Skip to content

ci(review): run the code-review skill's axes on a pull request - #7074

Merged
otavio merged 1 commit into
masterfrom
ci/pr-review-shared-procedure
Sep 10, 2026
Merged

ci(review): run the code-review skill's axes on a pull request#7074
otavio merged 1 commit into
masterfrom
ci/pr-review-shared-procedure

Conversation

@otavio

@otavio otavio commented Sep 10, 2026

Copy link
Copy Markdown
Member

What

The PR review workflow now executes the shared procedure from the claude repo instead of a 574-line prompt embedded in this file. The workflow keeps the plumbing and contributes a preamble naming this repo's specifics: the anonymous-route allowlist, which conventions skills apply, the extra correctness focus, and the cross-repo rule.

Why

Two near-identical copies of the prompt (here and in cloud) drifted, and both ran a weaker review than /code-review gives locally — no Spec axis, and a filter that discarded every convention and smell finding. See shellhub-io/claude#61 for the procedure and the full rationale.

Changes

  • Prompt: replaced with a Load review procedure step that reads the file via GITHUB_OUTPUT. Reading it in a step rather than telling the agent to open the file keeps the review from depending on a tool call that can fail mid-run.
  • Tools: gh pr view and gh issue view added to --allowedTools — the Spec axis needs them to resolve the linked issue.
  • Budget: --max-turns 50 -> 80, and the model pinned to claude-opus-5.

Testing

Comment /review on an open PR after shellhub-io/claude#61 merges. Watch for the tracking comment reaching a terminal state — the summary is mandatory, and the Finalize tracking comment step rewrites it if the agent runs out of turns.

The prompt lived inline here and in cloud's copy, 574 near-identical lines each, and the two
had already drifted. It now comes from .claude/prompts/pr-review.md in the claude repo,
leaving only this repo's specifics in the workflow.

What the old prompt asked for was narrower than the review /code-review runs locally: it
flagged compile errors and exploitable bugs while excluding "code style or quality concerns",
so every documented-rule violation and every code smell was dropped before it could be
posted, and nothing checked the diff against the issue it claims to implement.
@otavio
otavio requested a review from a team as a code owner September 10, 2026 21:39
@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown

Claude finished @otavio's task in 2m 1s —— View job


Code Review Complete

Reviewed 1 file across code quality, security, testing, language patterns, and architecture — no new issues found. The change is a clean, well-reasoned refactor.

What I verified:

  • Expression injection is safe — the procedure text is inserted via ${{ steps.review-procedure.outputs.text }} as an already-evaluated value; GitHub Actions does not re-scan substituted values for expressions, so procedure content can't smuggle in ${{ }} evaluation.
  • Step ordering is correctSetup workspace context creates the .claude symlink before Load review procedure reads .claude/prompts/pr-review.md through it.
  • No dangling template refs — the prompt's remaining ${{ ... }} references (…number, steps.author-check.outputs.is_admin) still resolve to steps that exist.
  • Fail-closed on missing procedure — if the file is absent the step exit 1s before the action creates a tracking comment, so Finalize tracking comment correctly finds nothing to rewrite.
  • --allowedTools — the added gh pr view / gh issue view match the Spec-axis need described in the PR.

One operational note (already called out in the PR body, not a code issue): .claude/prompts/pr-review.md is not present in the claude checkout yet, so this workflow will hard-fail until shellhub-io/claude#61 merges — which is the stated ordering.


To request another review round, comment /review.

__

@otavio
otavio merged commit 0004af5 into master Sep 10, 2026
39 checks passed
@otavio
otavio deleted the ci/pr-review-shared-procedure branch September 10, 2026 21:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant