Ci Review

CI Review

Multi-agent code review for pull requests. Posts findings as an atomic GitHub PR review with inline comments.

Before running, read [references/REVIEW-POSTING.md](references/REVIEW-POSTING.md) now for the review posting format and error handling chain.

Profiles

| Profile | Agents | Use When | |---------|--------|----------| | single | single-reviewer (one comprehensive agent) | Routine PRs, CI budgets, small diffs — ~6x cheaper than lean | | lean (default) | deep-reviewer, guidelines-checker, bug-detector, security-reviewer, silent-failure-hunter, code-simplifier | Every PR — balanced cost and coverage | | full | All lean agents + test-analyzer, comment-analyzer, type-analyzer | Critical PRs, large changes, pre-release | | agent | Same agents as full | PR authored by an AI agent — surfaces more findings since fixes are cheap |

Agent Profile

The --agent flag activates the agent profile, designed for reviewing AI-authored code. It uses the full agent set but with different thresholds and additional prompt context:

• Uses the full agent set (all 9 review agents)
• Lowers the default --min-severity to low (surface everything actionable)
• Injects context into each agent prompt: "This PR was authored by an AI agent. Surface all valid findings including minor ones — the cost of fixing is negligible. Pay attention to AI-specific patterns: over-engineering, hallucinated API usage, unnecessary abstractions, verbose boilerplate, and cargo-culted patterns."

Severity Filter

Use --min-severity to control which findings appear in the review:

| Level | Includes | Default For | |-------|----------|-------------| | low | All findings (low, medium, high, critical) | --agent profile | | medium | medium + high + critical | Default for --single, --lean, --full | | high | high + critical | — | | critical | critical only | — |

If not specified, --min-severity defaults to medium for normal runs and to low when --agent is used. The severity filter is applied AFTER confidence scoring — it removes real but low-priority findings, not false positives.

Review Posting Rules (Inlined for Reliability)

These rules are critical. They are also detailed in REVIEW-POSTING.md but inlined here as defense-in-depth:

• Always use event "COMMENT" — never "APPROVE" or "REQUEST_CHANGES"
• Build ONE gh api call that creates the review with all inline comments at once
• line is the line number on the new version of the file. Always use side=RIGHT
• Only post actionable inline comments — no confirmations, no "looks good"
• Do not repeat correctly addressed items
• If no inline comments, omit the comments array and just post the body

Timing Logs

This section is reference guidance. Do not execute anything from it directly — timing markers are only emitted from within each numbered Step's own Bash invocations below. This section describes the two variants and when to apply each.

Every Step in the ## Workflow section emits a phase-start marker at its beginning and a phase-end marker at its end so the GitHub Actions log shows where time is spent. GitHub Actions renders ::group:: / ::endgroup:: as collapsible sections in the run UI; local runs see them as plain text. Track each Step's elapsed seconds and report them in the Step 8 summary as Phase timings (s): s0=... s1=... ... total=....

Single-call variant — use when the entire Step fits in one Bash invocation (Steps 0, 1, 2). Capture the start epoch into a shell variable and compute elapsed inline, so no state needs to cross tool calls. Preserve the step's exit status by capturing $? immediately after ` and re-emitting it at the end — otherwise the trailing echo commands would always return 0 and mask prerequisite or eligibility failures (e.g., gh auth status failing in Step 0). **All echoes go to stdout** — per GitHub's workflow-command spec, ::group:: / ::endgroup:: must appear on stdout to render as collapsible sections in the Actions log. For steps whose also produces parseable output (e.g., Step 2's gh pr view --json), the output stream will interleave markers with the parseable line; the model reads both and extracts the parseable content visually (the JSON line is self-evident). Pattern: echo "::group::[ci-review] Step N: "; START=$(date +%s); ; STATUS=$?; echo "[ci-review] Step N done elapsed=$(( $(date +%s) - START ))s"; echo "::endgroup::"; exit $STATUS`.

Multi-call variant — use when the Step spans multiple Bash invocations or waits on subagent tool calls (Steps 3, 3.5, 4, 5, 6, 7). All marker echoes go to stdout (GitHub's workflow-command spec). Any value the model needs to remember for later calls (epochs, SHAs, owner/repo) must be printed to stdout as a labeled line so it survives across tool calls. In the first Bash call of the Step, print echo "::group::[ci-review] Step N: " and date +%s — remember the printed epoch in your working state. In the last Bash call of the Step, substitute the remembered epoch into echo "[ci-review] Step N done elapsed=$(( $(date +%s) - ))s"; echo "::endgroup::". For Steps with agent fan-out (Steps 4, 5), place the phase-end marker after all agents have returned — the elapsed value will include their wall-clock time, which is exactly what we want to measure.

