Review Agent

Review Agent Skill

Audit a PR produced by Claude, Codex, Copilot, or another AI agent.

Contract

• Input: PR number or current branch PR.
• Output: verdict approve, needs-fixes, or reject with evidence.
• Side effects: none by default. Do not approve, request changes, comment, or resolve threads unless explicitly asked.

Workflow

1. Fetch PR context

PR=1234
gh pr view "$PR" \
  --repo <OWNER>/<REPO> \
  --json number,title,body,state,isDraft,author,headRefName,baseRefName,additions,deletions,files,commits,reviews,statusCheckRollup,url

gh pr diff "$PR" --repo <OWNER>/<REPO>

Fetch unresolved review threads separately if thread state matters:

gh api graphql -F pr="$PR" -f query='
query($pr: Int!) {
  repository(owner: "<OWNER>", name: "<REPO>") {
    pullRequest(number: $pr) {
      reviewThreads(first: 100) {
        nodes {
          id isResolved isOutdated path line
          comments(first: 5) { nodes { author { login } body createdAt outdated } }
        }
      }
    }
  }
}'

2. Find linked acceptance criteria

Read PR body for Closes #..., Fixes #..., or issue references. Fetch each linked issue:

gh issue view ISSUE_NUMBER \
  --repo <OWNER>/<REPO> \
  --json number,title,body,labels,milestone,state,url

If no issue is linked, mark this as a review risk.

3. Inspect the changed files locally

Check out or fetch the branch if needed, then inspect only changed files:

gh pr checkout "$PR"
CHANGED_FILES_FILE=$(mktemp)
gh pr view "$PR" --json files --jq '.files[].path' > "$CHANGED_FILES_FILE"
cat "$CHANGED_FILES_FILE"

Search for AI-quality risks in changed files:

while IFS= read -r file; do
  [ -f "$file" ] && rg -n "TODO|FIXME|placeholder|lorem|dummy|mock|example\\.com|coming soon|wkrótce|as any|eslint-disable" "$file"
done < "$CHANGED_FILES_FILE"

Also check for:

• generated files committed without the generator being run
• edits to public/locales/*
• missing translations in src/locales/{pl,en,uk}
• permanent as any Supabase fixes
• AI Act violations: AI grading, profiling, adaptive learning, behavior monitoring
• broad refactors unrelated to the issue

4. Evaluate tests and checks

Use PR check data first:

gh pr checks "$PR" --repo <OWNER>/<REPO>

If local verification is needed, run the narrowest meaningful command:

• docs-only: no local test required, but say so
• TypeScript behavior: npm run typecheck
• lint-sensitive changes: npm run lint
• content changes: npm run validate:content
• route/UI changes: targeted Playwright spec or manual path list
• release-risk changes: npm run build

5. Verdict rubric

Output Format

## Review Agent Verdict

**PR:** #1234 Title
**Verdict:** approve / needs-fixes / reject
**Linked issues:** #...

### Findings
| Severity | File | Issue |
|---|---|---|
| high | `path:line` | ... |

### Acceptance criteria
- [x] ...
- [ ] ...

### Placeholder and scope scan
- ...

### Tests
- CI: ...
- Local: ...

### Required fixes
1. ...

If there are no findings, say that clearly and name the remaining residual risk.

Rules

• Findings first. Avoid praise-heavy summaries.
• Use file and line references for concrete bugs.
• Do not bulk-resolve review threads.
• Do not rubber-stamp agent work only because CI passed.
• Cite AGENTS.md or relevant .agent/skills/* when rejecting scope creep or policy violations.