Skip to content

Commit e90de36

Browse files
claudeenko
claude
authored and
enko
committed
refactor(ci): Split code review prompt into three focused files
https://claude.ai/code/session_01Y4tzQdiagBngNn4Ty9926c
1 parent 3599b57 commit e90de36

File tree

4 files changed

+300
-265
lines changed

4 files changed

+300
-265
lines changed

‎.github/prompts/code-review-output.md‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
# Code Review Output Format
2+
3+
Comment formatting, summary template, and posting mechanics for automated code reviews.
4+
5+
-----
6+
7+
## Inline Comments (New Issues Only)
8+
9+
For each new issue, post an inline comment:
10+
11+
```bash
12+
gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/comments" \
13+
-X POST \
14+
-f body="🚨 **Security: SQL Injection**
15+
16+
This query uses string concatenation with user input, allowing SQL injection attacks.
17+
18+
**Suggested fix:**
19+
\`\`\`python
20+
query = \"SELECT * FROM users WHERE id = ?\"
21+
cursor.execute(query, (user_id,))
22+
\`\`\`" \
23+
-f commit_id="$GITHUB_SHA" \
24+
-f path="src/db/users.py" \
25+
-F line=45
26+
```
27+
28+
**Comment Format:**
29+
30+
~~~
31+
[ICON] **[Category]: [Brief Title]**
32+
33+
[1-2 sentence explanation of impact/risk]
34+
35+
**Suggested fix:**
36+
```[language]
37+
[concrete code example]
38+
```
39+
~~~
40+
41+
**Volume Limit:** Maximum 10 inline comments per run. Prioritize: Critical > Important > Suggestion.
42+
43+
-----
44+
45+
## Summary Comment (Always Required)
46+
47+
**This summary must ALWAYS be posted or updated, even when no issues are found.**
48+
49+
> **IMPORTANT**: The summary body MUST be multi-line GitHub-flavored Markdown.
50+
> Never flatten it into a single line or use pipe-delimited text.
51+
> Always use the exact structure shown below — headers, tables, bullet lists, and footer.
52+
53+
**Step 1 — Find existing summary comment:**
54+
55+
```bash
56+
SUMMARY_ID=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
57+
--jq '.[] | select(.body | contains("<!-- CLAUDE_CODE_REVIEW -->")) | .id' | head -1)
58+
```
59+
60+
**Step 2 — Write the summary body to a temporary file:**
61+
62+
You MUST write the summary to a temp file to preserve Markdown formatting. Set shell
63+
variables for your review data first, then write the file using `cat` with a heredoc.
64+
The file content must follow this exact structure — do not omit or reorder sections:
65+
66+
```bash
67+
# Set these variables based on your review findings:
68+
SHORT_SHA=$(echo "$GITHUB_SHA" | head -c 7)
69+
REVIEW_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
70+
# STATUS: one of "✅ Approved", "⚠️ Comments", "🚨 Changes Requested"
71+
# CRITICAL_COUNT, IMPORTANT_COUNT, SUGGESTION_COUNT: integer counts
72+
# SUMMARY_TEXT: 1-3 sentence prose summary of the review
73+
# COMPLIANCE_LINES: multi-line string of "- ✅/❌ ..." items derived from AGENTS.md
74+
# (use the actual rules you read from AGENTS.md — do NOT use generic placeholders)
75+
76+
cat > /tmp/review-summary.md << ENDOFSUMMARY
77+
<!-- CLAUDE_CODE_REVIEW -->
78+
## 🔍 Automated Code Review
79+
80+
| | |
81+
|---|---|
82+
| **Commit** | \`${SHORT_SHA}\` |
83+
| **Reviewed** | ${REVIEW_DATE} |