Workflow

Step 0: Prerequisites

Verify gh CLI is available and authenticated. Single Bash invocation using the Timing Logs single-call variant:

echo "::group::[ci-review] Step 0: Prerequisites"
START=$(date +%s)
gh auth status
STATUS=$?
echo "[ci-review] Step 0 done elapsed=$(( $(date +%s) - START ))s"
echo "::endgroup::"
exit $STATUS

If gh is not found (exit 127), abort with: "gh CLI is required. Install: https://cli.github.com/" If not authenticated (non-zero exit from gh auth status), abort with: "gh is not authenticated. Run: gh auth login"

Step 1: Parse Arguments

Emit timing markers via a minimal Bash invocation even though argument parsing itself has no other shell work — s1= in the Step 8 summary must be a measured elapsed value, never a placeholder:

echo "::group::[ci-review] Step 1: Parse Arguments"
START=$(date +%s)
# Argument parsing is performed by the model from the conversation — no shell work required here.
echo "[ci-review] Step 1 done elapsed=$(( $(date +%s) - START ))s"
echo "::endgroup::"

Extract from the argument string:

• PR identifier (required): a number (e.g., 123) or GitHub URL. If a URL, extract the PR number and store as PR_NUMBER. If the URL points to a different repository than the current one, abort with: "Cross-repo URLs are not supported. Run this skill from the target repo, or pass just the PR number."
• Focus text (optional): free text describing what to focus the review on (e.g., "auth flow", "error handling")
• Profile flag (optional): --single, --lean, --full, or --agent. Default: --lean. --agent implies --full agent set. --single uses one comprehensive agent instead of the specialist fan-out.
• Model override (optional): --model sonnet|opus. Default: use each agent's built-in model (Sonnet for reviewers, Haiku for scorers). When set, overrides the model for review agents only — confidence scorers always use Haiku.
• Severity filter (optional): --min-severity low|medium|high|critical. Default: medium (or low when --agent).

If no PR number is provided, abort with: "Usage: /ci-review [focus text] [--full|--lean|--single] [--agent] [--model sonnet|opus] [--min-severity ]"

Step 2: Eligibility Check

Single Bash invocation using the Timing Logs single-call variant. Preserves the gh pr view exit status so non-zero (PR not found, permissions) propagates for the abort check:

echo "::group::[ci-review] Step 2: Eligibility Check"
START=$(date +%s)
gh pr view  --json state,number,title,url
STATUS=$?
echo "[ci-review] Step 2 done elapsed=$(( $(date +%s) - START ))s"
echo "::endgroup::"
exit $STATUS

• If gh pr view fails (non-zero exit), abort: "PR #N not found or insufficient permissions."
• If PR state is not OPEN, abort: "PR #N is {state}. Only open PRs can be reviewed."

Print: "Reviewing PR #N: {title} ({url}) — profile: {single|lean|full|agent}"

Step 3: Gather Context (Parallel)

Multi-call timing variant. Emit the phase-start marker in a dedicated Bash call before launching the parallel operations below:

echo "::group::[ci-review] Step 3: Gather Context"
date +%s   # print and remember — pass this value into the Step 3 phase-end Bash call at the end

Then launch these four operations in parallel:

3a. Fetch PR diff:

gh pr diff 

3b. Fetch PR metadata:

gh pr view  --json title,body,headRefName,baseRefName,files,additions,deletions,changedFiles

3c. Discover CLAUDE.md files: Search for CLAUDE.md files in the repo root and in directories containing changed files. Use Glob to find **/CLAUDE.md and Read to load the root CLAUDE.md and any others relevant to the changed files. Preserve scope: prefix each file's contents with its path (e.g., ### /CLAUDE.md, ### /packages/api/CLAUDE.md) so agents know which rules apply to which directories.

3d. Fetch existing PR comments: Run the fetch-pr-comments.sh script to retrieve all existing comments on this PR (inline review comments, PR-level comments, and review bodies from all authors):

sh ../../scripts/fetch-pr-comments.sh 

Store the JSON output as EXISTING_COMMENTS. Comment bodies are truncated to 2000 characters by the script to limit context size on comment-heavy PRs — this is sufficient for content-signal matching since actionable content appears early in comments.

If the script fails (non-zero exit, or stderr contains {"error":...}), log a warning and continue — cross-run dedup is best-effort. On failure, set EXISTING_COMMENTS to:

{"inline_comments":[],"pr_comments":[],"review_bodies":[],"summary":{"total_inline":0,"total_pr_comments":0,"total_review_bodies":0}}

Print: "Fetched {totalinline} inline comments, {totalprcomments} PR comments, {totalreview_bodies} review bodies for cross-run dedup."

Compile the context bundle:

• PR_DIFF: the full diff text
• PR_META: title, body, branch names, file list, stats
• CLAUDE_MD: path-prefixed CLAUDE.md contents (or "No CLAUDE.md found")
• FOCUS: the focus text (or empty)
• EXISTING_COMMENTS: structured JSON of all existing PR comments (for cross-run dedup in Step 5)

Large diffs: If the diff exceeds 10,000 lines, warn: "Large diff ({N} lines) — review quality may degrade for files not near the top of the diff." Do not truncate — let agents handle context naturally. They can always Read individual files for deeper investigation.

