Docs

PR review

PR review reads the PR diff in full context and reasons about it statically — this is a pure code review: it does not install, build, or run the code (CI validates that the change actually works). It runs in two phases: an agent phase judges the diff and records its findings, then a deterministic phase posts one formal review with each finding as an inline comment anchored to its diff line (with an applyable suggestion where a concrete fix fits). A finding whose line isn't in the diff is folded into the review summary instead.

The review is precision-first: only high-signal Critical and Important findings are posted — each with a concrete impact (what breaks, for which input) and put through a self-refutation confidence gate — while lower-value suggestions and nits are dropped, because a noisy reviewer gets muted. A clean PR is approved with few or no comments.

Permission profile: review-write — can read the repo and post review comments, but cannot push code.

Pipeline

Review judge the diff Post inline comments

What it checks

  • Implementation correctness against the PR description
  • Test coverage for changed code
  • Security vulnerabilities (OWASP top 10)
  • Code style and naming consistency
  • Error handling and edge cases

Triggers

  • GitHub webhook: pr.opened event
  • Cron fallback: Every 30 minutes (only when webhooks are not configured)
  • Slack: review cliftonc/repo
  • CLI: npm run cli -- review owner/repo