84+
| **Status** | ${STATUS} |
85+
86+
### Findings
87+
88+
| Severity | Count |
89+
|----------|-------|
90+
| 🚨 Critical | ${CRITICAL_COUNT} |
91+
| ⚠️ Important | ${IMPORTANT_COUNT} |
92+
| 💡 Suggestion | ${SUGGESTION_COUNT} |
93+
94+
### AGENTS.md Compliance
95+
96+
${COMPLIANCE_LINES}
97+
98+
### Summary
99+
100+
${SUMMARY_TEXT}
101+
102+
---
103+
<sub>🤖 Automated review by Claude Code • [View CI Run](${CI_RUN_URL})</sub>
104+
ENDOFSUMMARY
105+
```
106+
107+
**Step 3 — Post or update the comment using the file:**
108+
109+
Build a JSON payload from the file (this avoids shell escaping issues with `$()` subshells):
110+
111+
```bash
112+
jq -n --rawfile body /tmp/review-summary.md '{"body": $body}' > /tmp/review-payload.json
113+
114+
if [ -n "$SUMMARY_ID" ]; then
115+
gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${SUMMARY_ID}" \
116+
-X PATCH \
117+
--input /tmp/review-payload.json
118+
else
119+
gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
120+
-X POST \
121+
--input /tmp/review-payload.json
122+
fi
123+
```
124+
125+
-----
126+
127+
## Review Decision
128+
129+
```bash
130+
CRITICAL_COUNT=0 # Set based on your findings
131+
IMPORTANT_COUNT=0
132+
133+
if [ "$CRITICAL_COUNT" -gt 0 ]; then
134+
gh pr review "$PR_NUMBER" --request-changes \
135+
--body "🚨 Found ${CRITICAL_COUNT} critical issue(s) requiring changes. See inline comments for details."
136+
elif [ "$IMPORTANT_COUNT" -gt 0 ]; then
137+
gh pr review "$PR_NUMBER" --comment \
138+
--body "⚠️ Found ${IMPORTANT_COUNT} issue(s) to consider. See inline comments."
139+
else
140+
gh pr review "$PR_NUMBER" --approve \
141+
--body "✅ Code review passed. No issues found."
142+
fi
143+
```
144+
145+
-----
146+
147+
## Summary Comment Formatting Requirements
148+
149+
> **CRITICAL — Summary Comment Formatting**
150+
>
151+
> The summary comment posted to the PR **MUST** use full GitHub-flavored Markdown
152+
> with headers (`##`, `###`), tables (`| | |`), bullet lists, and the
153+
> `<!-- CLAUDE_CODE_REVIEW -->` marker. **Never** output a single-line or
154+
> pipe-delimited summary.
155+
> Every summary comment must contain all of these elements:
156+
> - The `<!-- CLAUDE_CODE_REVIEW -->` HTML comment marker (first line)
157+
> - A `## 🔍 Automated Code Review` heading
158+
> - A metadata table with Commit, Reviewed, and Status rows
159+
> - A `### Findings` section with a severity table or "No issues found."
160+
> - A `### AGENTS.md Compliance` section with checklist items **derived from the actual AGENTS.md rules** (not generic placeholders)
161+
> - A `### Summary` section with prose
162+
> - A footer with the CI run link
163+
164+
-----
165+
166+
## Final Checklist (verify before finishing)
167+
168+
Before completing the review, confirm:
169+
170+
- [ ] Summary comment uses `<!-- CLAUDE_CODE_REVIEW -->` marker on the first line
171+
- [ ] Summary comment is **multi-line Markdown** with `##` / `###` headers and `| |` tables
172+
- [ ] Summary was written to a temp file and posted via `--body-file` or `cat` to preserve formatting
173+
- [ ] Summary is **not** a single line of pipe-delimited or dash-delimited text
174+
- [ ] CI run link is included in the footer

