Pr Review

PR Review

Polished GitHub-Actions review bot. Copy the templates into any repo with setup-vskills or node standalone/pr-review/scripts/copy.mjs.

What it installs

• .github/workflows/pr-review.yml — trusted-base review, status checks, one upserted summary
• .github/workflows/pr-fix.yml — collaborator fix-on-comment, one commit, max 3 loops then needs-human
• .vskills/review.yml — when to review, file-change limit, strictness, status-check thresholds, auto-approve
• .vskills/pr-review/ — prompts plus the JSON/config parsers the workflows actually run

Triggers

• Trusted pull_request_target: [opened, synchronize, reopened, ready_for_review]; checks out the PR head as data and executes no PR-controlled code. Collaborators can rerun with @vskills review.
• issue_comment: created when the comment line begins with the fix command. Same-repo collaborators only. Forks cannot push.
• After a verified fix-on-comment push, the fix job dispatches this workflow because GITHUB_TOKEN commits do not fire pull_request_target.

BYOK model

OpenRouter via OPENROUTER_API_KEY and vars.REVIEW_MODEL / vars.REVIEW_API_BASE. Without a key the workflow still posts a limited deterministic review (conflict detection and credential-pattern scan on added lines). It does not run PR-controlled npm scripts.

CONTEXT-aware

If the consumer repo has CONTEXT/glossary.md or architecture.md, the review job injects them (8k token cap) before chunking hunks (80 lines) and running ripgrep context.

Verification

node --test 'test/pr-review-*.test.js'

Templates carry <!-- vskills-pr-review --> for idempotent upserts.