github-pr-review

Files (1)

• SKILL.md

SKILL.md (first lines)

# GitHub PR Review: CodeQL & Copilot Suggestions

Evaluates automated review comments from GitHub Advanced Security (CodeQL)
and GitHub Copilot on pull requests. Fetches comments, triages by severity,
and proposes fixes with a decision framework.

## Prerequisites

- GitHub API access (token via `/proc/PID/environ` or `gh auth`)
- PR number or URL

## Workflow

### Step 1: Fetch Review Comments

```bash
# Get PR review comments (CodeQL + Copilot inline comments)
curl -s "https://api.github.com/repos/{owner}/{repo}/pulls/{PR}/comments" \
  -H "Authorization: token $TOKEN" | python3 -c "
import json, sys
comments = json.load(sys.stdin)
for c in comments:
    author = c.get('user', {}).get('login', '?')
    if 'advanced-security' in author or 'copilot' in author:
        print(f'---')
        print(f'File: {c.get(\"path\", \"?\")}')
        print(f'Line: {c.get(\"line\", \"?\")}')
        print(f'Author: {author}')
        print(f'Body: {c.get(\"body\", \"\")[:500]}')
"
```

### Step 2: Triage by Source

| Source | What It Checks | Typical Findings |
|--------|---------------|------------------|
| `github-advanced-security[bot]` | CodeQL static analysis | Security vulnerabilities, workflow permissions, injection risks |
| `Copilot` | Code quality suggestions | Inconsistent naming, dead code, style issues |
| `copilot-pull-request-reviewer` | PR-level review | Logic errors, missing tests, documentation |

### Step 3: Evaluate Each Suggestion

For each comment, apply this decision framework:

#### ACCEPT if:
- Security issue (CodeQL finding) → always accept or explicitly justify rejection
- Workflow permission too broad → add `permissions:` block
- Actual bug or logic error → fix the code
- Inconsistent naming/branding → fix (e.g., wrong logo on badge)

#### REJECT if:
- False positive (CodeQL misidentification) → document why
- Style preference only (no functional impact) → note but skip
- Would break existing behavior without clear benefit → reject
- Suggestion is overly aggressive (e.g., "rename all variables") → reject

#### DEFER if:
- Requires architectural change → propose in separate PR
- Needs user decision → present options, wait for approval
- Unclear impact → investigate further before acting

### Step 4: Present Proposal

Format as a table for user review:

```
=== CodeQL & Copilot Review: PR #N ===

| # | Severity | Source | File | Suggestion | Proposal | Effort |
|---|----------|--------|------|------------|----------|--------|
| 1 | High     | CodeQL | workflow.yml | Missing permissions block | ACCEPT — add permissions: contents: read | 2 lines |
| 2 | Low      | Copilot | README.md | Wrong badge logo | ACCEPT — fix logo parameter | 1 line |
| 3 | Medium   | CodeQL | script.sh | Unquoted variable | REJECT — variable is intentionally word-split | 0 lines |

Summary: 2 accept, 1 reject, 0 defer
```

### Step 5: Implement Accepted Fixes

After user approval:
1. Make the changes
2. Commit with descriptive message
3. Push and verify CI passes
4. Optionally reply to the review comment with the fix

### Step 6: Seed Export Check (Pre-Merge)

Before merging, check if new high-value Mnemon entries should be added to seed.json:

```bash
scripts/check-seed-export.sh
```

This script:
1. Queries Mnemon for entries with importance >= 4
2. Compares against existing seed.json content
3. Reports any new entries that should be exported

**If new entries found:**
1. Review each entry for relevance
2. Add to `mnemon/seed.json` with proper format
3. Validate: `mnemon import --dry-run mnemon/seed.json`
4. Commit updated seed.json with the PR

**Why this matters:**
- Seed file is the persistent knowledge catalog across sessions
- New wiki articles, key decisions, and architecture facts should be seeded
- Ensures future Codespaces start with all important knowledge

## API Endpoints

| Endpoint | Purpose |
|----------|---------|
| `GET /repos/{owner}/{repo}/pulls/{PR}/comments` | Inline review comments |
| `GET /repos/{owner}/{repo}/issues/{PR}/comments` | Top-level PR comments |
| `GET /repos/{owner}/{repo}/pulls/{PR}/reviews` | Full review objects |
| `POST /repos/{owner}/{repo}/pulls/{PR}/comments/{ID}/replies` | Reply to a comment |

## Common CodeQL Findings

From gitricko/.minions, MIT.

More from gitricko/.minions