ccc-python-review

/ccc-python-review — Python review with a merge verdict

CC Commander · /ccc-python-review · static analysis plus a python-reviewer agent pass, returned as path:line findings and an approve, warn or block verdict.

Arguments

$ARGUMENTS: optional paths or a git range (for example main...HEAD). Default: uncommitted and staged changes.

What happens

1. Find the Python changes.

   git diff --name-only --diff-filter=ACMR HEAD -- '*.py'
   git diff --name-only --diff-filter=ACMR <range> -- '*.py'   # when a range was given
   

   Include pyproject.toml, setup.cfg, requirements*.txt and lock files when they changed. If no Python files changed, say so and stop.

2. Run static analysis. Run each tool only when it is installed (command -v <tool>) or declared in the project's dev dependencies; prefer the project's own task runner (make lint, tox, nox, uv run, poetry run) when it defines these checks. Scope to the changed files where the tool allows it.

   ruff check <files>
   ruff format --check <files>      # or: black --check <files>
   isort --check-only <files>       # only when the project uses isort
   mypy <files>
   bandit -q <files>
   pip-audit                         # dependency audit, when dependencies changed
   pytest --cov=<package> --cov-report=term-missing   # when tests exist
   

   Record pass, fail or not installed for each. Do not install missing tools.

3. Delegate the code review. Call the Agent tool with the python-reviewer agent (read-only), passing the changed file list, the diff, the static-analysis output and the detected framework (Django, FastAPI, Flask or none). Ask it to return findings as path:line + severity + issue + fix. Codex fallback: run the same review with codex exec --sandbox read-only and the same instructions.

4. Check the findings. Open each CRITICAL and HIGH finding at its path:line and confirm it against the code before reporting it; drop any the code does not support.

5. Report in the output format below and give the verdict.