github-code-review

GitHub Code Review

Review local changes before pushing, or review open PRs on GitHub. Plain git covers local work; gh covers PR-level interactions — without it, use the REST fallbacks in references/rest-api-fallback.md.

Prerequisites

• Authenticated with GitHub (see github-auth skill)
• Inside a git repository

OWNER_REPO=$(git remote get-url origin | sed -E 's|.*github\.com[:/]||; s|\.git$||')
OWNER=$(echo "$OWNER_REPO" | cut -d/ -f1); REPO=$(echo "$OWNER_REPO" | cut -d/ -f2)

---

1. Reviewing Local Changes (Pre-Push)

Pure git — works everywhere, no API needed.

Review Strategy

1. Scope first: git diff main...HEAD --stat and git log main..HEAD --oneline.
2. File by file: read_file for context, git diff main...HEAD -- <path> for one file, git diff main...HEAD --name-only to list files, git diff --staged for staged-only work.
3. Check the diff for common issues:

git diff main...HEAD | grep -n "print(\|console\.log\|TODO\|FIXME\|HACK\|XXX\|debugger"
git diff main...HEAD --stat | sort -t'|' -k2 -rn | head -10   # large files accidentally staged
git diff main...HEAD | grep -in "password\|secret\|api_key\|token.*=\|private_key"
git diff main...HEAD | grep -n "<<<<<<\|>>>>>>\|======="      # merge conflict markers

1. Present structured feedback in the format below.

Review Output Format

When reviewing local changes, present findings in this structure:

## Code Review Summary

### Critical
- **src/auth.py:45** — SQL injection: user input passed directly to query.
  Suggestion: Use parameterized queries.

### Warnings
- **src/models/user.py:23** — Password stored in plaintext. Use bcrypt or argon2.
- **src/api/routes.py:112** — No rate limiting on login endpoint.

### Suggestions
- **src/utils/helpers.py:8** — Duplicates logic in `src/core/utils.py:34`. Consolidate.
- **tests/test_auth.py** — Missing edge case: expired token test.

### Looks Good
- Clean separation of concerns in the middleware layer
- Good test coverage for the happy path