pr-review

CRITICAL: When --publish is passed, this skill produces a PUBLISHED GitHub review visible to the PR author and all watchers. Every word matters. Every claim must be proven. User MUST approve the text before publishing.

Default behavior is draft only: the skill performs the full analysis, presents the review and inline comments to the user, and stops. Nothing is sent to GitHub unless --publish is set.

Arguments

Parse $ARGUMENTS for:

• PR number (positional, optional). If omitted, detect from current branch: gh pr view --json number --jq .number 2>/dev/null
• --publish — actually post the review to GitHub via the API. Without this flag the skill stops after presenting the draft; the draft is the deliverable. Required separately from --approve so that the LGTM/NOT-LGTM decision and the publish action are independent.
• --approve — submit as LGTM (APPROVE event) explicitly even when no blockers found (default verdict policy is LGTM without blockers, so this flag is informational). Has no effect unless --publish is also set.
• --target — target branch override (passed through to /branch-review)
• --ticket — external ticket reference (URL or ID) for cross-referencing requirements beyond the PR description; activates the Ticket Compliance section in the output

If no PR number and no PR exists for current branch, report error and stop.

Step 1: Sync to Remote and Verify PR Scope

Before any analysis, fetch ALL remote refs and verify the PR scope via GitHub API.

CRITICAL: Local branches go stale. NEVER use bare main/master/base-branch in git diff — ALWAYS use origin/<branch>. A stale local branch produces phantom diffs that include already-merged commits, leading to false findings (e.g., claiming a PR needs rebasing when it doesn't).

# Fetch everything so origin/* refs are current
git fetch origin

# Get PR metadata from the API — this is the ONLY authoritative source for PR scope
PR_BRANCH=$(gh pr view $PR_NUMBER --json headRefName --jq .headRefName)
PR_BASE=$(gh pr view $PR_NUMBER --json baseRefName --jq .baseRefName)

# Checkout and reset to remote head
git checkout $PR_BRANCH
git reset --hard origin/$PR_BRANCH

# Verify PR scope via API — do NOT trust local git diff for file count
gh api "repos/{owner}/{repo}/pulls/$PR_NUMBER" --jq '{commits: .commits, changed_files: .changed_files}'
gh api "repos/{owner}/{repo}/pulls/$PR_NUMBER/files" --jq '.[].filename'
gh api "repos/{owner}/{repo}/pulls/$PR_NUMBER/commits" --jq '.[] | "\(.sha[:8]) \(.commit.message | split("\n")[0])"'