‎.github/prompts/code-review-policy.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Code Review Policy
2+
3+
Review standards, severity definitions, and analysis methodology for automated code reviews.
4+
5+
-----
6+
7+
## Multi-Pass Review
8+
9+
**Pass 1 — Security & Breaking Changes**
10+
11+
- Authentication/authorization flaws
12+
- Injection vulnerabilities (SQL, XSS, command injection)
13+
- Exposed secrets, API keys, credentials
14+
- Breaking API/interface changes
15+
- Data loss or corruption risks
16+
17+
**Pass 2 — Correctness & Logic**
18+
19+
- Bugs and logic errors
20+
- Race conditions, deadlocks
21+
- Null/undefined handling
22+
- Edge cases and boundary conditions
23+
- Error handling coverage
24+
25+
**Pass 3 — Quality & Maintainability**
26+
27+
- Performance issues (N+1 queries, inefficient algorithms)
28+
- Code clarity and naming
29+
- SOLID principle violations
30+
- Test coverage gaps
31+
- Documentation completeness
32+
33+
-----
34+
35+
## Severity Definitions
36+
37+
|Severity |Icon|Criteria |Review Action |
38+
|----------|----|-----------------------------------------------------------------------------|---------------|
39+
|Critical |🚨 |Security vulnerabilities, bugs, data loss, breaking changes without migration|Request Changes|
40+
|Important |⚠️ |Performance problems, missing error handling, maintainability concerns |Comment |
41+
|Suggestion|💡 |Alternative approaches, minor improvements, nice-to-haves |Comment |
42+
43+
-----
44+
45+
## Confidence Threshold
46+
47+
> **When uncertain whether something is a genuine issue, prefer silence over potentially incorrect feedback.**
48+
49+
Only flag issues you are **≥ 80% confident** about.
50+
51+
-----
52+
53+
## Always Flag (if new and confident)
54+
55+
- Security vulnerabilities (injection, auth bypass, exposed secrets)
56+
- Bugs and logic errors
57+
- Breaking changes without migration path
58+
- Data loss or corruption risks
59+
- Race conditions and concurrency issues
60+
- Missing error handling on critical paths
61+
- N+1 queries and obvious performance problems
62+
- AGENTS.md MUST-PASS/REQUIRED violations
63+
64+
## Never Flag
65+
66+
- Style issues handled by linters/formatters (ESLint, Prettier, etc.)
67+
- Pre-existing issues not introduced by this PR
68+
- Personal preferences not documented in AGENTS.md
69+
- Speculative concerns without concrete evidence
70+
- Minor optimizations with negligible real-world impact
71+
- Issues where confidence < 80%
72+
73+
-----
74+
75+
## Context Adjustments
76+
77+
|PR Type |Review Approach |
78+
|-----------------|-------------------------------------|
79+
|Hotfix/urgent |Critical issues only |
80+
|Refactoring |Focus on architecture, test coverage |
81+
|Draft PR |Lighter review, directional feedback |
82+
|Dependency update|Breaking changes, security advisories|
83+
|New contributor |More explanatory, educational tone |
84+
85+
-----
86+
87+
## Language-Specific Focus
88+
89+
|Language |Priority Checks |
90+
|---------------------|----------------------------------------------------------|
91+
|TypeScript/JavaScript|Type safety, async patterns, memory leaks, null coalescing|
92+
|SQL |Injection risks, missing indexes, N+1 patterns |
93+
94+
-----
95+
96+
## Deduplication Algorithm
97+
98+
**For each potential issue, before queuing a comment:**
99+
100+
1. **Create issue key:** `(file_path, line ± 5, issue_category)`
101+
1. **Search existing comments** (fetched during initialization):
102+
- Same file + similar line range + same issue type → **SKIP (duplicate)**
103+
- Same code pattern mentioned in any existing comment → **SKIP (duplicate)**
104+
1. **Only queue if no semantic match found**
105+
106+
**Pattern Grouping:** If the same issue appears in multiple locations (e.g., missing null check in 5 places), create **ONE** comment listing all locations:
107+
108+
```
109+
Found in: src/a.ts:45, src/b.ts:23, src/c.ts:89, src/d.ts:12, src/e.ts:67
110+
```

0 commit comments

Comments
 (0)