial): Any ORM query accessing event-specific data MUST be wrapped securely with
django_scopes.scope(event=event). Flag missing scopes immediately.
- ORM Efficiency: Check for N+1 query vulnerabilities. Ensure
select_related and prefetch_related are used appropriately.
- Error Handling: Reject the use of generic
Exception blocks. Code must catch specific exception types.
- Imports Structure: Imports must be at the top of the file. Local imports inside functions/methods are strictly for resolving circular dependencies.
- Frontend Hard Rules: No jQuery. No inline scripts in templates. JavaScript must use external ES modules.
2. File-Scoped Standard Enforcement
During the review, you MUST apply the canonical scoped rules based on the files modified in the pull request:
| File Type |
Instruction File to Enforce |
Key Review Focus |
Python (.py) |
.github/instructions/python.instructions.md |
Python 3.12 compatibility, correct typing, proper Django 5.2+ usage, Celery task definitions. |
JavaScript/Vue (.js, .vue) |
.github/instructions/js.instructions.md |
Vue 3 composition API standards, ES modules, strict absence of jQuery. |
Django Templates (.html) |
.github/instructions/django-template.instructions.md |
Structural integrity, template tag correctness, absence of inline JavaScript. |
Jinja Templates (.html, .j2) |
.github/instructions/jinja.instructions.md |
Syntax correctness, context safety and proper escaping. |
| Dockerfile |
.github/instructions/dockerfile.instructions.md |
Security, multi-stage build best practices, minimal layer size. |
TOML (.toml) |
.github/instructions/toml.instructions.md |
Syntax validity, uv dependency alignment (app/pyproject.toml). |
| Git Commits |
.github/instructions/git-commit.instructions.md |
Conventional commit formatting, descriptive bodies. |
3. Security, Validation & State
- Permissions: Verify that new endpoints or views enforce appropriate Django/DRF permissions and scopes.
- Validation: Ensure all incoming data is validated via Django forms or DRF serializers.
- Runtime Context: Keep in mind the stack runs on PostgreSQL, Redis, Channels, and Celery. Review background tasks for idempotency and transaction safety.
4. Providing Actionable Feedback
When leaving review comments:
- Be Explicit: Do not just say "fix imports". Say "Use
eventyay.* for this import instead of pretalx.*".
- Provide Code Snippets: If an ORM query is missing a scope, provide the correct wrapped
django_scopes.scope(...) snippet.
- Cite Sources: Reference
AGENTS.md or the specific file in .github/instructions/ to reinforce the source of truth.
- Prioritize Severity: Call out missing Django Scopes, N+1 queries, and generic exceptions as block-level issues.
1---2name: code-review3description: How to review code and Pull Requests in the Eventyay repository against canonical instructions.4---56# Code Review Protocol78This skill provides the standard operating procedure for AI agents (like GitHub Copilot, Claude, etc.) performing code reviews on the Eventyay repository.910## 1. Initial Triage & Architecture Checks1112Before reviewing specific business logic, strictly enforce these Non-Negotiable Architecture Rules (from `AGENTS.md`):1314* **Location Verification**: New product code must reside under `app/eventyay/`. Tests must reside under `app/tests/`. Ensure legacy directories (`talk/`, `video/`, `src/`) are not being actively modified unless requested.15* **Legacy Namespaces**: Reject any new imports or logic using `pretix.*`, `pretalx.*`, or `venueless.*`. All new code must use the `eventyay.*` namespace.16* **Multi-tenancy (Crucial)**: Any ORM query accessing event-specific data MUST be wrapped securely with `django_scopes.scope(event=event)`. Flag missing scopes immediately.17* **ORM Efficiency**: Check for N+1 query vulnerabilities. Ensure `select_related` and `prefetch_related` are used appropriately.18* **Error Handling**: Reject the use of generic `Exception` blocks. Code must catch specific exception types.19* **Imports Structure**: Imports must be at the top of the file. Local imports inside functions/methods are strictly for resolving circular dependencies.20* **Frontend Hard Rules**: No jQuery. No inline scripts in templates. JavaScript must use external ES modules.2122## 2. File-Scoped Standard Enforcement2324During the review, you MUST apply the canonical scoped rules based on the files modified in the pull request:2526| File Type | Instruction File to Enforce | Key Review Focus |27| :--- | :--- | :--- |28| **Python** (`.py`) | `.github/instructions/python.instructions.md` | Python 3.12 compatibility, correct typing, proper Django 5.2+ usage, Celery task definitions. |29| **JavaScript/Vue** (`.js`, `.vue`) | `.github/instructions/js.instructions.md` | Vue 3 composition API standards, ES modules, strict absence of jQuery. |30| **Django Templates** (`.html`) | `.github/instructions/django-template.instructions.md` | Structural integrity, template tag correctness, absence of inline JavaScript. |31| **Jinja Templates** (`.html`, `.j2`) | `.github/instructions/jinja.instructions.md` | Syntax correctness, context safety and proper escaping. |32| **Dockerfile** | `.github/instructions/dockerfile.instructions.md` | Security, multi-stage build best practices, minimal layer size. |33| **TOML** (`.toml`) | `.github/instructions/toml.instructions.md` | Syntax validity, `uv` dependency alignment (`app/pyproject.toml`). |34| **Git Commits** | `.github/instructions/git-commit.instructions.md` | Conventional commit formatting, descriptive bodies. |3536## 3. Security, Validation & State3738* **Permissions**: Verify that new endpoints or views enforce appropriate Django/DRF permissions and scopes.39* **Validation**: Ensure all incoming data is validated via Django forms or DRF serializers.40* **Runtime Context**: Keep in mind the stack runs on PostgreSQL, Redis, Channels, and Celery. Review background tasks for idempotency and transaction safety.4142## 4. Providing Actionable Feedback4344When leaving review comments:451. **Be Explicit**: Do not just say "fix imports". Say "Use `eventyay.*` for this import instead of `pretalx.*`".462. **Provide Code Snippets**: If an ORM query is missing a scope, provide the correct wrapped `django_scopes.scope(...)` snippet.473. **Cite Sources**: Reference `AGENTS.md` or the specific file in `.github/instructions/` to reinforce the source of truth.484. **Prioritize Severity**: Call out missing Django Scopes, N+1 queries, and generic exceptions as block-level issues.
fossasia