github-code-review

GitHub Code Review

Perform code reviews on local changes before pushing, or review open PRs on GitHub.

Prerequisites

• Authenticated with GitHub (see github-auth skill)
• Inside a git repository

Setup

if command -v gh &>/dev/null && gh auth status &>/dev/null; then
  AUTH="gh"
else
  AUTH="git"
  if [ -z "$GITHUB_TOKEN" ]; then
    if [ -f ~/.hermes/.env ] && grep -q "^GITHUB_TOKEN=" ~/.hermes/.env; then
      GITHUB_TOKEN=$(grep "^GITHUB_TOKEN=" ~/.hermes/.env | head -1 | cut -d= -f2 | tr -d '\n\r')
    elif grep -q "github.com" ~/.git-credentials 2>/dev/null; then
      GITHUB_TOKEN=$(grep "github.com" ~/.git-credentials 2>/dev/null | head -1 | sed 's|https://[^:]*:\([^@]*\)@.*|\1|')
    fi
  fi
fi

REMOTE_URL=$(git remote get-url origin)
OWNER_REPO=$(echo "$REMOTE_URL" | sed -E 's|.*github\.com[:/]||; s|\.git$||')
OWNER=$(echo "$OWNER_REPO" | cut -d/ -f1)
REPO=$(echo "$OWNER_REPO" | cut -d/ -f2)

---

1. Reviewing Local Changes (Pre-Push)

Get the Diff

git diff --staged                            # staged changes
git diff main...HEAD                         # all changes vs main
git diff main...HEAD --name-only             # file names only
git diff main...HEAD --stat                  # stat summary

Review Strategy

1. Big picture: git diff main...HEAD --stat + git log main..HEAD --oneline
2. File by file: git diff main...HEAD -- src/auth/login.py + read_file for context
3. Check for common issues:

   git diff main...HEAD | grep -n "print(\|console\.log\|TODO\|FIXME\|HACK\|debugger"
   git diff main...HEAD --stat | sort -t'|' -k2 -rn | head -10
   git diff main...HEAD | grep -in "password\|secret\|api_key\|token.*=\|private_key"
   git diff main...HEAD | grep -n "<<<<<<\|>>>>>>\|======="
   

Review Output Format

## Code Review Summary
### Critical
- **src/auth.py:45** — SQL injection: use parameterized queries.
### Warnings
- **src/models/user.py:23** — Password stored in plaintext.
### Suggestions
- **src/utils/helpers.py:8** — Duplicates logic in `src/core/utils.py:34`.
### Looks Good
- Clean separation of concerns in the middleware layer