Emit the Step-3 phase-end marker in a final Bash call after the context bundle is compiled (substitute the epoch you remembered from the phase-start call):

echo "[ci-review] Step 3 done elapsed=$(( $(date +%s) -  ))s"
echo "::endgroup::"

Step 3.5: Ensure PR Branch is Checked Out

Multi-call timing variant. Emit the phase-start marker in a first Bash call that prints everything subsequent calls need — Bash tool state does not persist across calls, so any value you need later must be echoed to stdout here:

echo "::group::[ci-review] Step 3.5: Ensure PR Branch is Checked Out"
date +%s   # remember this epoch for the phase-end call
gh pr view  --json headRefOid --jq '"PR_HEAD_SHA=" + .headRefOid'
echo "HEAD_SHA=$(git rev-parse HEAD)"

Review agents use Read, Grep, and git blame to examine the actual code — not just the diff. Decide the checkout action based on the SHAs:

• If HEAD_SHA matches PR_HEAD_SHA → already on the right commit, do nothing.
• Otherwise → run gh pr checkout .
• If checkout fails → warn but continue. Pass a note to agents: "File access unavailable — review from diff only." This lets agents skip Read/git blame rather than wasting turns on failing tool calls.

Close Step 3.5 with a phase-end Bash call (required on every branch — already-on-commit, checkout-succeeded, and checkout-failed-but-continuing):

echo "[ci-review] Step 3.5 done elapsed=$(( $(date +%s) -  ))s"
echo "::endgroup::"

Step 4: Launch Review Agents

Multi-call timing variant. This is typically the longest phase — the elapsed value tells the user exactly how much time agent reasoning consumed. Emit the phase-start marker in a dedicated Bash call before launching agents:

echo "::group::[ci-review] Step 4: Launch Review Agents"
date +%s   # remember this epoch for the phase-end call

Select agents based on profile:

Single agent (when --single):

1. ci-review:single-reviewer — one comprehensive agent covering all domains

Lean agents (default, when --lean or no flag):

1. ci-review:deep-reviewer
2. ci-review:guidelines-checker
3. ci-review:bug-detector
4. ci-review:security-reviewer
5. ci-review:silent-failure-hunter
6. ci-review:code-simplifier

Full and agent profile agents (added when --full or --agent):

1. ci-review:test-analyzer
2. ci-review:comment-analyzer
3. ci-review:type-analyzer

Launch ALL selected agents in parallel using the Agent tool. If --model was specified, pass it as the model parameter on each Agent tool call to override the agent definition's default. Each agent receives the same prompt:

Review this pull request. Report findings in your defined output format:
## Findings
1. **[severity]** `file:line` — description + **Recommendation:**
If no issues found, output "No findings."

## PR Metadata
Title: {title}
Branch: {head} → {base}
Changed files: {count} ({additions}+ / {deletions}-)

## CLAUDE.md Rules
{CLAUDE_MD contents}

## Focus
{FOCUS text, or "No specific focus — review broadly."}

## Agent Context
{If --agent: "This PR was authored by an AI agent. Surface all valid findings including minor ones — the cost of fixing is negligible. Pay attention to AI-specific patterns: over-engineering, hallucinated API usage, unnecessary abstractions, verbose boilerplate, and cargo-culted patterns."}
{If not --agent: omit this section entirely}

## PR Diff
{PR_DIFF}

Agent failure handling: If an agent fails, times out, or returns unparseable output, log the failure and continue with findings from the remaining agents. Do not abort the review because one agent failed. Record the failure in the Step 8 summary (e.g., "Agents: 8 launched, 7 completed, 1 failed").

After all agents have returned (or been recorded as failed), emit the Step-4 phase-end marker (substitute the remembered epoch):

echo "[ci-review] Step 4 done elapsed=$(( $(date +%s) -  ))s"
echo "::endgroup::"

Step 5: Confidence Scoring

Multi-call timing variant. Emit the phase-start marker in a dedicated Bash call before launching scorers:

echo "::group::[ci-review] Step 5: Confidence Scoring"
date +%s   # remember this epoch for the phase-end call

Collect all findings from all agents into a single list. For each finding, record:

• The finding text (severity, file, line, message, recommendation)
• Which agent produced it

Launch one ci-review:confidence-scorer agent per finding, all in parallel. Haiku is cheap and fast — independent scoring per finding ensures no cross-contamination and survives partial failures.

Each scorer receives:

Score this review finding from 0-100 for confidence (how certain are you that this finding is factually correct?).
Check the diff to verify the finding is on a changed line, then read the actual code to verify it's real.
Confidence is about accuracy, not importance — a minor but real style issue should score high.

## Finding
Source agent: {agent-name}
{the finding text: severity, file, line, message, recommendation}

## PR Diff
{PR_DIFF}

Wait for all scorers to co

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: rube-de
• Source: rube-de/cc-skills
• License: MIT

Install and usage instructions live in the source repository linked above.